💻 computer science

Personalized Federated Intrusion Detection for Non-IID IIoT Traffic via DDPG-Guided Adaptive Aggregation

This paper proposes PAEDDPG, a personalized federated learning framework that utilizes a Deep Deterministic Policy Gradient agent to adaptively aggregate models and a client-specific autoencoder decoder to effectively address Non-IID and class-imbalanced IIoT traffic, significantly improving detection performance for rare attack classes while preserving data privacy.

Original authors: Junyi Hou, Wenzhong Yang, Yabo Yin, Shuying Xu

Published 2026-10-07

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Junyi Hou, Wenzhong Yang, Yabo Yin, Shuying Xu

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the modern industrial world, factories and power grids are increasingly run by networks of smart sensors and machines that talk to each other constantly. This interconnected system, known as the Industrial Internet of Things, allows for real-time monitoring and automated production, but it also opens the door to cyberattacks that can halt operations or damage expensive equipment. To stop these threats, engineers use intrusion detection systems, which act like security guards scanning network traffic for signs of malicious activity. Traditionally, these systems were trained on a massive, central computer that held data from every factory. However, this approach raises serious privacy concerns, as companies are often unwilling to share their raw operational data, and it creates a single point of failure if that central server is compromised.

To solve this, researchers have turned to a method called federated learning. Imagine a group of students trying to solve a difficult math problem. Instead of all bringing their notebooks to a teacher who copies everything into one giant book, each student works on their own copy of the problem at home. They only send their final answers to the teacher, who combines them to create a better solution for everyone. This way, the students keep their private notes safe, but they still benefit from the collective wisdom of the group. In the industrial world, this means each factory can train a security model on its own local data without ever revealing what that data looks like. The challenge, however, is that every factory is different. One might see mostly normal traffic with occasional hacking attempts, while another might be under constant attack from a specific type of virus. When you try to blend these very different experiences into a single global model, the result often fails to protect the most vulnerable sites, especially those facing rare or unusual attacks.

A team of researchers at Xinjiang University has developed a new approach to fix this problem, called PAEDDPG. Their work addresses the specific issue that standard methods struggle with when the data from different factories does not look the same. In a typical setup, the central server simply averages the updates sent by each factory, assuming that every factory contributes equally to the solution. The researchers found that this "one-size-fits-all" averaging is flawed because it lets the factories with the most common traffic patterns drown out the unique signals from factories facing rare attacks. To counter this, they created a system where the central server learns how to weigh the contributions from each factory dynamically, rather than using a fixed rule.

The core of their solution involves two clever mechanisms working in tandem. First, on the local side, each factory keeps a private component of the security model that never leaves its premises. While the main part of the model is shared with the central server to learn general patterns, this private piece helps the local model remember the specific quirks of that factory's network. It acts as a regularizer, ensuring that the shared model does not forget the unique characteristics of the local data while it learns. This allows the factory to maintain a personalized detector that is highly tuned to its own environment, all while keeping the raw data and the private model components completely secure.

Second, on the central server, the researchers introduced an artificial intelligence agent that decides how much to trust each factory's update. Instead of just counting how many data points a factory has, this agent analyzes the changes the factory made to the model and compares them with the changes made by others. It looks for signs that a factory is contributing useful knowledge about rare attacks versus just repeating what is already known. The agent is trained using a reward system that specifically values the detection of rare and difficult attack types, rather than just overall accuracy. If a factory helps the group get better at spotting a rare threat, the agent learns to give that factory more influence in the next round of training. This process happens continuously, allowing the system to adapt as the network conditions change.

The researchers tested this new framework using two large, real-world datasets of industrial network traffic, one containing over half a million samples and the other nearly half a million. They simulated a scenario where six different factories had very different types of traffic, with some facing common attacks and others facing extremely rare ones. In these difficult conditions, their new method consistently outperformed existing techniques. Most notably, when it came to detecting the rarest attack types, their system improved the success rate by about 18 percentage points compared to the best previous method. For example, on one dataset, the new system correctly identified 85.25% of the rarest attacks, whereas the previous best method only caught 67%.

Beyond just being more accurate, the new system was also more stable. The researchers observed that their method reached a high level of performance faster and with less fluctuation than the older methods. This suggests that the system is not just lucky in its results, but is genuinely learning a better way to collaborate. The study also showed that removing either the private local component or the intelligent server agent caused performance to drop, proving that both parts are necessary for the system to work effectively. The researchers noted, however, that their current work assumes all factories are participating and honest. They acknowledged that future work would need to address what happens if a factory goes offline or if a malicious actor tries to trick the system.

Ultimately, this research offers a promising path forward for securing industrial networks without compromising privacy. By allowing factories to keep their data local while still benefiting from a smart, adaptive collaboration, the system provides a robust defense against the evolving landscape of cyber threats. The findings suggest that the future of industrial security lies not in a single, monolithic model, but in a flexible network where every participant's unique experience is valued and weighted according to its actual contribution to safety.

Technical Summary: Personalized Federated Intrusion Detection for Non-IID IIoT Traffic via DDPG-Guided Adaptive Aggregation

Problem Statement

The Industrial Internet of Things (IIoT) faces escalating cyber threats, necessitating robust Intrusion Detection Systems (IDS). While Federated Learning (FL) allows distributed clients to collaboratively train models without sharing raw traffic, standard FL approaches struggle with the reality of IIoT data: it is inherently Non-IID (non-independent and non-identically distributed) and class-imbalanced.

Client Drift: Different industrial sites observe varying normal behaviors and attack exposures, causing optimization directions to diverge. A single global model often fails to generalize across these heterogeneous distributions.
Minority Class Neglect: Standard aggregation (e.g., FedAvg) tends to favor majority classes (normal traffic) or dominant clients, leading to poor recall on rare attack classes (e.g., Man-in-the-Middle, specific malware).
Limitations of Existing Solutions: Current FL-IDS methods rely on fixed aggregation rules or static personalization strategies (e.g., fixed layer splitting) that do not dynamically adapt to the empirical utility of each client's contribution. Furthermore, existing Deep Reinforcement Learning (DRL) approaches for aggregation often lack integration with privacy-preserving local personalization or are not specifically tuned for minority-sensitive IDS objectives.

Methodology: PAEDDPG Framework

The authors propose PAEDDPG (Personalized AutoEncoder–Deep Deterministic Policy Gradient), a framework that combines on-device personalization with server-side adaptive aggregation.

1. Client-Side: Private Reconstruction Decoder
Each client $k$ maintains a shared model (feature extractor $g_\theta$ and classifier $h_\theta$ ) and a client-private reconstruction decoder $\psi_{\phi_k}$ .

Local Objective: The client minimizes a combined loss function:
$L_k^{local} = \ell_{ce}(h_\theta(g_\theta(x)), y) + \lambda_{rec} \| \psi_{\phi_k}(g_\theta(x)) - x \|_2^2$
The first term is supervised classification loss; the second is a self-supervised reconstruction loss.
Privacy & Personalization: The decoder is trained only on local data and never uploaded. It acts as a regularizer, forcing the shared encoder to preserve client-specific feature statistics (crucial for rare classes) without exposing raw data or decoder parameters.
Communication: Only the updated shared model parameters ( $\theta_k$ ) are uploaded, maintaining the same communication payload as standard FedAvg.

2. Server-Side: DDPG-Guided Adaptive Aggregation
The server employs a Deep Deterministic Policy Gradient (DDPG) agent to learn optimal aggregation weights dynamically.

State ( $s_t$ ): Constructed from the participating clients' encoder update statistics, including:
- Sample ratio ( $\rho_k$ ): Data quantity contribution.
- Update norm ( $\nu_k$ ): Magnitude of local model change.
- Average update distance ( $\bar{d}_k$ ) and cosine similarity ( $\bar{c}_k$ ): Measures of divergence and consistency with other clients.
Action ( $a_t$ ): The agent outputs a probability-simplex vector of weights ( $w_k$ ) for aggregating the shared models: $\theta_t = \sum w_k \theta_k$ .
Reward ( $r_t$ ): A minority-sensitive reward based on the round-to-round improvement of three metrics on a server-side validation set:
$r_t = 100 \times (\beta_1 \Delta \text{Macro-F1} + \beta_2 \Delta \text{BalancedAcc} + \beta_3 \Delta \text{WorstClassRecall})$
This explicitly steers the agent to prioritize collaboration that improves detection of rare attack classes rather than just overall accuracy.

Key Contributions

Novel Architecture: A client-server design coupling a shared global model with a client-private reconstruction decoder. This induces personalization via self-supervised learning while preserving privacy and keeping communication costs identical to standard FL.
Adaptive Aggregation via DDPG: Formulating aggregation weight selection as a continuous control problem. A single server-side agent learns to map encoder-update statistics to aggregation weights, avoiding the overhead of per-client policies and adapting to the current collaboration status.
Minority-Sensitive Reward Design: An IDS-oriented reward function combining Macro-F1, Balanced Accuracy, and Worst-Class Recall. This ensures the learned aggregation policy actively mitigates negative transfer and enhances rare-attack detection under heterogeneous and imbalanced traffic.

Experimental Results

The framework was evaluated on Edge-IIoTset and NF-ToN-IoT-v3 under IID and three Non-IID settings ( $\alpha \in \{1.0, 0.5, 0.1\}$ ).

Performance: PAEDDPG consistently outperformed baselines (FedAvg, FedProx, FedProto, MOON, FedGH) in Macro-F1, Balanced Accuracy, and Worst-Class Recall.
Rare Class Detection: Under the strongest Non-IID setting ( $\alpha=0.1$ $α = 0.1$ ) on Edge-IIoTset:
- PAEDDPG achieved a Worst-Class Recall of 85.25%, an improvement of approximately 18 percentage points over the best baseline (FedProto at 67.00%).
- It was the only method to maintain per-class recall above 85% for all attack classes.
Convergence: The method demonstrated fast and stable convergence, reaching 90% of its final performance within ~30 rounds with significantly lower round-to-round fluctuation compared to baselines.
Ablation Study: Removing any component (Private Decoder, DDPG, or the full Reward) degraded performance. The DDPG-based aggregation was identified as the dominant factor, while the private decoder and specific reward design provided consistent, complementary improvements.

Significance and Claims

The paper claims that PAEDDPG addresses a critical gap in Non-IID federated intrusion detection by jointly optimizing privacy-preserving local adaptation and task-driven adaptive aggregation.

Significance: Unlike existing methods that either fix the collaboration structure a priori or rely on generic robustness objectives, PAEDDPG dynamically learns how much each client should contribute based on empirical feedback regarding rare-class detection.
Modesty: The authors acknowledge limitations, noting that the current framework does not yet account for adversarial threats (e.g., malicious clients manipulating aggregation weights) or dynamic client participation (client dropout/churn), which are common in real-world IIoT deployments. Future work is proposed to address these robustness and dynamic availability challenges.