Incremental Federated Learning for Intrusion Detection in IoT Networks under Evolving Threat Landscape

Imagine you are the head of security for a massive, smart city where millions of devices (like smart thermostats, medical monitors, and smart fridges) are all connected. This is the Internet of Things (IoT).

The problem? Bad guys (hackers) are constantly inventing new ways to break in. One day they try to flood the network with traffic; the next day they try to trick the devices into lying about their identity.

The Old Way vs. The New Way

The Old Way (Centralized Learning):
Imagine you have a giant security camera in a central tower. You send all the footage from every device in the city to this tower to analyze it.

The Problem: This is a privacy nightmare (everyone's data is in one place) and it's slow (sending all that video takes forever). Also, if the tower gets overwhelmed, the whole city is blind.

The New Way (Federated Learning):
Instead of sending the video to the tower, you send a "security guard" (the AI model) to every single device. The guard learns locally, figures out what a "bad guy" looks like, and then just sends a tiny report back to the tower: "I learned that red cars are suspicious." The tower combines all these tiny reports to make a smarter global guard.

The Benefit: Privacy is preserved (no data leaves the device), and it's faster.

The Big Challenge: "The Moving Target"

Here is the catch: Hackers change their tactics every day. This is called Concept Drift.

The Analogy: Imagine you trained your security guard to spot a thief wearing a red hat.
Day 1: The guard is perfect.
Day 2: The thief switches to a blue hat.
Day 3: The thief wears a green hat.

If your guard only remembers the red hat, they will miss the new thieves. This is called Catastrophic Forgetting—the AI learns the new trick so well that it completely forgets the old tricks.

What This Paper Did

The researchers asked: "How do we keep our security guards smart enough to learn new tricks without forgetting the old ones, while not burning out their batteries?"

They set up a simulation using a dataset of medical devices (IoMT) and created a timeline of attacks. They tested different "study strategies" for the AI guards:

The "Static" Guard: You train the guard once and never update them.
- Result: They get good at the first attack, but fail miserably when the hackers change tactics.
The "Simple" Guard: You teach the guard the new trick, but you throw away the old textbook.
- Result: They learn the new trick, but immediately forget how to spot the old ones.
The "Cumulative" Guard: You keep every single textbook from every day and re-read them all every time you learn a new trick.
- Result: They are the smartest and catch everything. BUT, it takes them forever to study, and they burn out the device's battery.
The "Representative" Guard: You teach the new trick, but you keep just one perfect example of every old trick in your pocket to remind you.
- Result: They stay smart, remember the old tricks, and don't take too long to study.
The "Retention" Guard: You teach the new trick, but you keep a small "cheat sheet" (100 or 500 examples) of the old stuff.
- Result: This was the sweet spot. They were almost as smart as the "Cumulative" guard but much faster and lighter on resources.

The Verdict

The paper found that you don't need to retrain the whole system from scratch every time a hacker changes their hat color.

The Winner: Keeping a small, curated memory of past attacks (Retention) or keeping one example of every type of attack (Representative) works best.
The Trade-off: If you want the absolute highest accuracy and have unlimited power, retrain everything. But for real-world IoT devices (which have weak batteries and slow processors), the "small memory" approach is the winner. It's like carrying a pocket-sized cheat sheet instead of a library of books.

Why This Matters

This research helps us build security systems that can evolve with hackers. Instead of needing to shut down the whole network to update the software, these systems can learn on the fly, protecting our smart homes and hospitals from new threats without slowing down or leaking our private data.

Here is a detailed technical summary of the paper "Incremental Federated Learning for Intrusion Detection in IoT Networks under Evolving Threat Landscape" (arXiv:2603.10776v1).

1. Problem Statement

The rapid expansion of the Internet of Things (IoT), particularly in healthcare (IoMT), has expanded the attack surface, necessitating robust Intrusion Detection Systems (IDS). While Machine Learning (ML) and Federated Learning (FL) offer privacy-preserving and distributed training capabilities, traditional FL models suffer from concept drift. As attackers develop new techniques, the underlying data distribution changes, causing stationary models to degrade over time.

The core challenges addressed in this study are:

Catastrophic Forgetting: When models are updated incrementally to learn new attack patterns, they often "unlearn" previously learned concepts.
Resource Constraints: IoT devices have limited computational power, making full retraining of models infeasible.
Dynamic Threat Landscape: Existing IDS studies often assume static attack distributions, failing to address the continuous evolution of cyber threats in a non-stationary environment.

2. Methodology

Dataset and Experimental Setup

Dataset: The study utilizes the CICIoMT2024 dataset, which contains network traffic from 40 devices (25 real, 15 simulated) covering 18 cyberattacks across five major categories: MQTT, DoS, DDoS, Reconnaissance, and Spoofing.
Temporal Drift Simulation: The authors constructed a realistic timeline ( $t_0$ $t_{0}$ to $t_6$ $t_{6}$ ) where new attack families are introduced sequentially to simulate evolving threat distributions:
- $t_0$ : Baseline with one representative attack per category.
- $t_1$ – $t_5$ : Sequential introduction of full attack families (MQTT $\to$ DoS $\to$ DDoS $\to$ Recon $\to$ Spoofing).
- $t_6$ : Final testing phase with no new training data.
Architecture: A multi-layer LSTM (Long Short-Term Memory) model with five hidden layers (128 units each) was used as the classifier due to its effectiveness in modeling sequential network traffic.
Federated Setting: Implemented using the Flower framework with 5 clients using IID (Independent and Identically Distributed) partitioning to isolate temporal drift effects from data heterogeneity.

Proposed Strategies

The study benchmarks six distinct training strategies to handle concept drift:

Static Training: A model trained once at the start and never updated (baseline for drift impact).
Cumulative Incremental Learning: The model is retrained at each time step using all previously observed data plus new data.
Simple Incremental Learning: The model is updated only with newly introduced attack classes, discarding all historical data (prone to forgetting).
Representative Incremental Learning: At each step, the model trains on new attacks plus one representative sample from every other category to maintain a balanced 6-class label space.
Incremental Learning by Retention: The model retains a small, fixed buffer of historical samples (100, 500, or 1000) from previous periods while training on new data.
Averaging Variants: Model parameters are initialized by averaging weights from previous models (Equal, Sample-weighted, and EMA).

3. Key Contributions

Systematic Benchmarking: This is the first study to provide a systematic evaluation of incremental FL strategies under explicitly modeled temporal drift in a distributed IoT environment.
Granular Analysis: The work evaluates both binary (Benign vs. MQTT) and 6-class classification tasks, offering insights into how different attack families interact and cause drift.
Efficiency vs. Accuracy Trade-off: The study quantifies the trade-offs between detection accuracy, catastrophic forgetting, and computational latency (training/inference time).
Novel Timeline Construction: A controlled experimental timeline ( $t_0$ – $t_6$ ) was designed to simulate realistic, sequential attack evolution, ensuring fair comparison across methods.

4. Results

Accuracy Performance

Binary Classification:
- Representative Incremental Learning achieved the highest average accuracy (95.73%), slightly outperforming Cumulative Incremental Learning (93.30%) while being more computationally efficient.
- Retention-based methods (100–1000 samples) performed strongly (91.92%–92.74%), proving that small memory buffers effectively stabilize decision boundaries.
- Simple Incremental and Averaging methods failed significantly in later time periods (dropping to ~45–58% at $t_6$ ), demonstrating severe catastrophic forgetting.
6-Class Classification:
- Cumulative Incremental Learning achieved the best average accuracy (66.7%), confirming that full re-optimization yields the highest performance if resources allow.
- Representative and Retention methods followed closely (64.5% and ~64%, respectively).
- Simple Incremental deteriorated rapidly, falling to 9.1% at $t_6$ , highlighting its inability to retain multi-class boundaries.
- Static models failed to adapt, maintaining high accuracy only at the initial baseline ( $t_0$ ) before collapsing.

Latency and Efficiency

Training Latency: Cumulative Incremental Learning incurred the highest cost (688.8s for binary, 603.5s for 6-class).
Efficient Alternatives: Retention-based methods reduced training time by more than 50% (e.g., ~255s–318s) while maintaining competitive accuracy.
Inference Latency: Inference time remained constant (~2.0–2.4s) across all strategies, indicating that the LSTM architecture, not the adaptation method, dominates runtime costs.

Drift Analysis

Attack Divergence: The study found that MQTT and DDoS exhibit the strongest distributional divergence. Models trained on one performed poorly on the other, causing significant accuracy drops when these distinct families were introduced sequentially.
Knowledge Transfer: Learning DoS attacks helped improve DDoS detection (high similarity), whereas the introduction of distinct categories (like MQTT vs. DoS) caused immediate performance degradation.

5. Significance and Conclusion

This paper demonstrates that Federated Learning combined with Incremental Learning is a viable solution for maintaining robust IDS in evolving IoT environments.

Practical Implication: For resource-constrained IoT devices, Representative Incremental Learning and Retention-based methods offer the optimal balance. They prevent catastrophic forgetting without the prohibitive computational cost of full cumulative retraining.
Future Directions: The authors suggest future work should explore non-IID client distributions (more realistic for IoT), adaptive drift detection mechanisms to trigger updates dynamically, and the handling of emerging classes that appear only on a subset of clients.

In summary, the study provides a roadmap for developing resilient, non-stationary IDS solutions that can adapt to new cyber threats in real-time while respecting the privacy and resource limitations of IoT networks.