FedIDS-IIoT: Federated Intrusion Detection Under Non-IID and Temporal Distribution Shift Using the CICAPT-IIoT Dataset

The increasing interconnection of industrial devices, programmable logic controllers, edge platforms, and networked control systems has expanded the attack surface of Industrial Internet of Things (IIoT) environments. Machine-learning-based intrusion detection can improve the identification of malicious activities, but centralized training requires the collection of distributed industrial data and may provide an unrealistic estimate of detector performance when evaluation relies on randomly partitioned traffic. Federated learning offers a data-local alternative; however, its effectiveness can be affected by non-independent and identically distributed (non-IID) client data and temporal changes in attack and network behavior. This study presents FedIDS-IIoT, a federated intrusion detection framework evaluated using the CICAPT-IIoT dataset, with particular emphasis on non-IID attack distributions and temporal distribution shift. Sample-size-weighted federated averaging (FedAvg) is evaluated across controlled client configurations in which attack observations are progressively concentrated among five simulated clients. A training-only feature-selection procedure is used to derive a compact 20-feature representation, while model selection and operating-threshold determination are completed before evaluation on a chronologically later and previously untouched traffic block. The federated detector is evaluated against a centralized XGBoost reference and two matched federated optimizers, FedProx and FedAdam, under the same development protocol and feature representation. In the matched federated comparison, FedAvg achieves the highest F1-score in the mild and moderate development partitions, whereas FedProx is marginally higher in the severe partition (0.9643 vs. 0.9633). This result is interpreted as an optimizer-dependent operating trade-off rather than evidence of universal FedAvg superiority. Under the frozen operating threshold, FedAvg also produces substantially fewer false positives on the temporal test set. The non-IID experiments indicate that moderate differences in attack distribution have limited impact, whereas severe concentration of attack evidence can reduce detection performance. A paired McNemar test confirms that the difference in temporal error behavior between the two detectors is statistically significant, and a cost analysis shows that the federated detector needs only a few thousand parameters and a few megabytes of communication over the entire training run. The MADQN component is treated as a secondary exploratory simulation and is not presented as real-life network-response validation. These findings demonstrate the importance of evaluating federated IIoT intrusion detection under both client-level distribution heterogeneity and temporal distribution shift rather than relying solely on conventional random train–test evaluation.