💻 computer science

A Crowdsensing Intrusion Detection Dataset For Decentralized Federated Learning Models

This paper presents a large-scale crowdsensing intrusion detection dataset and an experimental study demonstrating that Decentralized Federated Learning (DFL) achieves competitive malware detection performance in IoT environments while preserving data locality, often outperforming Centralized Federated Learning (CFL).

Original authors: Chao Feng, Alberto Huertas Celdran, Jing Han, Heqing Ren, Xi Cheng, Zien Zeng, Lucas Krauter, Gerome Bovet, Burkhard Stiller

Published 2026-03-20

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Chao Feng, Alberto Huertas Celdran, Jing Han, Heqing Ren, Xi Cheng, Zien Zeng, Lucas Krauter, Gerome Bovet, Burkhard Stiller

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a massive neighborhood where everyone has a smart home device (like a thermostat, a camera, or a smart fridge). These devices are constantly watching their surroundings, collecting data about how the neighborhood is doing. This is called Crowdsensing.

However, there's a problem: some of these devices get infected by digital "germs" (malware). These germs try to steal data, crash the system, or turn the devices into zombies to attack others.

Traditionally, to catch these germs, you would have to send all the data from every single device to one giant, central computer (like a police station) to analyze it. But this has two big problems:

Privacy: You don't want to send your private home data to a central server.
Bottleneck: If the police station gets too busy or gets attacked, the whole system fails.

This paper introduces a new way to catch these digital germs without sending data anywhere. It's like teaching every neighbor to be a detective themselves, and then having them share their conclusions with each other, rather than sharing their private diaries.

Here is a breakdown of the paper's key parts using simple analogies:

1. The Dataset: A "Digital Crime Scene" Collection

The researchers built a massive library of evidence. They set up a test neighborhood with 8 Raspberry Pi computers (tiny, cheap computers that act like smart devices).

The Setup: They let these computers run normally for a while (the "Good Guy" state). Then, they infected them with 8 different types of "digital germs" (like Botnets, Ransomware, and Coinminers).
The Evidence: They didn't just look at network traffic. They watched everything: how much CPU the device used, what files were touched, what system commands were run, and even how the device's "brain" (kernel) reacted.
The Result: They collected over 21 million raw records of this behavior. To make it usable, they chopped this continuous stream of data into 30-second chunks. This resulted in a clean dataset of 342,000 snapshots, each describing what a device was doing in a 30-second window.

Analogy: Imagine filming a neighborhood for 288 hours straight. That's too much video to watch! So, they took a 30-second clip every hour, summarized what happened in that clip (e.g., "3 people ran," "1 door opened"), and wrote it down in a notebook. That notebook is their dataset.

2. The Method: Decentralized Federated Learning (DFL)

This is the core innovation. Instead of sending data to a central server, the devices learn together in a "peer-to-peer" network.

Centralized Learning (Old Way): All neighbors send their diaries to the Mayor. The Mayor reads them all, figures out what a criminal looks like, and tells everyone.
- Problem: The Mayor is a single point of failure, and everyone had to give up their privacy.
Federated Learning (Middle Way): Neighbors send their lessons learned to the Mayor, who averages them out and sends the "Global Lesson" back.
- Problem: The Mayor is still a single point of failure.
Decentralized Federated Learning (The New Way): There is no Mayor. The neighbors just talk to their immediate friends. Neighbor A learns something, tells Neighbor B, who tells Neighbor C. Eventually, the whole neighborhood learns the same thing without anyone ever seeing anyone else's private diary.

Analogy: Imagine a game of "Telephone," but instead of distorting the message, everyone is trying to solve a puzzle. Each person holds a piece of the puzzle (their local data). They only show their piece to their neighbors. They swap pieces of the solution (the model), not the pieces of the puzzle itself. Eventually, everyone has the full picture of what a "digital germ" looks like, but no one ever saw your specific puzzle piece.

3. The Experiment: Does it Work?

The researchers tested this new "neighborhood detective" system against the old "Mayor" system.

The Results: The decentralized system (DFL) performed almost as well as the centralized system, and in many cases, even better! It was very good at spotting the different types of malware.
The Trade-off: It was slightly slower to learn than the "Mayor" system because the information had to hop from neighbor to neighbor, but it was much more secure and private.
The "Poison" Test: They tried to trick the system by having some neighbors lie about what they saw (adversarial attacks). The system held up well against small lies, but if too many neighbors started lying (more than 50%), the system got confused. This is expected, just like a jury gets confused if half the witnesses are lying.

4. Why This Matters

This paper provides a blueprint and a toolbox for the future of IoT security.

Privacy First: You can detect malware without ever leaving your house (or device).
No Single Point of Failure: If one device goes down or gets hacked, the rest of the network keeps learning and protecting itself.
Realism: Unlike older datasets that were made up or only looked at network traffic, this one looks at the entire behavior of the device, making it much more realistic for catching modern, sneaky malware.

Summary

Think of this paper as the creation of a universal "Wanted Poster" training manual for smart devices. Instead of sending all the devices' private logs to a central cloud, the devices learn to recognize criminals by sharing their insights with their neighbors. This keeps your data private, makes the network harder to break, and proves that a group of small, independent devices can work together to stay safe.

1. Problem Statement

The rapid proliferation of Internet of Things (IoT) devices in crowdsensing environments introduces significant security challenges, particularly regarding malware and intrusion attacks. While Machine Learning (ML) is widely used for anomaly detection, traditional centralized approaches require transmitting raw data to a central server, raising severe privacy concerns and creating single points of failure.

Federated Learning (FL) offers a privacy-preserving alternative by training models locally. However, Centralized FL (CFL) still relies on a central aggregator, which remains a bottleneck and a vulnerability. Decentralized FL (DFL), which uses peer-to-peer topologies without a central server, is better suited for IoT crowdsensing but lacks suitable benchmark datasets. Existing datasets (e.g., NSL-KDD, CICIDS2017, Bot-IoT, TON_IoT) are either outdated, synthetic, or designed for centralized collection, failing to capture the heterogeneity, device-level behavioral diversity, and distributed nature required to evaluate DFL effectively.

2. Methodology

The authors developed a comprehensive framework for data collection, processing, and validation to create a realistic benchmark for DFL-based intrusion detection.

A. Experimental Environment & Data Collection

Hardware: An experimental testbed comprising eight heterogeneous IoT devices (six Raspberry Pi 3 and two Raspberry Pi 4) equipped with Software-Defined Radio (SDR) kits.
Scenarios: Devices operated under a benign state and eight distinct malware attack scenarios covering five major families:
- Botnets: Bashlite
- Backdoors: HttpBackdoor, Backdoor, TheTick
- Rootkits: Beurk, Bdvl
- Ransomware: Ransomware-PoC
- Coinminers: XMRig
Duration: 288 hours of continuous monitoring.
Behavioral Dimensions: Six key system dimensions were monitored locally on each device:
1. Resource Usage (CPU, memory, I/O)
2. Kernel Events
3. System Calls
4. Network Activity (TCP/UDP traffic)
5. Input/Output Operations (file entropy, block I/O)
6. File System Access

B. Data Processing Pipeline

Raw Data Collection: Generated 21,582,484 raw behavioral records.
Cleansing: Removed metadata (timestamps, device IDs), constant features, and imputed missing values with zeros.
Temporal Aggregation: Aligned heterogeneous logs into fixed 30-second time windows to balance temporal resolution with statistical stability.
Feature Extraction:
- Initial extraction yielded a 687-dimensional feature space.
- Feature Selection: Applied Chi-Squared, ANOVA F-value, and Mutual Information tests to identify the most discriminative features.
- Final Dataset: Reduced to a 32-dimensional feature set (normalized via min-max scaling) for lightweight DFL validation, while retaining the full 687-dimension set for broader research.
Output: A structured CSV dataset containing 342,106 records, organized by device and attack class.

C. Validation Framework

The dataset was evaluated using the Nebular DFL framework. Experiments compared:

Traditional ML (Centralized training).
Centralized FL (CFL) (Client-Server architecture).
Decentralized FL (DFL) (Peer-to-peer topologies: Fully Connected, Ring, Star).
Variables: Node counts (4, 8, 16, 32), data distributions (IID vs. Non-IID via Dirichlet $\alpha$ ), and adversarial conditions (Label Flipping attacks).
Model: A lightweight 3-layer Multilayer Perceptron (MLP) (32-128-9).

3. Key Contributions

Novel Dataset: The first crowdsensing dataset specifically designed for DFL, capturing real-world behavioral heterogeneity across six system dimensions from 288 hours of monitoring.
Comprehensive Malware Coverage: Includes 8 specific malware implementations across 5 families, ensuring diverse behavioral footprints (e.g., network flooding for botnets, file encryption for ransomware, CPU spikes for coinminers).
Feature Engineering: A rigorous pipeline transforming raw system logs into a 32-dimensional, highly discriminative feature set, alongside the full 687-dimensional raw feature space.
Benchmarking DFL: Extensive experimental validation demonstrating the dataset's utility in evaluating DFL performance under varying topologies, node scales, data heterogeneity (Non-IID), and adversarial attacks.

4. Results

Performance:
- Traditional ML achieved the highest accuracy (~0.96) but requires centralized data.
- DFL outperformed CFL in most configurations. For example, with 4 nodes, DFL (Fully Connected) achieved an F1 score of 0.950, compared to CFL's lower performance as node counts increased.
- DFL maintained competitive performance (F1 > 0.90) even with 8 nodes, proving its viability for privacy-preserving intrusion detection.
Scalability & Topology:
- Performance slightly decreased as node counts increased (due to data fragmentation per node).
- Network topology (Ring, Star, Fully Connected) had a minor impact on accuracy but significantly affected communication overhead. Fully connected topologies incurred the highest bandwidth costs.
Data Heterogeneity (Non-IID):
- Under moderate heterogeneity ( $\alpha=1$ ), performance remained stable (~0.93).
- Under extreme heterogeneity ( $\alpha=0.1$ ), accuracy dropped to ~0.81, highlighting the challenge of statistical skew in DFL.
Robustness:
- DFL tolerated up to 25% label-flipping poisoning (F1 ~0.84).
- Performance collapsed at 50% and 75% poisoning ratios, indicating a need for robust aggregation defenses in high-risk scenarios.
Confusion Analysis: The model achieved near-perfect classification for Rootkits (Beurk, Bdvl) and Coinminers, while showing some confusion between Backdoors and Botnets due to overlapping network behaviors.

5. Significance

This work addresses a critical gap in IoT security research by providing a realistic, distributed benchmark for Decentralized Federated Learning.

Privacy & Security: It enables the development of intrusion detection systems that preserve data locality, mitigating privacy risks associated with centralized data collection.
Scalability: The results validate that DFL can scale effectively in IoT crowdsensing environments without a central coordinator, enhancing system robustness against single points of failure.
Reproducibility: By releasing raw logs, full feature sets, and reduced feature sets, along with open-source code, the authors facilitate reproducible research in distributed learning, feature selection, and adversarial defense.
Future Impact: The dataset serves as a foundation for studying the trade-offs between communication overhead, model accuracy, and privacy in next-generation IoT security architectures.