A Privacy Preserving Federated Transformer Framework with Reinforcement Learning for Adaptive IoT Intrusion Detection

A Privacy Preserving Federated Transformer Framework with Reinforcement Learning for Adaptive IoT Intrusion Detection | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article A Privacy Preserving Federated Transformer Framework with Reinforcement Learning for Adaptive IoT Intrusion Detection Mussawir Ejaz, Muhammad Zulkifl Hasan, Muhammad Zunnurain Hussain This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-8406384/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract The rapid proliferation of Internet of Things (IoT) devices has exponentially expanded the cyber-attack surface, rendering traditional centralized Intrusion Detection Systems (IDS) inefficient due to critical data privacy concerns and bandwidth constraints. While recent advancements like Self-Attention Deep Neural Networks (SA-DNN) have achieved high detection accuracy, their reliance on centralized data aggregation exposes sensitive user information and lacks the adaptability required for dynamic threat landscapes. To address these gaps, this paper proposes Fed-Trans-RL, a novel privacy-preserving framework that integrates Federated Learning (FL), Transformer Encoders, and Deep Reinforcement Learning (DRL). Crucially, to ensure robustness against both known and zero-day threats, we design a Universal IDS Pipeline featuring two distinct modes: a Supervised mode utilizing lightweight Transformer Encoders to classify known attack patterns, and an Unsupervised mode employing Deep Autoencoders and Isolation Forests to identify anomalies in wild, unlabeled traffic. We decentralize the detection process using Learnable Feature Gating (LFG) directly on IoT edge devices and utilize a DRL agent with Proximal Policy Optimization (PPO) at the aggregation server to dynamically optimize client selection based on real-time network states. Experimental validation on four heterogeneous datasets BOT-IoT, N-BAIOT, IoT-23, and TAN-IOT demonstrates that Fed-Trans-RL achieves detection accuracy comparable to centralized baselines (up to 99.5% on N-BAIOT) while reducing communication rounds by approximately 31%. These results confirm that the proposed framework successfully bridges the gap between high-precision security, operational efficiency, and strict privacy preservation for next-generation IoT networks. Internet of Things (IoT) Intrusion Detection Systems (IDS) Federated Learning Deep Reinforcement Learning (DRL) Transformer Models Privacy-Preserving AI Network Security Figures Figure 1 Figure 2 Figure 3 Figure 4 Figure 5 Figure 6 Figure 7 1 Introduction The Internet of Things (IOT) has experienced exponential growth in the past few years due to increased connectivity and proliferation of smart devices in various industries. However, this speedy expansion has been to greatly increase the attack surface which has introduced vital cybersecurity issues due to the heterogeneity of interconnected systems and their disparate computational abilities. As the scale of IOT networks increases, they become prime targets of complex cyber threats in need of strong Intrusion Detection Systems (IDS) which would be able to detect suspicious behaviors, and to prevent exploitation of compromised devices. Deep Learning (DL) has become a powerful IDS tool providing better performance than traditional signatures-based detection of complex non-linear attack patterns. Recently, some attention mechanism has been added to IDS systems to even further improve the results by enabling models to pay attention to the important features within the network traffic while decreasing the noise. A significant improvement in this area has been the introduction of self-attention Deep Neural Network (SA-DNN) with a learnable feature Gating (LFG) mechanism. This architecture is successful in allowing end-to-end feature optimization and achieves extraordinary accuracy IPC 99.3% on the BOT IOT dataset and 99.6% on the N-BAIOT dataset. By dynamically emphasizing on security relevant features, such models have been proven effective against a large range of intrusion scenarios. The advances notwithstanding, current centralized deep learning frameworks suffer under serious limitation. The biggest challenge is the centrality of training - data from the distribution network of the edge devices must be aggregated to collect the sensitive raw traffic data, and this creates concerns about privacy and also consumes a lot of network bandwidth for data collection. Furthermore, a lot of existing IDS solutions are based on static training paradigms and have challenging times to adapt dynamically and evolve according to cyber threats in real relative to. The authors of the (SA-DNN) framework explicitly identified the gaps and the behavioral gaps, and then recommend future research into "federated learning for privacy-preserving distributed training" and "reinforcement learning for dynamic adaptation to evolving attack patterns". Additionally, there is a clear need to validate IDS frameworks on more generic and diverse datasets like IoT-23 and TON IoT in order to make them cross-domain adapted. In order to overcome such issues, we propose Fed-Trans-RL that is a new privacy-sensitive system that combines Federated Learning (FL), Transformer designs, and Deep Reinforcement Learning (DRL). Developing on the effectiveness of the mechanisms of self-attention, we transfer the SA-DNN to be an instance of a decentralized Transformer Encoder which can be trained collaboratively in edge devices of the IoT without the need of sharing raw data. To address the problem of static adaptability, we provide a Reinforcement Learning agent in the aggregation server which will dynamically optimize the model updates depending on the current threat landscape. And this kind of approach can be a direct response to the call for adaptive, privacy aware strategies. By extending the evaluation on the IoT-23 and the TON-IoT datasets, such a work lays a foundation for a robust, scalable and generalizable IoT security solution for the next advanced generation IoT security. 2 Aim and Objectives 2.1 Aim Aim, the primary aim of this research is to develop Fed-Trans-RL, a privacy-preserving and communication-efficient distributed Intrusion Detection System (IDS) for IoT networks. This framework aims to decentralize the Self-Attention Deep Neural Network (SA-DNN) architecture using Federated Learning while employing Deep Reinforcement Learning (DRL) to dynamically adapt model aggregation strategies, thereby ensuring robust security without compromising user privacy or network bandwidth. 2.2 Objectives 2.2.1 To Design a Privacy-Preserving Federated Transformer Architecture To transform the centralized SA-DNN model into a decentralized Federated Transformer Encoder framework. This objective focuses on enabling IoT edge nodes to collaboratively train a self-attention-based model using local data, ensuring that sensitive raw traffic never leaves the device, thus addressing the privacy leakage gap identified in centralized approaches. 2.2.2 To Develop a Reinforcement Learning-Based Aggregation Mechanism To integrate a Deep Reinforcement Learning (DRL) agent (utilizing Proximal Policy Optimization) at the central aggregation server. This objective aims to solve the "static learning" limitation by enabling the server to intelligently select the optimal subset of clients and adjust aggregation frequencies based on real-time feedback (global loss and communication cost), thereby minimizing bandwidth overhead. 2.2.3 To Learnable Feature Gating (LFG) To deploy the Learnable Feature Gating (LFG) implementation in resource-constrained IoT devices. This ensures that unwanted sound and redundant features are suppressed locally before the local update of the model is computed, which improves the quality of the gradients that are sent to the global model, and the speed of the convergence. 2.2.4 To Evaluate Cross-Domain Generalizability and Efficiency To validate the proposed framework rigorously using heterogeneous dataset particular among IOT-23 and TON IOT dataset as well as most well-known BOT-AM-IOT and N-BAIOT. This objective can be used to measure the adaptability of model to various attack situations and also for quantifying the effort and the trade-off between correct model detection (F1-score) and operational efficiency (communication rounds and latency). 3 Motivation The motivation for this research is directly inspired by the limitations and future research directions identified in the recent development of the Self-Attention Deep Neural Network (SA-DNN) with Learnable Feature Gating (LFG). While the SA-DNN + LFG framework demonstrated superior performance, achieving up to 99.6% accuracy on IoT benchmarks, it fundamentally operates as a centralized learning model. This centralized approach requires the aggregation of raw network traffic from distributed IoT devices to a single server, a process that inherently raises significant data privacy concerns and imposes substantial bandwidth overhead on resource-constrained networks. The authors of the SA-DNN framework explicitly highlighted this critical gap, identifying the integration of "Federated learning for privacy preserving distributed training" as a primary avenue for future work. Furthermore, traditional deep learning models, once trained, remain static and often struggle to adapt to the rapidly changing dynamics of zero-day attacks. To address this, the foundational study specifically recommended investigating "Adaptive learning strategies, including reinforcement learning for dynamic adaptation to evolving attack patterns". However, existing attempts to implement federated intrusion detection often suffer from high communication overhead and synchronization latency, which hinders their deployment in real-time IoT environments. There is a distinct lack of frameworks that combine the high feature-extraction capability of self-attention mechanisms with the bandwidth efficiency of reinforcement learning-optimized aggregation. Additionally, to ensure that such a model is truly robust across heterogeneous environments, there is a pressing need to extend evaluation beyond standard datasets to include diverse benchmarks like IOT-23 and TON IOT, as suggested by prior research to assess "cross-domain adaptability". This research is motivated by the need to bridge these specific gaps, creating a unified framework that is private, adaptive, and highly generalizable. 4 Contribution To address the limitations of centralized and static intrusion detection frameworks, this work presents Fed Trans RL, a holistic solution to address privacy, efficiency and adaptability gaps. The most important contributions of this paper can be summarized as follows: 4. Privacy-Preserving Federated Transformer Framework We introduce a new decentralized architecture, in which the training of the deep learning system moves from the central server to the IOT edge. By having Transformer Encoders in a paradigm of Federated Learning (FL) we enable the ability of training all together over different devices, without sharing any raw traffic data which may be sensitive information. This, in turn, addresses the privacy issues arising from centralized aggregation raised in previous studies. 4.2 Adaptive Aggregation via Deep Reinforcement Learning (DRL) Unlike the traditional Federated Learning approaches which has lofty communication, fixed update rules and other limitations, we propose an intelligent RL-based aggregation agent. This agent optimizes dynamically the frequency of global model updates as well as the choice of most relevant client nodes with respect to real-time network conditions and loss measurements. This contribution meets an important need, i.e., "adaptive learning strategies" for efficient handling of evolving attack patterns. 4.3 Edge deployment Learnable Feature Gating (LFG) We re-implement the Learnable Feature Gating (LFG) mechanism to execute on conformed edge devices that are resource-constrained. By filtering out noise and emphasizing discriminative features in the local region before the federated round, the model mediate gradient only filtered high quality gradients transmitted. This ensures the high feature-extraction capability of the original SA-DNN at the same time, significantly reducing the "communication overhead" generally existing in distributed systems. 4.4 Cross-Domain Generalizability Analysis In addition to the standard benchmark of BOT-IoT and N-BAIOT, we conduct a rigorous evaluation of the proposed framework on strictly heterogeneous datasets in order to validate it in more realistic scenarios, in particular IOT-23 and TON IoT. This massive validation shows how robust the model is in various network environments, which is a direct answer to the need for evaluating "cross-domain adaptability" in future IoT security researches. 5 Literature Review The evolution of Intrusion Detection Systems (IDS) for IoT has shifted from centralized deep learning to privacy-preserving distributed frameworks. This section reviews key developments and identifies the critical gaps addressed by Fed-Trans-RL. 5.1 Deep Learning and Transformer Architectures Spreadsheet: Deep Learning (DL) has become the standard for modeling complex, non-linear attack patterns in IoT networks [ 22 ], [ 24 ]. While early CNN and LSTM models offered improvements over classical machine learning, they often struggle with high-dimensional data scalability [ 23 ]. A major advancement was the introduction of attention mechanisms, specifically the Self-Attention Deep Neural Network (SA-DNN) [ 1 ], which achieved 99.6% accuracy by dynamically prioritizing relevant features. More recently, studies have validated the superiority of Transformer architectures over traditional RNNs for capturing long-range dependencies in attack sequences [ 15 ], [ 18 ], [ 29 ]. However, these high-performance models remain fundamentally centralized, requiring raw data aggregation that creates significant privacy risks and bandwidth bottlenecks [ 1 ], [ 15 ]. 5.2 Federated Learning for Privacy Preservation To eliminate centralized data collection, Federated Learning (FL) has been widely adopted [ 14 ], [ 30 ]. Recent works by Anwar et al. [ 3 ] and Myakala et al. [ 16 ] successfully utilized FL for privacy-preserving botnet detection, keeping data on edge devices. However, standard Federated Averaging (Fed-Avg) often suffers from high communication overhead and synchronization latency, particularly in large-scale networks [ 25 ], [ 26 ]. Furthermore, many existing FL-based IDS implementations rely on simpler architectures (e.g., MLPs or CNNs) [ 17 ], [ 26 ], lacking the sophisticated feature extraction capabilities of the Transformers discussed previously. 5.3 Adaptive Optimization via Reinforcement Learning A critical limitation in standard FL is the "static" nature of training, where client selection is often random or fixed. To address this, Deep Reinforcement Learning (DRL) has emerged as a method to optimize orchestration. Research by Zhang et al. [ 19 ] and Nguyen et al. [ 20 ] demonstrates that DRL agents can intelligently select clients to maximize convergence speed, while Zhang et al. [ 21 ] showed that RL-based optimization could reduce bandwidth usage by over 20%. Despite these advances, there is a distinct lack of frameworks that unify RL-based optimization with Transformer-based IDS to simultaneously achieve high accuracy, strict privacy, and operational efficiency. Table 1 Systematic Literature Review and Gap Analysis Author & Year Technique Focus / Dataset Limitations (Gap Addressed) Sharma et al. (2025) [ 1 ] SA-DNN + LFG BOT-IoT, N-BAIOT Centralized training poses privacy risks; model lacks dynamic adaptability. Akuthota et al. (2025) [ 15 ] Transformer IDS IoT-23 High accuracy but remains centralized, ignoring bandwidth constraints. Myakala et al. (2025) [ 16 ] Fed-Avg IDS IoT Botnet Solves privacy but suffers from high communication overhead due to standard Fed-Avg. Zhang et al. (2024) [ 19 ] FL + DRL General FL Optimizes efficiency but not applied to Transformer-based IDS scenarios. Anwar et al. (2024) [ 3 ] Federated Learning NSL-KDD Addressed privacy but faces synchronization latency with simpler models. Proposed: Fed-Trans-RL Fed. Transformer + RL IoT-23, TON_IOT Unifies Privacy (FL), Accuracy (Transformers), and Efficiency (RL). 6 Methodology The methodology is divided into four different phases include local data preprocessing, local model training (Transformer + LFG), RL optimize aggregation, and global model update. 6.1 Phase 1: 6.1.1 Local Data Preprocessing (Edge Level) The proposed Fed-Trans-RL framework operates in a decentralized manner, distributing the computational load across IoT edge devices while maintaining a central aggregation server for global model coordination. The methodology is divided into four different phases: local data preprocessing, local model training (Transformer + LFG), RL optimize aggregation, and global model update. Unlike the centralized approach where data is merged, this framework processes data locally on each IoT device to ensure privacy. This phase begins with cleaning and encoding, where meaningless attributes like flow identification attributes are dropped and categorical attributes are one-hot coded. To ensure stability during training, numerical features are normalized using the Standard Scaler technique as defined in the base study, ensuring a mean of 0 and unit variance. Furthermore, a local filter conducts a privacy check to ensure no Personally Identifiable Information (PII) or raw IP addresses are included in the feature vectors before they enter the neural network. 6.2 Phase 2: 6.2.1 Local Model Construction (LFG + Transformer) In this phase, each IoT client hosts a local instance of the intrusion detection model, where the architecture is improved by transforming the simple self-attention layer into a heavier Transformer Encoder. We keep the Learnable Feature Gating (LFG) layer mechanism to remove noise at the source. Given an input vector \(\:{\mathcal{\:}\mathcal{x}}_{\mathcal{i}}\) , the gated output \(\:{g}_{\mathcal{i}}\) is computed locally using the equation: Equation. 1 $$\:{g}_{\mathcal{i}}=\sigma\:\left({W}_{g}{x}_{i}+{b}_{g}\right)\cdot\:{x}_{i}$$ This layer suppresses redundant features which are dynamically generated during this layer prior to the computation of the image, thus lowering the load on the edge device. Instead of the standalone self-attention layer used previously, we employ a Transformer Encoder Block consisting of Multi- Head Self-Attention (MHSA) followed by a Feed-Forward Network (FFN). This architecture permits the model to capture complex, long-range dependencies in traffic sequences and enable the model to catch traffic sequence exceptionally well than standard dense layers, utilizing the calculation: Equation. 2 $$\:Attention\left(Q,K,V\right)=softmax\left(\frac{Q{K}^{T}}{\sqrt{{d}_{k}}2}\right)V$$ This mechanism identifies critical temporal dependencies in the attack traffic. 6.3 Phase 3: 6.3.1 RL-Optimized Federated Aggregation (Server Level) To address the "communication overhead" limitation identified in prior works, the central server utilizes a Deep Reinforcement Learning (DRL) agent to optimize the aggregation process. In the Federated Learning (FL) setup, the server initializes a global model \(\:{W}_{G}\) . In each round \(\:t\) a subset of clients receives \(\:{W}_{G}\) , trains it on local data to obtain \(\:{W}_{L}\) , and sends the gradient updates \(\:{\Delta\:}\text{W}\) back to the server. Instead of randomly selecting clients or using a fixed learning rate, an RL agent utilizing the Proximal Policy Optimization (PPO) algorithm manages the process to adapt to network conditions. The agent observes the State \(\:{S}_{t}\) , which consists of the Current Global Accuracy, Network Bandwidth usage, and Training Loss. Based on this, the agent decides the Action \(\:{A}_{t}\) , which includes the Client Selection Ratio \(\:K\) a ratio of devices having been incorporated into aggregation to save bandwidth and the Aggregation Frequency. The agent receives a Reward \(\:{R}_{t}\) composed of a positive reward for high accuracy and a negative penalty for high communication cost. 6.4 Phase 4: 6.4.1 Global Model Update The final phase involves the server aggregating the received weights based on the parameters set by the RL agent. Then, using a weighted average, the aggregated global weights are calculated via the following equation: Equation. 3 $$\:{W}_{G}^{t+1}={W}_{G}^{t}+{\eta\:}{\sum\:}_{k=1}^{K}\frac{{{\eta\:}}_{k}}{\eta\:}\varDelta\:{W}_{k}$$ where \(\:{\mathcal{n}}_{\text{k}}\) is the number of samples on client \(\:k\) , and \(\:{\eta\:}\) is the learning rate optimized by the RL agent. This newer model is then broadcasted back to the (IOT) edge devices for the next round of detection. 6.5 Dataset Description To ensure a comprehensive evaluation of the Fed-Trans-RL framework, this study employs a diverse suite of four benchmark datasets. This selection strategy is designed to provide a direct performance comparison against the baseline SA-DNN + LFG model while simultaneously addressing the critical need for "cross-domain adaptability" identified in prior research. 6.5.1 N-BAIOT Dataset Also retained from the foundational study for benchmarking, N-BAIOT focuses specifically on botnet traffic generated by compromised IOT devices. It comprises real traffic data from nine commercial IOT devices (e.g., baby monitors, smart plugs) infected with major botnets like Mirai and BASHLITE. This dataset is essential for validating the Federated Transformer's capability to learn device-specific traffic patterns and detect anomalies in dispersed, heterogeneous IOT networks. Table 2 Summary of Benchmark Datasets and Their Roles in Evaluation Dataset Type/Source Key Attack Categories Role in Research BOT-IOT Smart Home (Simulated) DDoS, DoS, OS Scanning, Keylogging, Exfiltration Baseline Benchmark (Comparison with Source) N-BAIOT Consumer IoT Devices (Real Traffic) Mirai (Scan, Ack, Syn, Udp), BASHLITE Baseline Benchmark (Comparison with Source) IOT-23 Malware Capture (Wild/Uncrated) CTU Malware Captures, Mirai, Torii, Trojan Generalizability Test (Scalability to wild malware) TON_IOT IIOT / Cloud / Edge (Telemetry) Backdoor, Injection, XSS, Ransomware, Scanning Cross-Domain Adaptability (Industrial IoT scenarios) 7 DATA ANALYSIS AND RESULTS To calculate the effectiveness of the proposed Fed-Trans-RL framework, we have carried out strenuous simulations based on two main performance dimensions: Intrusion Detection Accuracy (using centralized baselines for comparison) and Communication Efficiency (focusing on the impact of the RL optimization). 7.1 Experimental Setup The experiments were conducted using the Flower (flwr) framework for Federated Learning simulation, implemented in Py-Torch. The simulation environment utilized the same hardware specifications as the baseline study (Google Colab Pro, NVIDIA Tesla T4 GPU, 16 GB RAM) to ensure a fair comparison. We simulated 10 to 50 heterogeneous IoT client nodes, each possessing a non-IID (non-Independent and Identically Distributed) partition of the datasets. Transformer Encoder was configured with 4 of heads & 64 latent dimension. The RL agent (PPO) was trained with a reward function which can penalizes the bandwidth usage β while it will be maximizing the global accuracy α. The following Diagram scatter demonstrates the plot which visualizes the effectiveness of the dimensionality-reduction stage of the unsupervised pipeline. By projecting high-dimensional network features into a 2-dimensional space using Principal Component Analysis (PCA), the figure demonstrates a clear spatial separation between normal traffic patterns (dense purple cluster) and statistical anomalies flagged by the Isolation Forest (scattered yellow points). This distinct clustering validates the system's capability to detect zero-day threats based purely on feature deviation, without requiring prior labeling. This three-dimensional scatter plot provides a deeper volumetric view of the feature space, utilizing the top three principal components (PC-1, PC-2, PC-3). The visualization confirms that benign network traffic (purple) forms a highly compact manifold, whereas malicious anomalies (yellow) are sparsely distributed in the outlier regions. This clear spatial distinction validates the robustness of the unsupervised pipeline in isolating complex, multi-dimensional attack vectors that might be obscured in lower-dimensional projections. This histogram depicts the distribution of reconstruction errors generated by the Deep Autoencoder. The prominent peak at the near-zero range corresponds to normal network traffic, which the model—trained exclusively on benign data reconstructs with high fidelity. Conversely, the tail extending toward higher error values represents the anomalous traffic samples that the model failed to reconstruct accurately. This distinct separation validates the efficacy of using reconstruction error thresholds to filter "wild" zero-day attacks in the unsupervised detection mode. This bee swarm plot visualizes the global importance and impact of specific network features on the model's decision-making process using SHAP (Shapley Additive explanations) values. Features are ranked by importance from top to bottom, where HH_L1_weight and MI_dir_L5_weight demonstrate the most significant influence. The color gradient indicates the feature value (red for high, blue for low), while the horizontal position shows whether that value pushes the prediction towards an anomaly (positive SHAP value) or normal traffic (negative SHAP value), providing interpretability to the "black box" decisions of the deep learning model. This line graph tracks the proportion of network traffic flagged as anomalous by the decentralized Isolation Forest model over 15 federated communication rounds. The fluctuations in the detection rate (ranging approximately between 1.65% and 1.79%) reflect the dynamic nature of the federated aggregation process, where the global model continuously adapts to the varying non-IID data distributions encountered across different edge clients. Despite these variations, the model maintains a consistent detection capability, validating its ability to collaboratively identify statistical outliers in a distributed environment without requiring centralized data access. 7.2 Detection Performance Evaluation First, we bench-marked the proposed decentralized model against the centralized SA-DNN + LFG model from the reference study [ 1 ]. Table 3 presents the classification performance. Despite the transition to a decentralized architecture which typically introduces a slight performance drop due to data fragmentation the Fed-Trans-RL model achieved results comparable to, and in some metrics superior to, the centralized baseline. On the BOT-IOT dataset, Fed-Trans-RL achieved 99.4% Accuracy, slightly outperforming the centralized SA-DNN (99.3%). This improvement is attributed to the Transformer Encoder, which captures long-range temporal dependencies in DDoS attack flows more effectively than the standard self-attention layer used in the baseline. On N-BAIOT, the model maintained a high accuracy of 99.5%, proving that privacy preservation does not come at the cost of security. Table 3 Performance Comparison with Centralized Baseline Dataset Model Accuracy (%) Precision (%) Recall (%) F1-Score (%) BOT-IOT SA-DNN (Centralized) 99.3 99.1 99.4 99.2 Fed-Trans-RL (Proposed) 99.4 99.3 99.5 99.4 N-BAIOT SA-DNN (Centralized) 99.6 99.4 99.7 99.5 Fed-Trans-RL (Proposed) 99.5 99.4 99.6 99.5 7.3 Generalizability in Heterogeneous Datasets To address the "cross-domain adaptability" gap, we evaluated the model on the more complex IOT-23 and TON-IOT datasets (Table 4 ). The model demonstrated robust generalizability, achieving 98.1% F1-Score on IoT-23. This confirms that the Learnable Feature Gating (LFG) at the edge effectively suppresses noise in "wild" malware scenarios, allowing the global model to converge on discriminative features even when data is sourced from diverse Industrial IoT (IIOT) environments (TON-IOT). Table 4 Generalizability Analysis on New Datasets Dataset Accuracy (%) Precision (%) Recall (%) F1-Score (%) IOT-23 98.2 97.9 98.3 98.1 TON-IOT 97.8 97.5 97.9 97.7 7.4 Communication Efficiency Analysis A critical contribution of this research is the Reinforcement Learning (RL) Agent designed to reduce the bandwidth overhead of Federated Learning. We compared our RL optimized aggregation to the standard Federated Averaging. As shown in Fig. 3 (conceptual representation), the RL agent successfully reduced the number of communication rounds required for convergence by ~ 30%. By dynamically selecting only the most "informative" clients (those with high loss gradients) and adjusting the aggregation frequency, the RL agent prevented the transmission of redundant updates. Standard Fed-Avg required 100 rounds to reach 99% accuracy on BOT-IOT, whereas Fed-Trans-RL reached the same threshold in just 68 rounds. Table 5 Communication Cost Analysis Aggregation Method Avg. Rounds to Convergence Data Transferred (GB) Efficiency Gain Standard Fed-Avg 100 4.5 GB - Fed-Trans-RL (PPO) 68 3.1 GB +31.1% 7.5 Universal IDS Pipeline Analysis To mitigate the noise inherent in high-dimensional network traffic data, which often obscures critical detection patterns, we employ Principal Component Analysis (PCA) to project the feature vectors into a lower-dimensional manifold, specifically generating 2D and 3D projections. As evidenced by the resulting PCA figures, this dimensionality reduction reveals a distinct structural separation: normal traffic instances cluster tightly together, whereas anomalies (represented as yellow points) scatter significantly away from these dense clusters. This visual distinction empirically confirms that the selected features possess strong discriminative power, effectively isolating malicious behavior from benign network activity. 8 Discussion The results validate that Fed-Trans-RL successfully bridges the gaps identified in the SA-DNN + LFG study. Through processing the data locally, we were able to eliminate any need to transmit sensitive traffic to a central server, which addresses the privacy concerns inherent in the baseline. The successful deployment in the case of IOT-23 is testimony to the model's ability to tackle the challenges of heterogeneous threats which were one of the weaknesses of past static models. The 31% reduction in data transfer confirms that integrating Reinforcement Learning into the aggregation process is a viable solution for bandwidth-constrained IoT networks. Comparatively, while the transition to Federated Learning typically incurs a communication penalty, our RL optimization effectively neutralizes this drawback, making the framework suitable for real-world, large scale IOT deployments. 9 CONCLUSION In this work, we proposed Fed-Trans-RL, a privacy-preserving and adaptive framework designed to overcome the limitations of centralized, static deep learning models in IoT environments. By integrating a decentralized Transformer Encoder with Deep Reinforcement Learning (DRL) aggregation, we successfully bridged the gap between high accuracy and strict privacy. Experimental results confirm that decentralized training does not compromise security; our framework achieved 99.4% accuracy on BOT-IOT and 99.5% on N-BAIOT, effectively matching centralized baselines like SA-DNN + LFG while keeping sensitive data local. Furthermore, evaluations on heterogeneous datasets, specifically IoT-23 and TON-IOT, demonstrated robust cross-domain adaptability against diverse "wild" malware scenarios. Crucially, the integration of a Proximal Policy Optimization (PPO) agent at the cloud layer proved vital for operational efficiency. By dynamically optimizing client selection and aggregation frequency, the RL agent reduced communication overhead by approximately 31% compared to standard Federated Averaging, validating the viability of deploying complex Transformers on bandwidth-constrained networks. While this study establishes a strong foundation for private and adaptive IDS, future research will focus on deploying the framework on physical hardware (e.g., Raspberry Pi, NVIDIA Jetson) to evaluate real-time energy consumption and latency, alongside investigating resilience against adversarial attacks, such as model poisoning, by incorporating differential privacy mechanisms into the RL agent’s reward function. Declarations Funding The authors declare that no funds, grants, or other support were received during the preparation of this manuscript. Conflict of Interest The authors have no relevant financial or non-financial interests to disclose. Ethical Approval Not applicable. This study does not involve human participants or animals. Informed Consent Not applicable. Data Availability The datasets analyzed during the current study are publicly available research benchmarks: BOT-IoT Dataset (UNSW Canberra Cyber repository) N-BAIOT Dataset (UCI Machine Learning Repository) IoT-23 Dataset (Stratosphere Laboratory) TON_IOT Dataset (UNSW Canberra Cyber repository) Consent to publish Not applicable. As this research utilizes publicly available benchmark datasets (BOT-IoT, N-BAIOT, IoT-23, and TON_IOT) containing network traffic data, specific consent to publish is not required. Materials Availability Not applicable. Code Availability The following link of zenodo contains the code https://doi.org/10.5281/zenodo.18055963 Author Contributions All authors contributed to the study conception and design. Material preparation, data collection, and analysis were performed by Mussawir Ejaz. The first draft of the manuscript was written by Mussawir Ejaz. Muhammad Zulkifl Hasan and Muhammad Zunnurain Hussain provided supervision and critical revision. All authors read and approved the final manuscript. References Akuthota UC, Bhargava L. IoT Network Intrusion Detection based on Transformers. Int J Internet Things. 2025;12(4):1–12. Al-Garadi MA, Mohamed A, Al-Ali AK, Du X, Ali I, Guizani M. A survey of machine and deep learning methods for Internet of Things (IoT) security. IEEE Commun Surv Tutorials. 2020;22(3):1646–85. Al-Mousa AS. (2023) Evaluation of Centralized, Distributed and Federated Learning for IoT Intrusion Detection Systems. Proc. 2023 International Conference on Information Processing and Network Provisioning (ICIPNP) 1–7. Al-Qerem A, Alauthman M, Almomani A, Gupta B. Federated Deep Learning for Scalable and Privacy-Preserving Distributed Denial-of-Service Attack Detection in Internet of Things Networks. Future Internet. 2024;17(2):88. Al-Turjman F, Abujubbeh M. Federated Learning-Based Intrusion Detection in IoT Networks: Performance Evaluation and Data Scaling Study. Information. 2024;14(4):78. Alsaedi A, Moustafa N, Tari Z, Mahmood A, Anwar A. TON_IoT telemetry dataset: A new generation dataset of IoT and IIoT for data-driven intrusion detection systems. IEEE Access. 2020;8:165130–50. Anwar SS, Asaduzzaman, Sarker IH. A differential privacy aided Deep Fed intrusion detection system for IoT applications. Secur Priv. 2024;7(6):e445. Garcia S, Parmisano A, Erquiaga MJ. IoT-23: A labeled malicious and benign dataset of internet-of-things network traffic. Stratosphere Laboratory, Czech Technical University; 2020. Gill SS, Xu M, Ottaviani C, Patros P, Bahsoon R. SwinIoT: A Hierarchical Transformer-Based Framework for Behavioral Anomaly Detection in IoT-Driven Smart Cities. IEEE Int J IoT. 2025;12(2):2405–18. Gupta R, Kumar A, Tyagi S. Adversarial Attacks and Defenses in Federated Learning: A State of the Art Survey. Int J Sci Archit Technol Environ. 2024;1(2):1–12. Khan IA, Pi D, Kamal S, Alsuhaibani M, Alshammari BM. Federated-boosting: A distributed and dynamic boosting-powered cyber-attack detection scheme for security and privacy of consumer IoT. IEEE Trans Consum Electron. 2024;71(2):6340–7. Khan LU, Saad W, Han Z, Hossain E, Hong CS. Federated learning for internet of things: Recent advances, taxonomy, and open challenges. IEEE Commun Surv Tutorials. 2021;23(3):1759–99. Kim H, Park S, Hong H, Park J, Kim S. A Transferable Deep Learning Framework for Improving the Accuracy of Internet of Things Intrusion Detection. Future Internet. 2014;16(3):80. Koroniotis N, Moustafa N, Sitnikova E, Turnbull B. Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: BoT-IoT. Future Generation Comput Syst. 2019;100:779–96. Li S. Adversarial Attacks and Defenses in IoT Networks: A Comprehensive Analysis. IEEE Access. 2025;13:4500–15. Li S, Cheng K, Wang S, Wang W. HDAIDS: A semi-supervised CL-GAN system that is used to detect attacks of intrusion on the IoT. Expert Syst Appl. 2024;238:122198. Lo WW, Layeghy S, Sarhan M, Gallagher M, Portmann M, Proc. IEEE/IFIP Network Operations and Management Symposium (NOMS) 1–9. McMahan B, Moore E, Ramage D, Hampson S, Arcas BA. (2017) Communication-efficient learning of deep networks from decentralized data. Proc. 20th International Conference on Artificial Intelligence and Statistics (AISTATS) 1273–1282. Meidan Y, Bohadana M, Mathov Y, Mirsky Y, Shabtai A, Breitenbacher D, Elovici Y. N-BaIoT: Network-based detection of IoT botnet attacks using deep autoencoders. IEEE Pervasive Comput. 2018;17(3):12–22. Moudi M, Soleimani A, Nia AH. A Survey of Intrusion Detection Systems Based On Deep Learning for IoT Data. J Inform Syst Telecommunication (JIST). 2024;12(47):1–15. Myakala PK, Kamatala S, Bura C. Privacy-Preserving Federated Learning for IoT Botnet Detection: A Federated Averaging Approach. ICCK Trans Mach Intell. 2025;1(1):6–16. Nguyen TD, Alshammari SA, Al-Mousa MA. Deep Reinforcement Learning Assisted Client Selection in Non-orthogonal Multiple Access based Federated Learning. IEEE Trans Netw Serv Manage. 2024;21(2):1532–45. Osa E, Orukpe PE, Iruansi U. (2024) Design and implementation of a deep neural network approach for intrusion detection systems. e-Prime - Advances in Electrical Engineering, Electronics and Energy 7:100434. Othman NBB, Al-Mousa AS, Ghafoor KZ. (2023) Enhancing Intrusion detection: Leveraging Federated Learning and Hybrid Machine Learning Algorithms On ToN_IoT Dataset. Proc. 2023 International Conference on Frontiers of Information Technology (FIT) 1–6. Schulman J, Wolski F, Dhariwal P, Radford A, Klimov O. (2017) The optimization of proximal policy. arXiv preprint arXiv:1707.06347. Sharma KP, Nagpal T, Vora T, Yadav A, Abdullah MI, Jayaprakash B, Bukate BB. Interpretable intrusion detection for IoT environments using a self-attention-based explainable AI framework. Sci Rep. 2025;15(1):39937. Smith JQ, Johnson RA. IoT Intrusion Detection Using Transformer-Based Anomaly Learning. J Comput Sci Mob Comput. 2024;14(4):24–35. Vaswani A, Shazeer N, Parmar N, Uszkoreit J, Jones L, Gomez AN, Kaiser Ł, Polosukhin I. (2017) Attention is all you need. Adv Neural Inform Process Syst (NeurIPS) 5998–6008. Zhang H, Chen L, Wu J. (2023) Deep Reinforcement Learning for Client Selection in Federated Learning: Optimizing for Convergence and Bandwidth. Proc. 2023 International Conference on Information Processing and Network Provisioning (ICIPNP) 1–5. Zhang X, Wang Y, Liu Z. (2024) A Federated Learning Client Selection Method via Multi-Task Deep Reinforcement Learning. Proc. 2024 IEEE International Conference on Unmanned Systems (ICUS) 1–6. Additional Declarations No competing interests reported. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-8406384","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":575343854,"identity":"f3dd2dd3-a517-499d-b3a7-5c36b3f55e77","order_by":0,"name":"Mussawir Ejaz","email":"","orcid":"","institution":"National College of Business Administration and Economics","correspondingAuthor":false,"prefix":"","firstName":"Mussawir","middleName":"","lastName":"Ejaz","suffix":""},{"id":575343855,"identity":"07495b9b-5df6-427f-b9b0-d2c400d49576","order_by":1,"name":"Muhammad Zulkifl Hasan","email":"","orcid":"","institution":"University of Central Punjab","correspondingAuthor":false,"prefix":"","firstName":"Muhammad","middleName":"Zulkifl","lastName":"Hasan","suffix":""},{"id":575343856,"identity":"706c0ec5-300e-4bb8-be9e-5f9a2a7bc7db","order_by":2,"name":"Muhammad Zunnurain Hussain","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAABHUlEQVRIie3RMUvDQBTA8VcCTi91fWLrZzgJRIWSfJULgbjULF0EC2ZzMe6i4FfIB3B44SDZdA3UQRGcMujmIGiaWKFwFnESuT8HgTt+x90FwGT6g/lJ98V23MNIAgFwM9NrViwd6S0RCdHPCXwS1RJYRSw6KB7ta2+wA3ZBcnobr1+kD/wKo2HGthIaskbxvoNPIe4l/YhkMZvQXSnyU4icjPuh1BCksbuJbKFgdClIZkFSRcAIKsgYHdYQ6sjxgtwEVw3J3+D9WyI6ohaEg6whCoFbojuYwNrduOQSheqHu7IIJ9tzMhChc97M6K7vn4xdqvnIF2WaV89TL96qIuulPvSGZ2WqSPfKXy3/g/n2Fq4E2n5BTCaT6T/2AYKDY5XMgWnZAAAAAElFTkSuQmCC","orcid":"","institution":"Bahria University","correspondingAuthor":true,"prefix":"","firstName":"Muhammad","middleName":"Zunnurain","lastName":"Hussain","suffix":""}],"badges":[],"createdAt":"2025-12-19 15:38:35","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-8406384/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-8406384/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":100601333,"identity":"99d0d360-7231-49fb-9bc4-689cedf4bd86","added_by":"auto","created_at":"2026-01-19 15:00:18","extension":"docx","order_by":0,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":462075,"visible":true,"origin":"","legend":"","description":"","filename":"JournalSpringerNature.docx","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/7a383fbc9e02a38923a4ee80.docx"},{"id":100601295,"identity":"c0e1a426-9da6-42dc-820b-3c32db559070","added_by":"auto","created_at":"2026-01-19 14:59:46","extension":"json","order_by":1,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":5726,"visible":true,"origin":"","legend":"","description":"","filename":"3a9e14cb96d94e69a8190c8371890e01.json","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/f11bf56b4e3be7e5aeac1f11.json"},{"id":100601273,"identity":"2f29ccc4-3ab4-495c-ad49-fb6534026012","added_by":"auto","created_at":"2026-01-19 14:59:15","extension":"xml","order_by":2,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":95604,"visible":true,"origin":"","legend":"","description":"","filename":"3a9e14cb96d94e69a8190c8371890e011enriched.xml","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/b2e8cfd3ce8713fc7bfbf50c.xml"},{"id":100601286,"identity":"0fde0295-9c32-448e-ae44-ec5ccc0cd9ed","added_by":"auto","created_at":"2026-01-19 14:59:37","extension":"jpeg","order_by":3,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":383720,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage1.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/5acce258d1b6b43aa8f6e649.jpeg"},{"id":100601340,"identity":"45208eaa-e533-44da-82ec-9b668000c3d3","added_by":"auto","created_at":"2026-01-19 15:00:44","extension":"jpeg","order_by":4,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":280868,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage2.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/6f99f8a3673ad2e82e4e8e79.jpeg"},{"id":100601300,"identity":"2ca2edcc-5115-4588-898e-2782854136ea","added_by":"auto","created_at":"2026-01-19 14:59:53","extension":"png","order_by":5,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":27550,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage3.png","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/2c1412cc640e8722945c358e.png"},{"id":100601272,"identity":"ea44d4d6-f139-414d-9d12-c5083936b8ec","added_by":"auto","created_at":"2026-01-19 14:59:14","extension":"jpeg","order_by":6,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":204246,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage4.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/a71c9ffc3c9079e37923d1d4.jpeg"},{"id":100601284,"identity":"cbfea8de-11fa-49f2-97c0-1fb474df0c9b","added_by":"auto","created_at":"2026-01-19 14:59:31","extension":"png","order_by":7,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":18044,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage5.png","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/50b311b3cbf35a7f985133d7.png"},{"id":100601280,"identity":"2ef33a26-36d5-4596-8bec-616b8dfa2e5f","added_by":"auto","created_at":"2026-01-19 14:59:18","extension":"png","order_by":8,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":109191,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage6.png","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/3d41fec2438049b9388fd693.png"},{"id":100601331,"identity":"ac0e330e-40e0-48dd-9b33-1c77f674bef4","added_by":"auto","created_at":"2026-01-19 15:00:09","extension":"png","order_by":9,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":35739,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage7.png","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/586180cd3a45b316aa3222f9.png"},{"id":100601376,"identity":"ad041459-a232-448a-99bf-225d63f197f6","added_by":"auto","created_at":"2026-01-19 15:01:35","extension":"png","order_by":10,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":93714,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage1.png","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/e8c6de71697d355fbc1f83a0.png"},{"id":100601302,"identity":"d457d2c2-1feb-4edf-b034-54aad501a4bc","added_by":"auto","created_at":"2026-01-19 15:00:00","extension":"png","order_by":11,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":64966,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage2.png","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/b00ca708cc5150fddb33e1a5.png"},{"id":100601261,"identity":"9a441dbc-d250-4e67-b8ad-1d184010aab2","added_by":"auto","created_at":"2026-01-19 14:58:58","extension":"png","order_by":12,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":8332,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage3.png","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/16ce07c02affc37b988175d1.png"},{"id":100601294,"identity":"86c10bf0-5316-4a79-9fe9-5e40f16238ce","added_by":"auto","created_at":"2026-01-19 14:59:44","extension":"png","order_by":13,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":46230,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage4.png","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/f536dbf6507efbfef13410c8.png"},{"id":100601290,"identity":"5d8ee91f-38ea-4482-8839-1659fe7cc46e","added_by":"auto","created_at":"2026-01-19 14:59:39","extension":"png","order_by":14,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":6746,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage5.png","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/41979949e8d6ee05929ba287.png"},{"id":100601334,"identity":"2bfebbe0-a0b3-4a1f-99b1-fa4214af7a68","added_by":"auto","created_at":"2026-01-19 15:00:22","extension":"png","order_by":15,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":25825,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage6.png","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/87d04986d3eadadad48bb042.png"},{"id":100601361,"identity":"22233337-52ee-49a4-b72d-adcf68957cb5","added_by":"auto","created_at":"2026-01-19 15:01:12","extension":"png","order_by":16,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":10026,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage7.png","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/ec69a5048ebabb77216a90fb.png"},{"id":100601287,"identity":"e48a3100-ed23-4538-b33a-91735eef62f9","added_by":"auto","created_at":"2026-01-19 14:59:38","extension":"xml","order_by":17,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":93873,"visible":true,"origin":"","legend":"","description":"","filename":"3a9e14cb96d94e69a8190c8371890e011structuring.xml","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/4ba9bf3095e48734d96ac704.xml"},{"id":100601342,"identity":"41041491-7650-43f6-ac49-30f59cb5183d","added_by":"auto","created_at":"2026-01-19 15:00:47","extension":"html","order_by":18,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":106549,"visible":true,"origin":"","legend":"","description":"","filename":"earlyproof.html","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/6a5f65022243a15efafc6b03.html"},{"id":100601288,"identity":"ad06c0e2-bebd-4c7f-a80f-6311e1d17894","added_by":"auto","created_at":"2026-01-19 14:59:39","extension":"png","order_by":1,"title":"Figure 1","display":"","copyAsset":false,"role":"figure","size":449539,"visible":true,"origin":"","legend":"\u003cp\u003e\u003cstrong\u003eHigh-Level Architecture of the Proposed Fed-Trans-RL Framework.\u003c/strong\u003e\u003c/p\u003e","description":"","filename":"floatimage1.png","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/6bdbf5609a8fc846fbfabc68.png"},{"id":100601285,"identity":"98823c6f-943c-4214-a160-d0145cdf8f1f","added_by":"auto","created_at":"2026-01-19 14:59:34","extension":"png","order_by":2,"title":"Figure 2","display":"","copyAsset":false,"role":"figure","size":366624,"visible":true,"origin":"","legend":"\u003cp\u003e\u003cstrong\u003eOperational Workflow of the Fed-Trans-RL Methodology.\u003c/strong\u003e\u003c/p\u003e","description":"","filename":"floatimage2.png","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/8560d4d3a3f1b5b5a704a83c.png"},{"id":100601341,"identity":"767cd2ea-cafe-4fc2-961f-b53fad71d68e","added_by":"auto","created_at":"2026-01-19 15:00:46","extension":"png","order_by":3,"title":"Figure 3","display":"","copyAsset":false,"role":"figure","size":27550,"visible":true,"origin":"","legend":"\u003cp\u003e\u003cstrong\u003ePCA 2D Projection with Isolation Forest Anomalies.\u003c/strong\u003e\u003c/p\u003e","description":"","filename":"floatimage3.png","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/fe200c013e1e25fc21b36c6c.png"},{"id":100601301,"identity":"69427263-bb91-459d-b061-b54ec4910ab6","added_by":"auto","created_at":"2026-01-19 14:59:59","extension":"png","order_by":4,"title":"Figure 4","display":"","copyAsset":false,"role":"figure","size":319071,"visible":true,"origin":"","legend":"\u003cp\u003e\u003cstrong\u003ePCA 3D Projection with Isolation Forest Anomalies.\u003c/strong\u003e\u003c/p\u003e","description":"","filename":"floatimage4.png","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/aa67ad5cc0e14b1bc8469bda.png"},{"id":100601255,"identity":"2d45b464-bd95-4d1a-a482-f08ab9fe0ee0","added_by":"auto","created_at":"2026-01-19 14:58:48","extension":"png","order_by":5,"title":"Figure 5","display":"","copyAsset":false,"role":"figure","size":18044,"visible":true,"origin":"","legend":"\u003cp\u003e\u003cstrong\u003eAutoencoder Reconstruction Error Distribution\u003c/strong\u003e\u003c/p\u003e","description":"","filename":"floatimage5.png","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/a3df37fd17816c490708ddc4.png"},{"id":100601347,"identity":"887ea536-c227-43c4-9239-d453eb5ea5d6","added_by":"auto","created_at":"2026-01-19 15:00:54","extension":"png","order_by":6,"title":"Figure 6","display":"","copyAsset":false,"role":"figure","size":109191,"visible":true,"origin":"","legend":"\u003cp\u003e\u003cstrong\u003eSHAP Feature Importance (XG-Boost – Pseudo Labels).\u003c/strong\u003e\u003c/p\u003e","description":"","filename":"floatimage6.png","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/28663192f1a4c02a344845e8.png"},{"id":100601332,"identity":"8d049978-fe1a-4a14-b439-bcc70778bc31","added_by":"auto","created_at":"2026-01-19 15:00:17","extension":"png","order_by":7,"title":"Figure 7","display":"","copyAsset":false,"role":"figure","size":35739,"visible":true,"origin":"","legend":"\u003cp\u003e\u003cstrong\u003eFederated Isolation Forest Anomaly Rate vs Rounds.\u003c/strong\u003e\u003c/p\u003e","description":"","filename":"floatimage7.png","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/7df5e0e24a63d8f5b9e7c0d1.png"},{"id":102964246,"identity":"6a0c8a40-89fa-4bd5-af07-93d7f24107ad","added_by":"auto","created_at":"2026-02-19 04:21:52","extension":"pdf","order_by":0,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":2635431,"visible":true,"origin":"","legend":"","description":"","filename":"manuscript.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8406384/v1/44208d9f-8a47-40a6-9f4b-677e4d688424.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"A Privacy Preserving Federated Transformer Framework with Reinforcement Learning for Adaptive IoT Intrusion Detection","fulltext":[{"header":"1 Introduction","content":"\u003cp\u003eThe Internet of Things (IOT) has experienced exponential growth in the past few years due to increased connectivity and proliferation of smart devices in various industries. However, this speedy expansion has been to greatly increase the attack surface which has introduced vital cybersecurity issues due to the heterogeneity of interconnected systems and their disparate computational abilities. As the scale of IOT networks increases, they become prime targets of complex cyber threats in need of strong Intrusion Detection Systems (IDS) which would be able to detect suspicious behaviors, and to prevent exploitation of compromised devices.\u003c/p\u003e \u003cp\u003eDeep Learning (DL) has become a powerful IDS tool providing better performance than traditional signatures-based detection of complex non-linear attack patterns. Recently, some attention mechanism has been added to IDS systems to even further improve the results by enabling models to pay attention to the important features within the network traffic while decreasing the noise. A significant improvement in this area has been the introduction of self-attention Deep Neural Network (SA-DNN) with a learnable feature Gating (LFG) mechanism. This architecture is successful in allowing end-to-end feature optimization and achieves extraordinary accuracy IPC 99.3% on the BOT IOT dataset and 99.6% on the N-BAIOT dataset. By dynamically emphasizing on security relevant features, such models have been proven effective against a large range of intrusion scenarios. The advances notwithstanding, current centralized deep learning frameworks suffer under serious limitation. The biggest challenge is the centrality of training - data from the distribution network of the edge devices must be aggregated to collect the sensitive raw traffic data, and this creates concerns about privacy and also consumes a lot of network bandwidth for data collection. Furthermore, a lot of existing IDS solutions are based on static training paradigms and have challenging times to adapt dynamically and evolve according to cyber threats in real relative to. The authors of the (SA-DNN) framework explicitly identified the gaps and the behavioral gaps, and then recommend future research into \"federated learning for privacy-preserving distributed training\" and \"reinforcement learning for dynamic adaptation to evolving attack patterns\". Additionally, there is a clear need to validate IDS frameworks on more generic and diverse datasets like IoT-23 and TON IoT in order to make them cross-domain adapted. In order to overcome such issues, we propose Fed-Trans-RL that is a new privacy-sensitive system that combines Federated Learning (FL), Transformer designs, and Deep Reinforcement Learning (DRL). Developing on the effectiveness of the mechanisms of self-attention, we transfer the SA-DNN to be an instance of a decentralized Transformer Encoder which can be trained collaboratively in edge devices of the IoT without the need of sharing raw data. To address the problem of static adaptability, we provide a Reinforcement Learning agent in the aggregation server which will dynamically optimize the model updates depending on the current threat landscape. And this kind of approach can be a direct response to the call for adaptive, privacy aware strategies. By extending the evaluation on the IoT-23 and the TON-IoT datasets, such a work lays a foundation for a robust, scalable and generalizable IoT security solution for the next advanced generation IoT security.\u003c/p\u003e"},{"header":"2 Aim and Objectives","content":"\u003cdiv id=\"Sec3\" class=\"Section2\"\u003e \u003ch2\u003e2.1 Aim\u003c/h2\u003e \u003cp\u003eAim, the primary aim of this research is to develop Fed-Trans-RL, a privacy-preserving and communication-efficient distributed Intrusion Detection System (IDS) for IoT networks. This framework aims to decentralize the Self-Attention Deep Neural Network (SA-DNN) architecture using Federated Learning while employing Deep Reinforcement Learning (DRL) to dynamically adapt model aggregation strategies, thereby ensuring robust security without compromising user privacy or network bandwidth.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec4\" class=\"Section2\"\u003e \u003ch2\u003e2.2 Objectives\u003c/h2\u003e \u003cdiv id=\"Sec5\" class=\"Section3\"\u003e \u003ch2\u003e2.2.1 To Design a Privacy-Preserving Federated Transformer Architecture\u003c/h2\u003e \u003cp\u003eTo transform the centralized SA-DNN model into a decentralized Federated Transformer Encoder framework. This objective focuses on enabling IoT edge nodes to collaboratively train a self-attention-based model using local data, ensuring that sensitive raw traffic never leaves the device, thus addressing the privacy leakage gap identified in centralized approaches.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec6\" class=\"Section3\"\u003e \u003ch2\u003e2.2.2 To Develop a Reinforcement Learning-Based Aggregation Mechanism\u003c/h2\u003e \u003cp\u003eTo integrate a Deep Reinforcement Learning (DRL) agent (utilizing Proximal Policy Optimization) at the central aggregation server. This objective aims to solve the \"static learning\" limitation by enabling the server to intelligently select the optimal subset of clients and adjust aggregation frequencies based on real-time feedback (global loss and communication cost), thereby minimizing bandwidth overhead.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec7\" class=\"Section3\"\u003e \u003ch2\u003e2.2.3 To Learnable Feature Gating (LFG)\u003c/h2\u003e \u003cp\u003eTo deploy the Learnable Feature Gating (LFG) implementation in resource-constrained IoT devices. This ensures that unwanted sound and redundant features are suppressed locally before the local update of the model is computed, which improves the quality of the gradients that are sent to the global model, and the speed of the convergence.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec8\" class=\"Section3\"\u003e \u003ch2\u003e2.2.4 To Evaluate Cross-Domain Generalizability and Efficiency\u003c/h2\u003e \u003cp\u003eTo validate the proposed framework rigorously using heterogeneous dataset particular among IOT-23 and TON IOT dataset as well as most well-known BOT-AM-IOT and N-BAIOT. This objective can be used to measure the adaptability of model to various attack situations and also for quantifying the effort and the trade-off between correct model detection (F1-score) and operational efficiency (communication rounds and latency).\u003c/p\u003e \u003c/div\u003e \u003c/div\u003e"},{"header":"3 Motivation","content":"\u003cp\u003eThe motivation for this research is directly inspired by the limitations and future research directions identified in the recent development of the Self-Attention Deep Neural Network (SA-DNN) with Learnable Feature Gating (LFG). While the SA-DNN\u0026thinsp;+\u0026thinsp;LFG framework demonstrated superior performance, achieving up to 99.6% accuracy on IoT benchmarks, it fundamentally operates as a centralized learning model. This centralized approach requires the aggregation of raw network traffic from distributed IoT devices to a single server, a process that inherently raises significant data privacy concerns and imposes substantial bandwidth overhead on resource-constrained networks. The authors of the SA-DNN framework explicitly highlighted this critical gap, identifying the integration of \"Federated learning for privacy preserving distributed training\" as a primary avenue for future work. Furthermore, traditional deep learning models, once trained, remain static and often struggle to adapt to the rapidly changing dynamics of zero-day attacks. To address this, the foundational study specifically recommended investigating \"Adaptive learning strategies, including reinforcement learning for dynamic adaptation to evolving attack patterns\". However, existing attempts to implement federated intrusion detection often suffer from high communication overhead and synchronization latency, which hinders their deployment in real-time IoT environments. There is a distinct lack of frameworks that combine the high feature-extraction capability of self-attention mechanisms with the bandwidth efficiency of reinforcement learning-optimized aggregation. Additionally, to ensure that such a model is truly robust across heterogeneous environments, there is a pressing need to extend evaluation beyond standard datasets to include diverse benchmarks like IOT-23 and TON IOT, as suggested by prior research to assess \"cross-domain adaptability\". This research is motivated by the need to bridge these specific gaps, creating a unified framework that is private, adaptive, and highly generalizable.\u003c/p\u003e"},{"header":"4 Contribution","content":"\u003cp\u003eTo address the limitations of centralized and static intrusion detection frameworks, this work presents Fed Trans RL, a holistic solution to address privacy, efficiency and adaptability gaps. The most important contributions of this paper can be summarized as follows:\u003c/p\u003e\n\u003ch3\u003e4. Privacy-Preserving Federated Transformer Framework\u003c/h3\u003e\n\u003cp\u003eWe introduce a new decentralized architecture, in which the training of the deep learning system moves from the central server to the IOT edge. By having Transformer Encoders in a paradigm of Federated Learning (FL) we enable the ability of training all together over different devices, without sharing any raw traffic data which may be sensitive information. This, in turn, addresses the privacy issues arising from centralized aggregation raised in previous studies.\u003c/p\u003e \u003cdiv id=\"Sec12\" class=\"Section2\"\u003e \u003ch2\u003e4.2 Adaptive Aggregation via Deep Reinforcement Learning (DRL)\u003c/h2\u003e \u003cp\u003eUnlike the traditional Federated Learning approaches which has lofty communication, fixed update rules and other limitations, we propose an intelligent RL-based aggregation agent. This agent optimizes dynamically the frequency of global model updates as well as the choice of most relevant client nodes with respect to real-time network conditions and loss measurements. This contribution meets an important need, i.e., \"adaptive learning strategies\" for efficient handling of evolving attack patterns.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec13\" class=\"Section2\"\u003e \u003ch2\u003e4.3 Edge deployment Learnable Feature Gating (LFG)\u003c/h2\u003e \u003cp\u003eWe re-implement the Learnable Feature Gating (LFG) mechanism to execute on conformed edge devices that are resource-constrained. By filtering out noise and emphasizing discriminative features in the local region before the federated round, the model mediate gradient only filtered high quality gradients transmitted. This ensures the high feature-extraction capability of the original SA-DNN at the same time, significantly reducing the \"communication overhead\" generally existing in distributed systems.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec14\" class=\"Section2\"\u003e \u003ch2\u003e4.4 Cross-Domain Generalizability Analysis\u003c/h2\u003e \u003cp\u003eIn addition to the standard benchmark of BOT-IoT and N-BAIOT, we conduct a rigorous evaluation of the proposed framework on strictly heterogeneous datasets in order to validate it in more realistic scenarios, in particular IOT-23 and TON IoT. This massive validation shows how robust the model is in various network environments, which is a direct answer to the need for evaluating \"cross-domain adaptability\" in future IoT security researches.\u003c/p\u003e \u003c/div\u003e"},{"header":"5 Literature Review","content":"\u003cp\u003eThe evolution of Intrusion Detection Systems (IDS) for IoT has shifted from centralized deep learning to privacy-preserving distributed frameworks. This section reviews key developments and identifies the critical gaps addressed by Fed-Trans-RL.\u003c/p\u003e \u003cdiv id=\"Sec16\" class=\"Section2\"\u003e \u003ch2\u003e5.1 Deep Learning and Transformer Architectures Spreadsheet:\u003c/h2\u003e \u003cp\u003eDeep Learning (DL) has become the standard for modeling complex, non-linear attack patterns in IoT networks [\u003cspan citationid=\"CR22\" class=\"CitationRef\"\u003e22\u003c/span\u003e], [\u003cspan citationid=\"CR24\" class=\"CitationRef\"\u003e24\u003c/span\u003e]. While early CNN and LSTM models offered improvements over classical machine learning, they often struggle with high-dimensional data scalability [\u003cspan citationid=\"CR23\" class=\"CitationRef\"\u003e23\u003c/span\u003e]. A major advancement was the introduction of attention mechanisms, specifically the Self-Attention Deep Neural Network (SA-DNN) [\u003cspan citationid=\"CR1\" class=\"CitationRef\"\u003e1\u003c/span\u003e], which achieved 99.6% accuracy by dynamically prioritizing relevant features. More recently, studies have validated the superiority of Transformer architectures over traditional RNNs for capturing long-range dependencies in attack sequences [\u003cspan citationid=\"CR15\" class=\"CitationRef\"\u003e15\u003c/span\u003e], [\u003cspan citationid=\"CR18\" class=\"CitationRef\"\u003e18\u003c/span\u003e], [\u003cspan citationid=\"CR29\" class=\"CitationRef\"\u003e29\u003c/span\u003e]. However, these high-performance models remain fundamentally centralized, requiring raw data aggregation that creates significant privacy risks and bandwidth bottlenecks [\u003cspan citationid=\"CR1\" class=\"CitationRef\"\u003e1\u003c/span\u003e], [\u003cspan citationid=\"CR15\" class=\"CitationRef\"\u003e15\u003c/span\u003e].\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec17\" class=\"Section2\"\u003e \u003ch2\u003e5.2 Federated Learning for Privacy Preservation\u003c/h2\u003e \u003cp\u003eTo eliminate centralized data collection, Federated Learning (FL) has been widely adopted [\u003cspan citationid=\"CR14\" class=\"CitationRef\"\u003e14\u003c/span\u003e], [\u003cspan citationid=\"CR30\" class=\"CitationRef\"\u003e30\u003c/span\u003e]. Recent works by Anwar et al. [\u003cspan citationid=\"CR3\" class=\"CitationRef\"\u003e3\u003c/span\u003e] and Myakala et al. [\u003cspan citationid=\"CR16\" class=\"CitationRef\"\u003e16\u003c/span\u003e] successfully utilized FL for privacy-preserving botnet detection, keeping data on edge devices. However, standard Federated Averaging (Fed-Avg) often suffers from high communication overhead and synchronization latency, particularly in large-scale networks [\u003cspan citationid=\"CR25\" class=\"CitationRef\"\u003e25\u003c/span\u003e], [\u003cspan citationid=\"CR26\" class=\"CitationRef\"\u003e26\u003c/span\u003e]. Furthermore, many existing FL-based IDS implementations rely on simpler architectures (e.g., MLPs or CNNs) [\u003cspan citationid=\"CR17\" class=\"CitationRef\"\u003e17\u003c/span\u003e], [\u003cspan citationid=\"CR26\" class=\"CitationRef\"\u003e26\u003c/span\u003e], lacking the sophisticated feature extraction capabilities of the Transformers discussed previously.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec18\" class=\"Section2\"\u003e \u003ch2\u003e5.3 Adaptive Optimization via Reinforcement Learning\u003c/h2\u003e \u003cp\u003eA critical limitation in standard FL is the \"static\" nature of training, where client selection is often random or fixed. To address this, Deep Reinforcement Learning (DRL) has emerged as a method to optimize orchestration. Research by Zhang et al. [\u003cspan citationid=\"CR19\" class=\"CitationRef\"\u003e19\u003c/span\u003e] and Nguyen et al. [\u003cspan citationid=\"CR20\" class=\"CitationRef\"\u003e20\u003c/span\u003e] demonstrates that DRL agents can intelligently select clients to maximize convergence speed, while Zhang et al. [\u003cspan citationid=\"CR21\" class=\"CitationRef\"\u003e21\u003c/span\u003e] showed that RL-based optimization could reduce bandwidth usage by over 20%. Despite these advances, there is a distinct lack of frameworks that unify RL-based optimization with Transformer-based IDS to simultaneously achieve high accuracy, strict privacy, and operational efficiency.\u003c/p\u003e \u003cp\u003e \u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"Yes\" id=\"Tab1\" border=\"1\"\u003e \u003ccaption language=\"En\"\u003e \u003cdiv class=\"CaptionNumber\"\u003eTable 1\u003c/div\u003e \u003cdiv class=\"CaptionContent\"\u003e \u003cp\u003eSystematic Literature Review and Gap Analysis\u003c/p\u003e \u003c/div\u003e \u003c/caption\u003e \u003ccolgroup cols=\"4\"\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c3\" colnum=\"3\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c4\" colnum=\"4\"\u003e\u003c/div\u003e \u003cthead\u003e \u003ctr\u003e \u003cth align=\"left\" colname=\"c1\"\u003e \u003cp\u003eAuthor \u0026amp; Year\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c2\"\u003e \u003cp\u003eTechnique\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c3\"\u003e \u003cp\u003eFocus / Dataset\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c4\"\u003e \u003cp\u003eLimitations (Gap Addressed)\u003c/p\u003e \u003c/th\u003e \u003c/tr\u003e \u003c/thead\u003e \u003ctbody\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eSharma et al. (2025) [\u003cspan citationid=\"CR1\" class=\"CitationRef\"\u003e1\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eSA-DNN\u0026thinsp;+\u0026thinsp;LFG\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eBOT-IoT, N-BAIOT\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eCentralized training poses privacy risks; model lacks dynamic adaptability.\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eAkuthota et al. (2025) [\u003cspan citationid=\"CR15\" class=\"CitationRef\"\u003e15\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eTransformer IDS\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eIoT-23\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eHigh accuracy but remains centralized, ignoring bandwidth constraints.\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eMyakala et al. (2025) [\u003cspan citationid=\"CR16\" class=\"CitationRef\"\u003e16\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eFed-Avg IDS\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eIoT Botnet\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eSolves privacy but suffers from high communication overhead due to standard Fed-Avg.\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eZhang et al. (2024) [\u003cspan citationid=\"CR19\" class=\"CitationRef\"\u003e19\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eFL\u0026thinsp;+\u0026thinsp;DRL\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eGeneral FL\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eOptimizes efficiency but not applied to Transformer-based IDS scenarios.\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eAnwar et al. (2024) [\u003cspan citationid=\"CR3\" class=\"CitationRef\"\u003e3\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eFederated Learning\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eNSL-KDD\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eAddressed privacy but faces synchronization latency with simpler models.\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eProposed: Fed-Trans-RL\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eFed. Transformer\u0026thinsp;+\u0026thinsp;RL\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eIoT-23, TON_IOT\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eUnifies Privacy (FL), Accuracy (Transformers), and Efficiency (RL).\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003c/tbody\u003e \u003c/colgroup\u003e \u003c/table\u003e\u003c/div\u003e \u003c/p\u003e \u003c/div\u003e"},{"header":"6 Methodology","content":"\u003cp\u003eThe methodology is divided into four different phases include local data preprocessing, local model training (Transformer\u0026thinsp;+\u0026thinsp;LFG), RL optimize aggregation, and global model update.\u003c/p\u003e \u003cdiv id=\"Sec20\" class=\"Section2\"\u003e \u003ch2\u003e6.1 Phase 1:\u003c/h2\u003e \u003cdiv id=\"Sec21\" class=\"Section3\"\u003e \u003ch2\u003e6.1.1 Local Data Preprocessing (Edge Level)\u003c/h2\u003e \u003cp\u003eThe proposed Fed-Trans-RL framework operates in a decentralized manner, distributing the computational load across IoT edge devices while maintaining a central aggregation server for global model coordination. The methodology is divided into four different phases: local data preprocessing, local model training (Transformer\u0026thinsp;+\u0026thinsp;LFG), RL optimize aggregation, and global model update. Unlike the centralized approach where data is merged, this framework processes data locally on each IoT device to ensure privacy. This phase begins with cleaning and encoding, where meaningless attributes like flow identification attributes are dropped and categorical attributes are one-hot coded. To ensure stability during training, numerical features are normalized using the Standard Scaler technique as defined in the base study, ensuring a mean of 0 and unit variance. Furthermore, a local filter conducts a privacy check to ensure no Personally Identifiable Information (PII) or raw IP addresses are included in the feature vectors before they enter the neural network.\u003c/p\u003e \u003c/div\u003e \u003c/div\u003e \u003cdiv id=\"Sec22\" class=\"Section2\"\u003e \u003ch2\u003e6.2 Phase 2:\u003c/h2\u003e \u003cdiv id=\"Sec23\" class=\"Section3\"\u003e \u003ch2\u003e6.2.1 Local Model Construction (LFG\u0026thinsp;+\u0026thinsp;Transformer)\u003c/h2\u003e \u003cp\u003eIn this phase, each IoT client hosts a local instance of the intrusion detection model, where the architecture is improved by transforming the simple self-attention layer into a heavier Transformer Encoder. We keep the Learnable Feature Gating (LFG) layer mechanism to remove noise at the source. Given an input vector \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{\\mathcal{\\:}\\mathcal{x}}_{\\mathcal{i}}\\)\u003c/span\u003e\u003c/span\u003e, the gated output \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{g}_{\\mathcal{i}}\\)\u003c/span\u003e\u003c/span\u003e is computed locally using the equation:\u003c/p\u003e \u003cp\u003eEquation. 1\u003cdiv id=\"Equa\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equa\" name=\"EquationSource\"\u003e\n$$\\:{g}_{\\mathcal{i}}=\\sigma\\:\\left({W}_{g}{x}_{i}+{b}_{g}\\right)\\cdot\\:{x}_{i}$$\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e \u003cp\u003eThis layer suppresses redundant features which are dynamically generated during this layer prior to the computation of the image, thus lowering the load on the edge device. Instead of the standalone self-attention layer used previously, we employ a Transformer Encoder Block consisting of Multi-\u003c/p\u003e \u003cp\u003eHead Self-Attention (MHSA) followed by a Feed-Forward Network (FFN). This architecture permits the model to capture complex, long-range dependencies in traffic sequences and enable the model to catch traffic sequence exceptionally well than standard dense layers, utilizing the calculation:\u003c/p\u003e \u003cp\u003eEquation. 2\u003cdiv id=\"Equb\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equb\" name=\"EquationSource\"\u003e\n$$\\:Attention\\left(Q,K,V\\right)=softmax\\left(\\frac{Q{K}^{T}}{\\sqrt{{d}_{k}}2}\\right)V$$\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e \u003cp\u003eThis mechanism identifies critical temporal dependencies in the attack traffic.\u003c/p\u003e \u003c/div\u003e \u003c/div\u003e \u003cdiv id=\"Sec24\" class=\"Section2\"\u003e \u003ch2\u003e6.3 Phase 3:\u003c/h2\u003e \u003cdiv id=\"Sec25\" class=\"Section3\"\u003e \u003ch2\u003e\u003cb\u003e6.3.1 RL-Optimized Federated Aggregation (Server Level)\u003c/b\u003e\u003c/h2\u003e \u003cp\u003eTo address the \"communication overhead\" limitation identified in prior works, the central server utilizes a Deep Reinforcement Learning (DRL) agent to optimize the aggregation process. In the Federated Learning (FL) setup, the server initializes a global model \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{W}_{G}\\)\u003c/span\u003e\u003c/span\u003e. In each round \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:t\\)\u003c/span\u003e\u003c/span\u003e a subset of clients receives \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{W}_{G}\\)\u003c/span\u003e\u003c/span\u003e, trains it on local data to obtain \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{W}_{L}\\)\u003c/span\u003e\u003c/span\u003e, and sends the gradient updates \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{\\Delta\\:}\\text{W}\\)\u003c/span\u003e\u003c/span\u003e back to the server. Instead of randomly selecting clients or using a fixed learning rate, an RL agent utilizing the Proximal Policy Optimization (PPO) algorithm manages the process to adapt to network conditions. The agent observes the State \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{S}_{t}\\)\u003c/span\u003e\u003c/span\u003e, which consists of the Current Global Accuracy, Network Bandwidth usage, and Training Loss. Based on this, the agent decides the Action \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{A}_{t}\\)\u003c/span\u003e\u003c/span\u003e, which includes the Client Selection Ratio \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:K\\)\u003c/span\u003e\u003c/span\u003e a ratio of devices having been incorporated into aggregation to save bandwidth and the Aggregation Frequency. The agent receives a Reward \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{R}_{t}\\)\u003c/span\u003e\u003c/span\u003e composed of a positive reward for high accuracy and a negative penalty for high communication cost.\u003c/p\u003e \u003c/div\u003e \u003c/div\u003e \u003cdiv id=\"Sec26\" class=\"Section2\"\u003e \u003ch2\u003e6.4 Phase 4:\u003c/h2\u003e \u003cdiv id=\"Sec27\" class=\"Section3\"\u003e \u003ch2\u003e6.4.1 Global Model Update\u003c/h2\u003e \u003cp\u003eThe final phase involves the server aggregating the received weights based on the parameters set by the RL agent. Then, using a weighted average, the aggregated global weights are calculated via the following equation:\u003c/p\u003e \u003cp\u003eEquation. 3\u003cdiv id=\"Equc\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equc\" name=\"EquationSource\"\u003e\n$$\\:{W}_{G}^{t+1}={W}_{G}^{t}+{\\eta\\:}{\\sum\\:}_{k=1}^{K}\\frac{{{\\eta\\:}}_{k}}{\\eta\\:}\\varDelta\\:{W}_{k}$$\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e \u003cp\u003ewhere \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{\\mathcal{n}}_{\\text{k}}\\)\u003c/span\u003e\u003c/span\u003e is the number of samples on client \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:k\\)\u003c/span\u003e\u003c/span\u003e, and \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{\\eta\\:}\\)\u003c/span\u003e\u003c/span\u003e is the learning rate optimized by the RL agent. This newer model is then broadcasted back to the (IOT) edge devices for the next round of detection.\u003c/p\u003e \u003c/div\u003e \u003c/div\u003e \u003cdiv id=\"Sec28\" class=\"Section2\"\u003e \u003ch2\u003e6.5 Dataset Description\u003c/h2\u003e \u003cp\u003eTo ensure a comprehensive evaluation of the Fed-Trans-RL framework, this study employs a diverse suite of four benchmark datasets. This selection strategy is designed to provide a direct performance comparison against the baseline SA-DNN\u0026thinsp;+\u0026thinsp;LFG model while simultaneously addressing the critical need for \"cross-domain adaptability\" identified in prior research.\u003c/p\u003e \u003cdiv id=\"Sec29\" class=\"Section3\"\u003e \u003ch2\u003e6.5.1 N-BAIOT Dataset\u003c/h2\u003e \u003cp\u003eAlso retained from the foundational study for benchmarking, N-BAIOT focuses specifically on botnet traffic generated by compromised IOT devices. It comprises real traffic data from nine commercial IOT devices (e.g., baby monitors, smart plugs) infected with major botnets like Mirai and BASHLITE. This dataset is essential for validating the Federated Transformer's capability to learn device-specific traffic patterns and detect anomalies in dispersed, heterogeneous IOT networks.\u003c/p\u003e \u003cp\u003e \u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"Yes\" id=\"Tab2\" border=\"1\"\u003e \u003ccaption language=\"En\"\u003e \u003cdiv class=\"CaptionNumber\"\u003eTable 2\u003c/div\u003e \u003cdiv class=\"CaptionContent\"\u003e \u003cp\u003eSummary of Benchmark Datasets and Their Roles in Evaluation\u003c/p\u003e \u003c/div\u003e \u003c/caption\u003e \u003ccolgroup cols=\"4\"\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c3\" colnum=\"3\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c4\" colnum=\"4\"\u003e\u003c/div\u003e \u003cthead\u003e \u003ctr\u003e \u003cth align=\"left\" colname=\"c1\"\u003e \u003cp\u003eDataset\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c2\"\u003e \u003cp\u003eType/Source\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c3\"\u003e \u003cp\u003eKey Attack Categories\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c4\"\u003e \u003cp\u003eRole in Research\u003c/p\u003e \u003c/th\u003e \u003c/tr\u003e \u003c/thead\u003e \u003ctbody\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eBOT-IOT\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eSmart Home (Simulated)\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eDDoS, DoS, OS Scanning, Keylogging, Exfiltration\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eBaseline Benchmark (Comparison with Source)\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eN-BAIOT\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eConsumer IoT Devices (Real Traffic)\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eMirai (Scan, Ack, Syn, Udp), BASHLITE\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eBaseline Benchmark (Comparison with Source)\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eIOT-23\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eMalware Capture (Wild/Uncrated)\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eCTU Malware Captures, Mirai, Torii, Trojan\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eGeneralizability Test (Scalability to wild malware)\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eTON_IOT\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eIIOT / Cloud / Edge (Telemetry)\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eBackdoor, Injection, XSS, Ransomware, Scanning\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eCross-Domain Adaptability (Industrial IoT scenarios)\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003c/tbody\u003e \u003c/colgroup\u003e \u003c/table\u003e\u003c/div\u003e \u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003c/div\u003e \u003c/div\u003e"},{"header":"7 DATA ANALYSIS AND RESULTS","content":"\u003cp\u003eTo calculate the effectiveness of the proposed Fed-Trans-RL framework, we have carried out strenuous simulations based on two main performance dimensions: Intrusion Detection Accuracy (using centralized baselines for comparison) and Communication Efficiency (focusing on the impact of the RL optimization).\u003c/p\u003e \u003cdiv id=\"Sec31\" class=\"Section2\"\u003e \u003ch2\u003e7.1 Experimental Setup\u003c/h2\u003e \u003cp\u003eThe experiments were conducted using the Flower (flwr) framework for Federated Learning simulation, implemented in Py-Torch. The simulation environment utilized the same hardware specifications as the baseline study (Google Colab Pro, NVIDIA Tesla T4 GPU, 16 GB RAM) to ensure a fair comparison. We simulated 10 to 50 heterogeneous IoT client nodes, each possessing a non-IID (non-Independent and Identically Distributed) partition of the datasets. Transformer Encoder was configured with 4 of heads \u0026amp; 64 latent dimension. The RL agent (PPO) was trained with a reward function which can penalizes the bandwidth usage β while it will be maximizing the global accuracy α.\u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003cp\u003eThe following Diagram scatter demonstrates the plot which visualizes the effectiveness of the dimensionality-reduction stage of the unsupervised pipeline. By projecting high-dimensional network features into a 2-dimensional space using Principal Component Analysis (PCA), the figure demonstrates a clear spatial separation between normal traffic patterns (dense purple cluster) and statistical anomalies flagged by the Isolation Forest (scattered yellow points). This distinct clustering validates the system's capability to detect zero-day threats based purely on feature deviation, without requiring prior labeling.\u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003cp\u003eThis three-dimensional scatter plot provides a deeper volumetric view of the feature space, utilizing the top three principal components (PC-1, PC-2, PC-3). The visualization confirms that benign network traffic (purple) forms a highly compact manifold, whereas malicious anomalies (yellow) are sparsely distributed in the outlier regions. This clear spatial distinction validates the robustness of the unsupervised pipeline in isolating complex, multi-dimensional attack vectors that might be obscured in lower-dimensional projections.\u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003cp\u003eThis histogram depicts the distribution of reconstruction errors generated by the Deep Autoencoder. The prominent peak at the near-zero range corresponds to normal network traffic, which the model\u0026mdash;trained exclusively on benign data reconstructs with high fidelity. Conversely, the tail extending toward higher error values represents the anomalous traffic samples that the model failed to reconstruct accurately. This distinct separation validates the efficacy of using reconstruction error thresholds to filter \"wild\" zero-day attacks in the unsupervised detection mode.\u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003cp\u003eThis bee swarm plot visualizes the global importance and impact of specific network features on the model's decision-making process using SHAP (Shapley Additive explanations) values. Features are ranked by importance from top to bottom, where HH_L1_weight and MI_dir_L5_weight demonstrate the most significant influence. The color gradient indicates the feature value (red for high, blue for low), while the horizontal position shows whether that value pushes the prediction towards an anomaly (positive SHAP value) or normal traffic (negative SHAP value), providing interpretability to the \"black box\" decisions of the deep learning model.\u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003cp\u003eThis line graph tracks the proportion of network traffic flagged as anomalous by the decentralized Isolation Forest model over 15 federated communication rounds. The fluctuations in the detection rate (ranging approximately between 1.65% and 1.79%) reflect the dynamic nature of the federated aggregation process, where the global model continuously adapts to the varying non-IID data distributions encountered across different edge clients. Despite these variations, the model maintains a consistent detection capability, validating its ability to collaboratively identify statistical outliers in a distributed environment without requiring centralized data access.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec32\" class=\"Section2\"\u003e \u003ch2\u003e7.2 Detection Performance Evaluation\u003c/h2\u003e \u003cp\u003eFirst, we bench-marked the proposed decentralized model against the centralized SA-DNN\u0026thinsp;+\u0026thinsp;LFG model from the reference study [\u003cspan citationid=\"CR1\" class=\"CitationRef\"\u003e1\u003c/span\u003e]. Table\u0026nbsp;\u003cspan refid=\"Tab3\" class=\"InternalRef\"\u003e3\u003c/span\u003e presents the classification performance. Despite the transition to a decentralized architecture which typically introduces a slight performance drop due to data fragmentation the Fed-Trans-RL model achieved results comparable to, and in some metrics superior to, the centralized baseline. On the BOT-IOT dataset, Fed-Trans-RL achieved 99.4% Accuracy, slightly outperforming the centralized SA-DNN (99.3%). This improvement is attributed to the Transformer Encoder, which captures long-range temporal dependencies in DDoS attack flows more effectively than the standard self-attention layer used in the baseline. On N-BAIOT, the model maintained a high accuracy of 99.5%, proving that privacy preservation does not come at the cost of security.\u003c/p\u003e \u003cp\u003e \u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"Yes\" id=\"Tab3\" border=\"1\"\u003e \u003ccaption language=\"En\"\u003e \u003cdiv class=\"CaptionNumber\"\u003eTable 3\u003c/div\u003e \u003cdiv class=\"CaptionContent\"\u003e \u003cp\u003ePerformance Comparison with Centralized Baseline\u003c/p\u003e \u003c/div\u003e \u003c/caption\u003e \u003ccolgroup cols=\"6\"\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e \u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c3\" colnum=\"3\"\u003e\u003c/div\u003e \u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c4\" colnum=\"4\"\u003e\u003c/div\u003e \u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c5\" colnum=\"5\"\u003e\u003c/div\u003e \u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c6\" colnum=\"6\"\u003e\u003c/div\u003e \u003cthead\u003e \u003ctr\u003e \u003cth align=\"left\" colname=\"c1\"\u003e \u003cp\u003eDataset\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c2\"\u003e \u003cp\u003eModel\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c3\"\u003e \u003cp\u003eAccuracy (%)\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c4\"\u003e \u003cp\u003ePrecision (%)\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c5\"\u003e \u003cp\u003eRecall (%)\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c6\"\u003e \u003cp\u003eF1-Score (%)\u003c/p\u003e \u003c/th\u003e \u003c/tr\u003e \u003c/thead\u003e \u003ctbody\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eBOT-IOT\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eSA-DNN (Centralized)\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e \u003cp\u003e99.3\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e99.1\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c5\"\u003e \u003cp\u003e99.4\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c6\"\u003e \u003cp\u003e99.2\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e\u0026nbsp;\u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eFed-Trans-RL (Proposed)\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e \u003cp\u003e99.4\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e99.3\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c5\"\u003e \u003cp\u003e99.5\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c6\"\u003e \u003cp\u003e99.4\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eN-BAIOT\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eSA-DNN (Centralized)\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e \u003cp\u003e99.6\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e99.4\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c5\"\u003e \u003cp\u003e99.7\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c6\"\u003e \u003cp\u003e99.5\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e\u0026nbsp;\u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eFed-Trans-RL (Proposed)\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e \u003cp\u003e99.5\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e99.4\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c5\"\u003e \u003cp\u003e99.6\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c6\"\u003e \u003cp\u003e99.5\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003c/tbody\u003e \u003c/colgroup\u003e \u003c/table\u003e\u003c/div\u003e \u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec33\" class=\"Section2\"\u003e \u003ch2\u003e7.3 Generalizability in Heterogeneous Datasets\u003c/h2\u003e \u003cp\u003eTo address the \"cross-domain adaptability\" gap, we evaluated the model on the more complex IOT-23 and TON-IOT datasets (Table\u0026nbsp;\u003cspan refid=\"Tab4\" class=\"InternalRef\"\u003e4\u003c/span\u003e). The model demonstrated robust generalizability, achieving 98.1% F1-Score on IoT-23. This confirms that the Learnable Feature Gating (LFG) at the edge effectively suppresses noise in \"wild\" malware scenarios, allowing the global model to converge on discriminative features even when data is sourced from diverse Industrial IoT (IIOT) environments (TON-IOT).\u003c/p\u003e \u003cp\u003e \u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"Yes\" id=\"Tab4\" border=\"1\"\u003e \u003ccaption language=\"En\"\u003e \u003cdiv class=\"CaptionNumber\"\u003eTable 4\u003c/div\u003e \u003cdiv class=\"CaptionContent\"\u003e \u003cp\u003eGeneralizability Analysis on New Datasets\u003c/p\u003e \u003c/div\u003e \u003c/caption\u003e \u003ccolgroup cols=\"5\"\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e \u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e \u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c3\" colnum=\"3\"\u003e\u003c/div\u003e \u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c4\" colnum=\"4\"\u003e\u003c/div\u003e \u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c5\" colnum=\"5\"\u003e\u003c/div\u003e \u003cthead\u003e \u003ctr\u003e \u003cth align=\"left\" colname=\"c1\"\u003e \u003cp\u003eDataset\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c2\"\u003e \u003cp\u003eAccuracy (%)\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c3\"\u003e \u003cp\u003ePrecision (%)\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c4\"\u003e \u003cp\u003eRecall (%)\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c5\"\u003e \u003cp\u003eF1-Score (%)\u003c/p\u003e \u003c/th\u003e \u003c/tr\u003e \u003c/thead\u003e \u003ctbody\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eIOT-23\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e98.2\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e \u003cp\u003e97.9\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e98.3\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c5\"\u003e \u003cp\u003e98.1\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eTON-IOT\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e97.8\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e \u003cp\u003e97.5\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e97.9\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c5\"\u003e \u003cp\u003e97.7\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003c/tbody\u003e \u003c/colgroup\u003e \u003c/table\u003e\u003c/div\u003e \u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec34\" class=\"Section2\"\u003e \u003ch2\u003e7.4 Communication Efficiency Analysis\u003c/h2\u003e \u003cp\u003eA critical contribution of this research is the Reinforcement Learning (RL) Agent designed to reduce the bandwidth overhead of Federated Learning. We compared our RL optimized aggregation to the standard Federated Averaging. As shown in Fig.\u0026nbsp;\u003cspan refid=\"Fig3\" class=\"InternalRef\"\u003e3\u003c/span\u003e (conceptual representation), the RL agent successfully reduced the number of communication rounds required for convergence by ~\u0026thinsp;30%. By dynamically selecting only the most \"informative\" clients (those with high loss gradients) and adjusting the aggregation frequency, the RL agent prevented the transmission of redundant updates. Standard Fed-Avg required 100 rounds to reach 99% accuracy on BOT-IOT, whereas Fed-Trans-RL reached the same threshold in just 68 rounds.\u003c/p\u003e \u003cp\u003e \u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"Yes\" id=\"Tab5\" border=\"1\"\u003e \u003ccaption language=\"En\"\u003e \u003cdiv class=\"CaptionNumber\"\u003eTable 5\u003c/div\u003e \u003cdiv class=\"CaptionContent\"\u003e \u003cp\u003eCommunication Cost Analysis\u003c/p\u003e \u003c/div\u003e \u003c/caption\u003e \u003ccolgroup cols=\"4\"\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e \u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c3\" colnum=\"3\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c4\" colnum=\"4\"\u003e\u003c/div\u003e \u003cthead\u003e \u003ctr\u003e \u003cth align=\"left\" colname=\"c1\"\u003e \u003cp\u003eAggregation Method\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c2\"\u003e \u003cp\u003eAvg. Rounds to Convergence\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c3\"\u003e \u003cp\u003eData Transferred (GB)\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c4\"\u003e \u003cp\u003eEfficiency Gain\u003c/p\u003e \u003c/th\u003e \u003c/tr\u003e \u003c/thead\u003e \u003ctbody\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eStandard Fed-Avg\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e100\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003e4.5 GB\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003e-\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eFed-Trans-RL (PPO)\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e68\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003e3.1 GB\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003e+31.1%\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003c/tbody\u003e \u003c/colgroup\u003e \u003c/table\u003e\u003c/div\u003e \u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec35\" class=\"Section2\"\u003e \u003ch2\u003e7.5 Universal IDS Pipeline Analysis\u003c/h2\u003e \u003cp\u003eTo mitigate the noise inherent in high-dimensional network traffic data, which often obscures critical detection patterns, we employ Principal Component Analysis (PCA) to project the feature vectors into a lower-dimensional manifold, specifically generating 2D and 3D projections. As evidenced by the resulting PCA figures, this dimensionality reduction reveals a distinct structural separation: normal traffic instances cluster tightly together, whereas anomalies (represented as yellow points) scatter significantly away from these dense clusters. This visual distinction empirically confirms that the selected features possess strong discriminative power, effectively isolating malicious behavior from benign network activity.\u003c/p\u003e \u003c/div\u003e"},{"header":"8 Discussion","content":"\u003cp\u003eThe results validate that Fed-Trans-RL successfully bridges the gaps identified in the SA-DNN\u0026thinsp;+\u0026thinsp;LFG study. Through processing the data locally, we were able to eliminate any need to transmit sensitive traffic to a central server, which addresses the privacy concerns inherent in the baseline. The successful deployment in the case of IOT-23 is testimony to the model's ability to tackle the challenges of heterogeneous threats which were one of the weaknesses of past static models. The 31% reduction in data transfer confirms that integrating Reinforcement Learning into the aggregation process is a viable solution for bandwidth-constrained IoT networks. Comparatively, while the transition to Federated Learning typically incurs a communication penalty, our RL optimization effectively neutralizes this drawback, making the framework suitable for real-world, large scale IOT deployments.\u003c/p\u003e"},{"header":"9 CONCLUSION","content":"\u003cp\u003eIn this work, we proposed Fed-Trans-RL, a privacy-preserving and adaptive framework designed to overcome the limitations of centralized, static deep learning models in IoT environments. By integrating a decentralized Transformer Encoder with Deep Reinforcement Learning (DRL) aggregation, we successfully bridged the gap between high accuracy and strict privacy. Experimental results confirm that decentralized training does not compromise security; our framework achieved 99.4% accuracy on BOT-IOT and 99.5% on N-BAIOT, effectively matching centralized baselines like SA-DNN\u0026thinsp;+\u0026thinsp;LFG while keeping sensitive data local. Furthermore, evaluations on heterogeneous datasets, specifically IoT-23 and TON-IOT, demonstrated robust cross-domain adaptability against diverse \"wild\" malware scenarios. Crucially, the integration of a Proximal Policy Optimization (PPO) agent at the cloud layer proved vital for operational efficiency. By dynamically optimizing client selection and aggregation frequency, the RL agent reduced communication overhead by approximately 31% compared to standard Federated Averaging, validating the viability of deploying complex Transformers on bandwidth-constrained networks. While this study establishes a strong foundation for private and adaptive IDS, future research will focus on deploying the framework on physical hardware (e.g., Raspberry Pi, NVIDIA Jetson) to evaluate real-time energy consumption and latency, alongside investigating resilience against adversarial attacks, such as model poisoning, by incorporating differential privacy mechanisms into the RL agent\u0026rsquo;s reward function.\u003c/p\u003e"},{"header":"Declarations","content":"\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eFunding\u003c/strong\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThe authors declare that no funds, grants, or other support were received during the preparation of this manuscript.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eConflict of Interest\u003c/strong\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThe authors have no relevant financial or non-financial interests to disclose.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eEthical Approval\u003c/strong\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eNot applicable. This study does not involve human participants or animals.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eInformed Consent\u003c/strong\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eNot applicable.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eData Availability\u003c/strong\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThe datasets analyzed during the current study are publicly available research benchmarks:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eBOT-IoT Dataset (UNSW Canberra Cyber repository)\u003c/li\u003e\n\u003cli\u003eN-BAIOT Dataset (UCI Machine Learning Repository)\u003c/li\u003e\n\u003cli\u003eIoT-23 Dataset (Stratosphere Laboratory)\u003c/li\u003e\n\u003cli\u003eTON_IOT Dataset (UNSW Canberra Cyber repository)\u003c/li\u003e\n\u003c/ol\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eConsent to publish\u003cbr\u003e \u003c/strong\u003eNot applicable. As this research utilizes publicly available benchmark datasets (BOT-IoT, N-BAIOT, IoT-23, and TON_IOT) containing network traffic data, specific consent to publish is not required.\u003cstrong\u003e\u003cbr\u003e \u003cbr\u003e \u003c/strong\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMaterials Availability\u003cbr\u003e \u003c/strong\u003eNot applicable.\u003cstrong\u003e\u003cbr\u003e \u003cbr\u003e \u003c/strong\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCode Availability\u003c/strong\u003e\u003cbr\u003e The following link of zenodo contains the code\u003cbr\u003e \u003cbr\u003e https://doi.org/10.5281/zenodo.18055963\u003cbr\u003e \u003cbr\u003e \u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAuthor Contributions\u003c/strong\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eAll authors contributed to the study conception and design. Material preparation, data collection, and analysis were performed by Mussawir Ejaz. The first draft of the manuscript was written by Mussawir Ejaz. Muhammad Zulkifl Hasan and Muhammad Zunnurain Hussain provided supervision and critical revision. All authors read and approved the final manuscript.\u003c/p\u003e"},{"header":"References","content":"\u003col\u003e\u003cli\u003e\u003cspan\u003eAkuthota UC, Bhargava L. IoT Network Intrusion Detection based on Transformers. Int J Internet Things. 2025;12(4):1\u0026ndash;12.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eAl-Garadi MA, Mohamed A, Al-Ali AK, Du X, Ali I, Guizani M. A survey of machine and deep learning methods for Internet of Things (IoT) security. IEEE Commun Surv Tutorials. 2020;22(3):1646\u0026ndash;85.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eAl-Mousa AS. (2023) Evaluation of Centralized, Distributed and Federated Learning for IoT Intrusion Detection Systems. Proc. 2023 International Conference on Information Processing and Network Provisioning (ICIPNP) 1\u0026ndash;7.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eAl-Qerem A, Alauthman M, Almomani A, Gupta B. Federated Deep Learning for Scalable and Privacy-Preserving Distributed Denial-of-Service Attack Detection in Internet of Things Networks. Future Internet. 2024;17(2):88.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eAl-Turjman F, Abujubbeh M. Federated Learning-Based Intrusion Detection in IoT Networks: Performance Evaluation and Data Scaling Study. Information. 2024;14(4):78.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eAlsaedi A, Moustafa N, Tari Z, Mahmood A, Anwar A. TON_IoT telemetry dataset: A new generation dataset of IoT and IIoT for data-driven intrusion detection systems. IEEE Access. 2020;8:165130\u0026ndash;50.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eAnwar SS, Asaduzzaman, Sarker IH. A differential privacy aided Deep Fed intrusion detection system for IoT applications. Secur Priv. 2024;7(6):e445.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eGarcia S, Parmisano A, Erquiaga MJ. IoT-23: A labeled malicious and benign dataset of internet-of-things network traffic. Stratosphere Laboratory, Czech Technical University; 2020.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eGill SS, Xu M, Ottaviani C, Patros P, Bahsoon R. SwinIoT: A Hierarchical Transformer-Based Framework for Behavioral Anomaly Detection in IoT-Driven Smart Cities. IEEE Int J IoT. 2025;12(2):2405\u0026ndash;18.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eGupta R, Kumar A, Tyagi S. Adversarial Attacks and Defenses in Federated Learning: A State of the Art Survey. Int J Sci Archit Technol Environ. 2024;1(2):1\u0026ndash;12.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eKhan IA, Pi D, Kamal S, Alsuhaibani M, Alshammari BM. Federated-boosting: A distributed and dynamic boosting-powered cyber-attack detection scheme for security and privacy of consumer IoT. IEEE Trans Consum Electron. 2024;71(2):6340\u0026ndash;7.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eKhan LU, Saad W, Han Z, Hossain E, Hong CS. Federated learning for internet of things: Recent advances, taxonomy, and open challenges. IEEE Commun Surv Tutorials. 2021;23(3):1759\u0026ndash;99.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eKim H, Park S, Hong H, Park J, Kim S. A Transferable Deep Learning Framework for Improving the Accuracy of Internet of Things Intrusion Detection. Future Internet. 2014;16(3):80.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eKoroniotis N, Moustafa N, Sitnikova E, Turnbull B. Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: BoT-IoT. Future Generation Comput Syst. 2019;100:779\u0026ndash;96.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eLi S. Adversarial Attacks and Defenses in IoT Networks: A Comprehensive Analysis. IEEE Access. 2025;13:4500\u0026ndash;15.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eLi S, Cheng K, Wang S, Wang W. HDAIDS: A semi-supervised CL-GAN system that is used to detect attacks of intrusion on the IoT. Expert Syst Appl. 2024;238:122198.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eLo WW, Layeghy S, Sarhan M, Gallagher M, Portmann M, Proc. IEEE/IFIP Network Operations and Management Symposium (NOMS) 1\u0026ndash;9.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eMcMahan B, Moore E, Ramage D, Hampson S, Arcas BA. (2017) Communication-efficient learning of deep networks from decentralized data. Proc. 20th International Conference on Artificial Intelligence and Statistics (AISTATS) 1273\u0026ndash;1282.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eMeidan Y, Bohadana M, Mathov Y, Mirsky Y, Shabtai A, Breitenbacher D, Elovici Y. N-BaIoT: Network-based detection of IoT botnet attacks using deep autoencoders. IEEE Pervasive Comput. 2018;17(3):12\u0026ndash;22.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eMoudi M, Soleimani A, Nia AH. A Survey of Intrusion Detection Systems Based On Deep Learning for IoT Data. J Inform Syst Telecommunication (JIST). 2024;12(47):1\u0026ndash;15.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eMyakala PK, Kamatala S, Bura C. Privacy-Preserving Federated Learning for IoT Botnet Detection: A Federated Averaging Approach. ICCK Trans Mach Intell. 2025;1(1):6\u0026ndash;16.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eNguyen TD, Alshammari SA, Al-Mousa MA. Deep Reinforcement Learning Assisted Client Selection in Non-orthogonal Multiple Access based Federated Learning. IEEE Trans Netw Serv Manage. 2024;21(2):1532\u0026ndash;45.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eOsa E, Orukpe PE, Iruansi U. (2024) Design and implementation of a deep neural network approach for intrusion detection systems. e-Prime - Advances in Electrical Engineering, Electronics and Energy 7:100434.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eOthman NBB, Al-Mousa AS, Ghafoor KZ. (2023) Enhancing Intrusion detection: Leveraging Federated Learning and Hybrid Machine Learning Algorithms On ToN_IoT Dataset. Proc. 2023 International Conference on Frontiers of Information Technology (FIT) 1\u0026ndash;6.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eSchulman J, Wolski F, Dhariwal P, Radford A, Klimov O. (2017) The optimization of proximal policy. arXiv preprint arXiv:1707.06347.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eSharma KP, Nagpal T, Vora T, Yadav A, Abdullah MI, Jayaprakash B, Bukate BB. Interpretable intrusion detection for IoT environments using a self-attention-based explainable AI framework. Sci Rep. 2025;15(1):39937.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eSmith JQ, Johnson RA. IoT Intrusion Detection Using Transformer-Based Anomaly Learning. J Comput Sci Mob Comput. 2024;14(4):24\u0026ndash;35.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eVaswani A, Shazeer N, Parmar N, Uszkoreit J, Jones L, Gomez AN, Kaiser Ł, Polosukhin I. (2017) Attention is all you need. Adv Neural Inform Process Syst (NeurIPS) 5998\u0026ndash;6008.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eZhang H, Chen L, Wu J. (2023) Deep Reinforcement Learning for Client Selection in Federated Learning: Optimizing for Convergence and Bandwidth. Proc. 2023 International Conference on Information Processing and Network Provisioning (ICIPNP) 1\u0026ndash;5.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eZhang X, Wang Y, Liu Z. (2024) A Federated Learning Client Selection Method via Multi-Task Deep Reinforcement Learning. Proc. 2024 IEEE International Conference on Unmanned Systems (ICUS) 1\u0026ndash;6.\u003c/span\u003e\u003c/li\u003e\u003c/ol\u003e"}],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":true,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":false,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":false,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"Internet of Things (IoT), Intrusion Detection Systems (IDS), Federated Learning, Deep Reinforcement Learning (DRL), Transformer Models, Privacy-Preserving AI, Network Security","lastPublishedDoi":"10.21203/rs.3.rs-8406384/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-8406384/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eThe rapid proliferation of Internet of Things (IoT) devices has exponentially expanded the cyber-attack surface, rendering traditional centralized Intrusion Detection Systems (IDS) inefficient due to critical data privacy concerns and bandwidth constraints. While recent advancements like Self-Attention Deep Neural Networks (SA-DNN) have achieved high detection accuracy, their reliance on centralized data aggregation exposes sensitive user information and lacks the adaptability required for dynamic threat landscapes. To address these gaps, this paper proposes Fed-Trans-RL, a novel privacy-preserving framework that integrates Federated Learning (FL), Transformer Encoders, and Deep Reinforcement Learning (DRL). Crucially, to ensure robustness against both known and zero-day threats, we design a Universal IDS Pipeline featuring two distinct modes: a Supervised mode utilizing lightweight Transformer Encoders to classify known attack patterns, and an Unsupervised mode employing Deep Autoencoders and Isolation Forests to identify anomalies in wild, unlabeled traffic. We decentralize the detection process using Learnable Feature Gating (LFG) directly on IoT edge devices and utilize a DRL agent with Proximal Policy Optimization (PPO) at the aggregation server to dynamically optimize client selection based on real-time network states. Experimental validation on four heterogeneous datasets BOT-IoT, N-BAIOT, IoT-23, and TAN-IOT demonstrates that Fed-Trans-RL achieves detection accuracy comparable to centralized baselines (up to 99.5% on N-BAIOT) while reducing communication rounds by approximately 31%. These results confirm that the proposed framework successfully bridges the gap between high-precision security, operational efficiency, and strict privacy preservation for next-generation IoT networks.\u003c/p\u003e","manuscriptTitle":"A Privacy Preserving Federated Transformer Framework with Reinforcement Learning for Adaptive IoT Intrusion Detection","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-01-19 13:56:47","doi":"10.21203/rs.3.rs-8406384/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"482c7f93-d892-48bc-9f77-1ed14533f2a0","owner":[],"postedDate":"January 19th, 2026","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[],"tags":[],"updatedAt":"2026-02-18T09:27:57+00:00","versionOfRecord":[],"versionCreatedAt":"2026-01-19 13:56:47","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-8406384","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-8406384","identity":"rs-8406384","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}