Cybersecurity in Edge Computing: A Trust-Aware Federated Hybrid Intrusion Detection Framework
This paper proposes TA-FHIDF, a federated intrusion-detection framework for edge/IoT environments that runs a hybrid local deep model combining an autoencoder, 1D-CNN, and BiLSTM to learn spatial-temporal attack patterns while keeping raw telemetry on local gateways. What’s interesting is the trust-aware server aggregation that scores client updates by cosine similarity to blunt poisoning/Byzantine behavior, and the multi-dataset results suggest strong accuracy and robustness, though the abstract leaves open practical questions around edge-device overhead, non-IID client drift, and whether adaptive attackers could game the similarity-based trust score.
Abstract
Edge computing has emerged as a critical computing paradigm in modern distributed systems by migrating data processing closer to end users and Internet of Things (IoT) devices. While this paradigm decentralizes processes, minimizes latency, and reduces backhaul bandwidth congestion, it exponentially enlarges the cyberattack surface. Heterogeneous, resource-constrained edge devices deployed across unmanaged administrative domains present highly vulnerable targets. To address these vulnerabilities without compromising global data privacy regulations, this paper proposes a novel Trust-Aware Federated Hybrid Intrusion Detection Framework (TA-FHIDF). The proposed framework integrates an Autoencoder, a 1D Convolutional Neural Network (1D-CNN), and a Bidirectional Long Short-Term Memory (BiLSTM) model into a unified, localized deep learning engine capable of autonomous spatial and temporal feature extraction. Model training is performed collaboratively via federated learning, ensuring raw network telemetry remains isolated at local gateways. Furthermore, to defend against adversarial model poisoning attacks, we introduce a robust server-side trust-aware aggregation mechanism that evaluates client reliability using a cosine similarity metric before global model integration. Empirical evaluations across multi-vector benchmark datasets (UNSW-NB15, CICIDS2017, and Edge-IIoTset) demonstrate the framework's superior detection accuracy, rapid convergence, and high Byzantine fault tolerance under adversarial attack scenarios.