Fed-BalX: Federated Adaptive Intrusion Detection Framework for Cross-Domain IoT Environments Using Explainable Attention Fusion and Dynamic Cost Balancing

Abstract

The growth of Internet of Things (IoT) networks has made today's environments vulnerable to complex cross-domain attacks that target critical services. This research introduces a federated adaptive machine learning approach to identify multi-vector attacks using the large-scale CICIoT23 dataset, comprising flow duration, header length, TCP/UDP flags, and time-based features. The data was preprocessed to simulate a decentralized network via Dirichlet non-IID partitioning across edge clients, applying local SMOTE to mitigate extreme class imbalance. Visual exploratory data analysis confirmed the relationship between flow time features and malicious packet lengths. A 1D-CNN and BiGRU deep learning model was trained on the federated network using a new Dynamic Class-Balanced Loss (DCBL) function. The model was evaluated using Macro Recall, False Alarm Rate and PR-AUC. The Fed-BalX global model surpassed centralized models with a 11.21 percent improvement in Macro Recall and an 88.89 percent detection metric for high-priority minority attacks, such as DDoS SlowLoris. With a memory footprint of 0.31 MB and a benign error rate of 0.34 percent, the model is extremely practical for real-time anomaly detection at the IoT edge. Using a custom Attention-Guided Explainability (AGX) module and SHAP, we found that Inter-Arrival Times, payload sizes, and connection state flags were key features in making predictions, which are consistent with volumetric attacks. This method shows the feasibility of secure federated learning for advanced IoT threat detection. The results demonstrate the effectiveness of dynamic cost adjustment on highly skewed traffic, and offer a lightweight, scalable framework for smart threat detection. Finally, Fed-BalX is a step towards robust IoT networks that can adapt to and efficiently detect threats early.