Abstract: The rapid growth and increasing complexity of Internet of Things (IoT) devices have made network intrusion detection a critical challenge, especially in edge computing environments where data privacy is a primary concern. Machine learning-based intrusion detection techniques enhance IoT network security but often require centralized network data, posing significant risks to data privacy and security. Although federated learning (FL)-based network intrusion detection methods have emerged in recent years to address privacy concerns, they have not fully leveraged the advantages of graph neural networks (GNNs) for intrusion detection. To address this issue, we propose a federated spatiotemporal graph convolutional network (FedSTGCN) model, which integrates the capabilities of spatiotemporal GNNs (STGNNs) and federated learning. This framework enables collaborative model training across distributed IoT devices without requiring the sharing of raw data, thereby improving network intrusion detection accuracy while preserving data privacy. Extensive experiments are conducted on two widely used IoT intrusion detection datasets to evaluate the effectiveness of the proposed approach. The results demonstrate that FedSTGCN outperforms other methods in both binary and multiclass classification tasks, achieving over 97% accuracy in binary classification tasks and over 92% weighted F1-score in multiclass classification tasks.

FedSTGCN：一种基于联邦时空图学习的物联网网络入侵检测新方法

[1]Aburomman AA, Reaz MBI, 2016. A novel SVM-kNN-PSO ensemble method for intrusion detection system. Appl Soft Comput, 38:360-372.

[2]Aljuhani A, Kumar P, Kumar R, et al., 2023. Fog intelligence for secure smart villages: architecture and future challenges. IEEE Consum Electron Mag, 12(5):12-21.

[3]Almogren AS, 2020. Intrusion detection in Edge-of-Things computing. J Parall Distrib Comput, 137:259-265.

[4]Altaf T, Wang X, Ni W, et al., 2023. A new concatenated multigraph neural network for IoT intrusion detection. Int Things, 22:100818.

[5]Caville E, Lo WW, Layeghy S, et al., 2022. Anomal-E: a self-supervised network intrusion detection system based on graph neural networks. Knowl-Based Syst, 258:110030.

[6]Chatterjee P, Das D, Rawat DB, 2024. Federated learning empowered recommendation model for financial consumer services. IEEE Trans Consum Electron, 70(1):2508-2516.

[7]Chen Z, Lv N, Liu PF, et al., 2020. Intrusion detection for wireless edge networks based on federated learning. IEEE Access, 8:217463-217472.

[8]Dina AS, Siddique AB, Manivannan D, 2023. A deep learning approach for intrusion detection in Internet of Things using focal loss function. Int Things, 22:100699.

[9]Ghasempour A, 2019. Internet of Things in smart grid: architecture, applications, services, key technologies, and challenges. Inventions, 4(1):22.

[10]Hu XY, Gao WJ, Cheng G, et al., 2023. Toward early and accurate network intrusion detection using graph embedding. IEEE Trans Inform Forens Secur, 18:5817-5831.

[11]Huang XT, Liu J, Lai YX, et al., 2023. EEFED: personalized federated learning of execution & evaluation dual network for CPS intrusion detection. IEEE Trans Inform Forens Secur, 18:41-56.

[12]Khan NW, Alshehri MS, Khan MA, et al., 2023. A hybrid deep learning-based intrusion detection system for IoT networks. Math Biosci Eng, 20(8):13491-13520.

[13]Kipf TN, Welling M, 2017. Semi-supervised classification with graph convolutional networks. 5^th Int Conf on Learning Representations, p.1-14.

[14]Koroniotis N, Moustafa N, Sitnikova E, et al., 2019. Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: Bot-IoT dataset. Fut Gener Comput Syst, 100:779-796.

[15]Lei RZ, Wang PH, Zhao JZ, et al., 2023. Federated learning over coupled graphs. IEEE Trans Parall Distrib Syst, 34(4):1159-1172.

[16]Li BB, Wu YH, Song JR, et al., 2021. DeepFed: federated deep learning for intrusion detection in industrial cyber–physical systems. IEEE Trans Ind Inform, 17(8):5615-5624.

[17]Li XM, Zhang D, Zheng Y, et al., 2023. Evolutionary computation-based machine learning for smart city high-dimensional big data analytics. Appl Soft Comput, 133:109955.

[18]Lim WYB, Luong NC, Hoang DT, et al., 2020. Federated learning in mobile edge networks: a comprehensive survey. IEEE Commun Surv Tuto, 22(3):2031-2063.

[19]Lo WW, Layeghy S, Sarhan M, et al., 2022. E-GraphSAGE: a graph neural network based intrusion detection system for IoT. IEEE/IFIP Network Operations and Management Symp, p.1-9.

[20]Ma ZC, Liu L, Meng WZ, et al., 2023. ADCL: toward an adaptive network intrusion detection system using collaborative learning in IoT networks. IEEE Int Things J, 10(14):12521-12536.

[21]Mansour Bahar AA, Ferrahi KS, Messai ML, et al., 2024. FedHE-Graph: federated learning with hybrid encryption on graph neural networks for advanced persistent threat detection. Proc 19^th Int Conf on Availability, Reliability and Security, Article 119.

[22]Mao QH, Lin X, Xu WC, et al., 2025. FeCoGraph: label-aware federated graph contrastive learning for few-shot network intrusion detection. IEEE Trans Inform Forens Secur, 20:2266-2280.

[23]McMahan B, Moore E, Ramage D, et al., 2017. Communication-efficient learning of deep networks from decentralized data. Proc 20^th Int Conf on Artificial Intelligence and Statistics, p.1273-1282.

[24]Moustafa N, 2021. A new distributed architecture for evaluating AI-based security systems at the edge: network TON_IoT datasets. Sustain Cities Soc, 72:102994.

[25]Nguyen DC, Ding M, Pathirana PN, et al., 2021. Federated learning for Internet of Things: a comprehensive survey. IEEE Commun Surv Tutor, 23(3):1622-1658.

[26]Nguyen DC, Pham QV, Pathirana PN, et al., 2022. Federated learning for smart healthcare: a survey. ACM Comput Surv, 55(3):60.

[27]Nitish A, Hanumanthappa J, Shiva Prakash SP, et al., 2023. On-device context-aware misuse detection framework for heterogeneous IoT edge. Appl Intell, 53(12):14792-14818.

[28]Nuaimi M, Fourati LC, Hamed BB, 2023. Intelligent approaches toward intrusion detection systems for Industrial Internet of Things: a systematic comprehensive review. J Netw Comput Appl, 215:103637.

[29]Sangkatsanee P, Wattanapongsakorn N, Charnsripinyo C, 2011. Practical real-time intrusion detection using machine learning approaches. Comput Commun, 34(18):2227-2235.

[30]Sarhan M, Layeghy S, Portmann M, 2022. Towards a standard feature set for network intrusion detection system datasets. Mob Netw Appl, 27(1):357-370.

[31]Veličković P, Cucurull G, Casanova A, et al., 2018. Graph attention networks. 6^th Int Conf on Learning Representations, p.1-12.

[32]Wang YL, Li J, Zhao W, et al., 2023. N-STGAT: spatio-temporal graph neural network based network intrusion detection for near-Earth remote sensing. Remote Sens, 15(14):3611.

[33]Wu JP, Qiu GQ, Wu CM, et al., 2024. Federated learning for network attack detection using attention-based graph neural networks. Sci Rep, 14(1):19088.

[34]Yang Q, Liu Y, Chen TJ, et al., 2019. Federated machine learning: concept and applications. ACM Trans Intell Syst Technol, 10(2):12.

[35]Zeng ZR, Peng W, Zeng DT, 2022. Improving the stability of intrusion detection with causal deep learning. IEEE Trans Netw Serv Manag, 19(4):4750-4763.

[36]Zhou XK, Liang W, Li WM, et al., 2022. Hierarchical adversarial attacks against graph-neural-network-based IoT network intrusion detection system. IEEE Int Things J, 9(12):9310-9319.