💻 computer science

Towards Securing IIoT: An Innovative Privacy-Preserving Anomaly Detector Based on Federated Learning

This paper proposes a novel Federated Learning framework for Industrial IoT that enhances privacy through Homomorphic Encryption and improves efficiency via a dynamic agent selection scheme to mitigate straggler effects, resulting in superior anomaly detection performance compared to baseline approaches.

Original authors: Samira Kamali Poorazad, Chafika Benzaïd, Tarik Taleb

Published 2026-04-08

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Samira Kamali Poorazad, Chafika Benzaïd, Tarik Taleb

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a massive factory floor filled with hundreds of smart machines (robots, sensors, and controllers). These machines are part of the Industrial Internet of Things (IIoT). They talk to each other to keep production running smoothly. But, just like in any busy city, there are bad actors trying to hack them, send fake commands, or steal secrets.

To stop these hackers, the factory needs a "security guard" that can spot strange behavior (anomalies) instantly. Traditionally, all the machines would send their private data to a central brain (a server) to be analyzed. But this is risky: if the central brain gets hacked, all the factory's secrets are exposed. Plus, sending all that data takes too long and clogs the network.

This paper proposes a new, smarter way to train this security guard called DyHFL. Here is how it works, explained through simple analogies:

1. The Problem: The "Wait for the Slowest" Dilemma

Imagine a group of students trying to solve a math problem together.

Old Way (Synchronous): The teacher says, "Everyone must finish their homework and hand it in before I can grade the next chapter." If one student is slow (a "straggler"), the whole class waits. This is frustrating and slow.
The Other Old Way (Asynchronous): The teacher grades homework the moment it arrives. This is fast, but the teacher gets overwhelmed with papers arriving at random times, and the grading gets messy.
The Privacy Problem: In both cases, students have to show their raw homework (their private data) to the teacher. If the teacher is curious or the classroom is bugged, secrets get out.

2. The Solution: The "Secret Note" System (Federated Learning + Encryption)

Instead of sending their raw homework, the students use a special magic ink (Homomorphic Encryption).

They write their answers on a piece of paper using this ink.
They send the paper to the teacher.
The teacher can add up the answers and do math on the encrypted paper without ever seeing the actual numbers.
Only the students have the "decoder ring" (private key) to read the final result.
Result: The teacher learns the correct answer for the whole class, but never sees any individual student's private data.

3. The Innovation: The "Smart Traffic Cop" (Dynamic Agent Selection)

Even with the magic ink, the factory still has a problem: some machines are fast, and some are slow (due to old hardware or bad internet). If the system waits for the slow ones, it's too slow. If it ignores them, the security guard learns from a biased view of the factory.

The authors created a Dynamic Traffic Cop to manage this:

The Sliding Window: Instead of picking the same students every time, the system watches the students over a short period (a "sliding window").
The Scorecard: It doesn't just look at who is fast. It looks at three things:
1. How fast did they do the math? (Training time)
2. How fast did they send the paper? (Communication time)
3. How much homework did they have? (Data size)
The Threshold: The system calculates a "speed limit." If a machine finishes its work and sends the secret note before the speed limit, it gets to participate in the next round. If it's too slow, it sits out for now, but the system keeps watching. If it speeds up later, it gets back in.
Why this is cool: It's fair. It doesn't just pick the "rich" fast machines; it gives the "slow" machines a chance to catch up, ensuring the security guard learns from everyone without getting stuck waiting forever.

4. The Results: A Faster, Safer Factory

The researchers tested this system on real industrial data (like gas pipelines and power grids) and compared it to other methods.

Speed: It reached the "target accuracy" (became a good security guard) much faster than the old methods. In some cases, it was 100 times faster!
Fairness: It made sure both fast and slow machines got to participate, so the security guard didn't get biased.
Privacy: Because of the magic ink, even if a hacker intercepted the messages, they would just see gibberish.
Efficiency: It sent fewer messages back and forth, saving bandwidth and energy.

The Big Picture

Think of DyHFL as a secure, high-speed relay race where:

Runners (machines) never show their secret training logs to the coach.
They pass a baton (encrypted model updates) that the coach can combine without opening it.
A smart referee (the dynamic selection) ensures the race keeps moving by letting the fast runners go early and giving the slow runners a fair chance to join in later, rather than letting the slowest runner hold up the whole team.

This makes industrial factories safer from hackers, protects their trade secrets, and keeps the production line moving at top speed.

1. Problem Statement

The Industrial Internet of Things (IIoT) faces increasing cybersecurity threats, including command injection, denial-of-service (DoS), and model inversion attacks. While centralized machine learning (ML) can detect these anomalies, it requires transferring raw data to a central server, creating significant privacy risks and a single point of failure.

Federated Learning (FL) offers a privacy-preserving alternative by training models locally and sharing only parameters. However, existing FL approaches in IIoT environments suffer from three critical limitations:

Privacy Vulnerabilities: Standard FL is vulnerable to "honest-but-curious" servers and eavesdroppers who can infer sensitive data from model updates (e.g., via model inversion attacks).
The Straggler Effect: In Synchronous FL (SyncFL), the server must wait for the slowest device (straggler) to complete training before aggregating, causing severe delays in heterogeneous IIoT networks with varying computational resources.
Communication Bottlenecks & Fairness: Asynchronous FL (AsyncFL) avoids waiting but creates communication bottlenecks and model staleness. Buffered FL approaches (like FedBuff) attempt to balance these but often introduce bias toward fast agents, excluding slow agents and reducing model generalization. Furthermore, existing dynamic selection methods often rely on static criteria (e.g., only training time in the first round) and fail to adapt to fluctuating IIoT conditions.

2. Methodology: The DyHFL Framework

The authors propose DyHFL (Dynamic Homomorphic Encryption-based Federated Learning), a novel framework designed to simultaneously address privacy, stragglers, and fairness. The framework consists of two core components:

A. Privacy Preservation via Homomorphic Encryption (HE)

Mechanism: DyHFL integrates the Paillier cryptosystem (an additive homomorphic encryption scheme).
Process:
1. A trusted third party generates public/private key pairs.
2. Industrial agents encrypt their local model updates (weights/gradients) using the public key before transmission.
3. The aggregator server performs homomorphic aggregation (summing encrypted values) without ever decrypting individual updates.
4. The encrypted global model is sent back to agents, who decrypt it using their private keys.
Benefit: This prevents the server and external eavesdroppers from inferring raw data or individual model parameters, effectively mitigating model inversion attacks while maintaining model accuracy (unlike Differential Privacy, which adds noise).

B. Dynamic Agent Selection & Buffering

To solve the straggler effect and ensure fairness, DyHFL employs a sliding window-based dynamic selection strategy rather than static selection.

Two-Phase Training:
1. Preliminary Rounds (Sliding Window): The first $P$ $P$ rounds (where $P = T/c$ $P = T / c$ ) are used to estimate a dynamic time threshold. During this phase, the system monitors three metrics for every agent:
  - Training Time: Reflects computational capacity.
  - Communication Time: Reflects network latency (upload/download).
  - Local Data Size: Reflects workload imbalance.
2. Subsequent Rounds: The system calculates a Long-Term Threshold (LT Thrsh) using an Exponentially Weighted Moving Average (EWA) of Short-Term thresholds derived from the preliminary rounds.
Selection Logic:
- Agents are categorized as "fast" or "slow" based on a Global Metric (GM): $GM = \alpha(T_{train} + T_{comm}) + \beta(DataSize)$ .
- The server aggregates updates from agents whose performance metrics fall below the dynamic threshold.
- Weighted Average Metrics (WAM): A weighting function is applied to ensure slower agents are not permanently excluded, balancing the participation of fast and slow agents to prevent bias.

3. Key Contributions

Novel Framework: Development of DyHFL, which uniquely combines Homomorphic Encryption with a dynamic, sliding-window-based agent selection mechanism.
Dynamic Fairness: Introduction of a tri-metric evaluation (training time, communication time, data size) that continuously adapts to heterogeneous IIoT environments, ensuring fair participation of both fast and slow agents across all training rounds (unlike previous methods that select agents only once).
Privacy-Accuracy Trade-off: Demonstrating that HE can be used for privacy without the accuracy degradation associated with Differential Privacy or the high overhead of Multi-Party Computation (MPC).
Comprehensive Evaluation: Rigorous testing across three distinct industrial datasets (Gas Pipeline, WUSTL IIoT, Edge IIoT) under identical and non-identical (Dirichlet/No-Label-Skew) data distributions.

4. Experimental Results

The framework was evaluated against five baselines: SyncFL, AsyncFL, FedBuff, ASR Fed, and BFL.

Convergence Speed: DyHFL significantly outperformed all baselines.
- On the Gas Pipeline dataset (non-identical data), DyHFL converged 16.3x faster than AsyncFL and 14.18x faster than FedBuff.
- On the WUSTL IIoT dataset, it was 158x faster than AsyncFL on non-identical data.
- Statistical t-tests confirmed these improvements are significant ( $p < 0.05$ , often $p < 10^{-10}$ ).
Agent Selection Fairness:
- Straggler Rate Selection (SRS): DyHFL achieved an average SRS of 56.44%, nearly double that of the BFL baseline (29.62%). This proves DyHFL successfully includes slow agents that other methods exclude.
- Fast Rate Selection (FRS): DyHFL maintained a consistent 100% selection rate for fast agents, ensuring efficiency is not sacrificed for fairness.
Communication Costs: By reducing the number of rounds and selectively aggregating, DyHFL reduced communication costs significantly compared to SyncFL and AsyncFL, especially as the number of agents increased.
Model Performance: DyHFL achieved the highest Accuracy, Precision, and F1-Scores across all datasets and distribution types, demonstrating robustness against data heterogeneity.
Ablation Study: Confirmed that the dynamic agent selection is the primary driver for speed and efficiency improvements, while HE provides privacy with negligible impact on convergence speed or model accuracy.

5. Significance and Conclusion

This paper presents a critical advancement for securing IIoT systems. By integrating Homomorphic Encryption with a dynamic, fairness-aware agent selection strategy, DyHFL solves the "trilemma" of privacy, efficiency, and fairness in industrial settings.

Practical Impact: It enables real-time anomaly detection in IIoT without compromising data privacy or waiting for slow devices, making it suitable for critical infrastructure (e.g., power grids, manufacturing).
Scientific Contribution: It moves beyond static or single-round selection methods, proving that continuous adaptation to agent performance metrics is essential for robust Federated Learning in heterogeneous environments.
Future Directions: The authors suggest integrating Distributed Key Generation (DKG) to remove the trusted third party and using quantized encryption to further reduce computational overhead for low-power sensors.

In summary, DyHFL offers a superior, scalable, and secure solution for anomaly detection in the Industrial Internet of Things, outperforming state-of-the-art methods in convergence speed, communication efficiency, and model fairness.