FNEM: A Federated-Neuro-Symbolic Edge Approach for Explainable Anomaly Detection in IoT Networks

FNEM: A Federated-Neuro-Symbolic Edge Approach for Explainable Anomaly Detection in IoT Networks | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article FNEM: A Federated-Neuro-Symbolic Edge Approach for Explainable Anomaly Detection in IoT Networks Isaac Kofi Nti, Murat Ozer This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-8181303/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract The fast growth of Internet of Things (IoT) devices requires intrusion detection systems which must deliver precise results and fast response times and understandable decision processes from network edge locations. The three main obstacles for deep learning methods in these environments result from limited processing capacity and privacy protection standards and the requirement for explainable output. FL provides privacy protection through its method but it achieves inferior results when dealing with non-IID data and lacks clear explanations. The research introduces FNEM as a Federated-Neuro-Edge Model which combines neural prediction with symbolic rule-based correction to achieve both precise and interpretable IoT anomaly detection. The system enables edge device rule synchronization through SHAP-based rule extraction after FL collaborative training is finished. The system identified seven basic symbolic rules and 22 corrective overrides (0.0176%) which successfully fixed five neural false negatives within the uncertainty range. The system achieved 99.87% attack detection F1 when using a recall-oriented configuration with τ = 0.10. The model achieved a Macro-F1 score of 98.37% and AUC of 99.87% and average precision of 99.99% when using the validation-optimized threshold (τ = 0.22). The system provides an efficient solution for real-time anomaly detection in IoT networks through its combination of distributed learning with symbolic reasoning and privacy protection. Artificial Intelligence and Machine Learning Federated learning explainable artificial intelligence network intrusion detection neuro-symbolic federated model interpretable edge-based anomaly detection SHAP-driven rule extraction lightweight machine learning IoT networks security Full Text Additional Declarations The authors declare no competing interests. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-8181303","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":549184857,"identity":"3c7e67a8-3af5-4e54-8375-d6873f7daeaa","order_by":0,"name":"Isaac Kofi Nti","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAAuklEQVRIiWNgGAWjYFACxgYgISEHYh54QJQONrAWC2OwlgTitIDJikSQRgaitJjLNzc+5vkjkT4/7PBDoC12croNBLRYtjE2G/O2SeRuvJ1mANSSbGx2gIAWg2OMbdK8DUAtsxNAWg4kbiNKC8hhhrPTP5CihU0iQV46h2hbEpsN57ZJGG6Qzik4kGBAjF8OH3/44M2fOnn52embP3yosJMjqAWhF6zSgFjlICDfQIrqUTAKRsEoGFEAALhfQyfNdO0xAAAAAElFTkSuQmCC","orcid":"https://orcid.org/0000-0001-9257-4295","institution":"School of Information Technology, University of Cincinnati","correspondingAuthor":true,"prefix":"","firstName":"Isaac","middleName":"Kofi","lastName":"Nti","suffix":""},{"id":549184858,"identity":"b8e76fe0-e1a5-4cbd-a671-af4dedbb5f1e","order_by":1,"name":"Murat Ozer","email":"","orcid":"","institution":"School of Information Technology, University of Cincinnati","correspondingAuthor":false,"prefix":"","firstName":"Murat","middleName":"","lastName":"Ozer","suffix":""}],"badges":[],"createdAt":"2025-11-22 15:20:49","currentVersionCode":1,"declarations":{"humanSubjects":false,"vertebrateSubjects":false,"conflictsOfInterestStatement":false,"humanSubjectEthicalGuidelines":false,"humanSubjectConsent":false,"humanSubjectClinicalTrial":false,"humanSubjectCaseReport":false,"vertebrateSubjectEthicalGuidelines":false},"doi":"10.21203/rs.3.rs-8181303/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-8181303/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":96913783,"identity":"e96807aa-2895-4987-8e9a-9358eabb9a52","added_by":"auto","created_at":"2025-11-27 14:04:21","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":1117294,"visible":true,"origin":"","legend":"","description":"","filename":"ManuscriptV1.5.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8181303/v1_covered_696dca8a-4abe-4cc2-a2e1-2b38737a42f6.pdf"}],"financialInterests":"The authors declare no competing interests.","formattedTitle":"\u003cp\u003eFNEM: A Federated-Neuro-Symbolic Edge Approach for Explainable Anomaly Detection in IoT Networks\u003c/p\u003e","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":true,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"Federated learning, explainable artificial intelligence, network intrusion detection, neuro-symbolic federated model, interpretable edge-based anomaly detection, SHAP-driven rule extraction, lightweight machine learning, IoT networks security","lastPublishedDoi":"10.21203/rs.3.rs-8181303/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-8181303/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eThe fast growth of Internet of Things (IoT) devices requires intrusion detection systems which must deliver precise results and fast response times and understandable decision processes from network edge locations. The three main obstacles for deep learning methods in these environments result from limited processing capacity and privacy protection standards and the requirement for explainable output. FL provides privacy protection through its method but it achieves inferior results when dealing with non-IID data and lacks clear explanations. The research introduces FNEM as a Federated-Neuro-Edge Model which combines neural prediction with symbolic rule-based correction to achieve both precise and interpretable IoT anomaly detection. The system enables edge device rule synchronization through SHAP-based rule extraction after FL collaborative training is finished. The system identified seven basic symbolic rules and 22 corrective overrides (0.0176%) which successfully fixed five neural false negatives within the uncertainty range. The system achieved 99.87% attack detection F1 when using a recall-oriented configuration with τ = 0.10. The model achieved a Macro-F1 score of 98.37% and AUC of 99.87% and average precision of 99.99% when using the validation-optimized threshold (τ = 0.22). The system provides an efficient solution for real-time anomaly detection in IoT networks through its combination of distributed learning with symbolic reasoning and privacy protection.\u003c/p\u003e","manuscriptTitle":"FNEM: A Federated-Neuro-Symbolic Edge Approach for Explainable Anomaly Detection in IoT Networks","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-11-25 10:58:42","doi":"10.21203/rs.3.rs-8181303/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"e0bb9d2a-03ad-452e-bf65-de416489e521","owner":[],"postedDate":"November 25th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[{"id":58438965,"name":"Artificial Intelligence and Machine Learning"}],"tags":[],"updatedAt":"2025-11-25T10:58:42+00:00","versionOfRecord":[],"versionCreatedAt":"2025-11-25 10:58:42","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-8181303","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-8181303","identity":"rs-8181303","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}