Centralized pre-training with aggregation-free distributed simulation for privacy-preserving IoT intrusion detection

Abstract

This paper proposes Centralized Pre-training with Aggregation-Free Distributed Simulation for Privacy-Preserving IoT Intrusion Detection, a framework designed for residential smart home IoT networks. It utilizes centralized pre-training followed by an aggregation-free distributed simulation via virtual clients. This enables independent local fine-tuning on private data partitions without any model aggregation, gradient sharing, or data exchange, thereby eliminating communication and consensus overhead while ensuring complete data locality and privacy. It employs an ultra-lightweight (10.64 KB) int8-quantized TensorFlow Lite model that achieves 99.31 % accuracy, 99.28 % precision, 99.34 % recall, and 99.31 % F1-score in binary classification on the CICIoT2023 dataset using only 15 selected features. The model enables sub-millisecond inference on constrained gateways. Dynamic per-attack SHAP explanations provide interpretable feature attribution, which are embedded in structured JSON evidence records hashed via SHA-256 for tamper-resistance. The hash is optionally anchored to a public blockchain using lightweight zero-value transactions on the Ethereum Sepolia testnet for immutable verification. Extensive experiments on CICIoT2023 demonstrate competitive performance with strong emphasis on privacy, efficiency, and residential suitability, with negligible accuracy variance across heterogeneous virtual clients. IT offers a practical integration of lightweight detection, explainability, and forensic capabilities for resource-constrained IoT environments.