Privacy-First AI Learns to Spot DDoS Attacks Across IoT Networks Without Sharing Raw Data

Billions of connected devices, from smart thermostats to industrial sensors, now form a vast attack surface that cybercriminals exploit with distributed denial of service (DDoS) attacks, in which thousands of compromised gadgets flood a target server with traffic until legitimate users are locked out. A new study published in Discover Artificial Intelligence proposes a way to train attack-detection models across such networks without ever moving the sensitive traffic data off the devices, and without sacrificing the accuracy that security operators depend on. The framework, called CLDP-DWFL, combines client-level differential privacy with dynamic weighted federated learning, and its authors report detection accuracies of up to 96.95 percent on two widely used IoT traffic benchmarks.

The core problem the researchers set out to solve is a three-way tension. Centralized intrusion detection systems require raw network data to be collected in one place, which is impractical and risky in IoT environments where devices have limited computing power and data crosses organizational boundaries. Federated learning solves the data-sharing problem by letting each device train a model locally and send only model updates to a central aggregator, but it has historically treated every client equally, an assumption that collapses when some devices hold rich, high-quality traffic records and others hold sparse or skewed data. Moreover, even sharing model updates can leak information about the underlying data, a risk many prior systems simply ignored or addressed with informal noise that was never formally accounted for.

The new framework attacks all three weaknesses simultaneously. On the privacy side, each client clips its model update so that its L2 norm cannot exceed a fixed threshold, bounding how much any single device’s data can influence the transmitted vector. Gaussian noise is then added to the clipped update, with a standard deviation proportional to the clipping norm through a noise multiplier. This is the classic Gaussian mechanism of differential privacy, but the authors go further by tracking the cumulative privacy cost rigorously using Renyi differential privacy composition, amplified by the fact that only a random subset of clients participates in each communication round. The result is a formally quantified privacy budget, expressed as epsilon values between 4.06 and 9.07 depending on the number of training rounds, computed with the autodp library rather than asserted informally.

On the aggregation side, the framework introduces a lightweight weighting scheme that scores each client by combining two factors: the size of its local dataset and a quality score derived from the inverse of its local validation loss. A balance parameter set to 0.5 gives equal influence to both factors. Clients whose updates prove more informative therefore exert proportionally greater influence on the global model, which the authors argue is essential in heterogeneous IoT environments where traffic patterns differ wildly between, say, a home router and a factory sensor. Crucially, the weighting mechanism is deliberately simple. More elaborate trust-aware or attention-based aggregation schemes exist, but they require the server to inspect gradient-level statistics or accumulate state across rounds, which would complicate the per-round privacy accounting and add overhead unsuitable for constrained devices.

To simulate realistic non-uniform data distributions, the researchers partitioned the training data using a Dirichlet distribution with a concentration parameter of 0.5, producing skewed class distributions across clients that mirror real IoT deployments. The underlying detection model is a compact deep neural network with three fully connected hidden layers of 256, 128, and 64 neurons, roughly 46,000 trainable parameters, and a sigmoid output for binary classification of benign versus DDoS traffic. The authors report that the forward pass costs approximately 93,000 floating-point operations per sample, and the total communication volume per client across a full ten-round training run is about 3.6 megabytes, figures they argue sit comfortably within the budgets of low-power IoT hardware.

Evaluation was carried out on two benchmark datasets: CICIoT2023, containing more than 1.2 million traffic records with 40 features, and IoT23, with roughly 1.3 million records and 23 features. After preprocessing, which included removing duplicates and highly correlated features, normalizing values, and mapping labels to a benign-versus-DDoS binary scheme, the framework achieved detection accuracies ranging from 95.30 to 96.95 percent across configurations varying from 10 to 50 clients and 3 to 10 communication rounds. Against the standard FedAvg baseline, which averages client updates weighted only by dataset size, the proposed model improved accuracy by approximately 3.7 percent; against FedProx, which adds proximal regularization to handle non-IID data, the gain was approximately 4.5 percent.

One of the study’s most informative experiments is an ablation called CLDP-Uniform, which applies the identical clipping, noise injection, and subsampling pipeline but replaces the quality-aware weighting with equal weights. CLDP-Uniform achieved only 91.85 and 91.14 percent accuracy on the two datasets, slightly below even the non-private baselines, confirming the expected utility cost of differential privacy. The dynamic weighting mechanism then recovered that cost and exceeded it, lifting accuracy to 96.95 and 96.92 percent, a gain of roughly five to six percentage points attributable specifically to quality-aware aggregation under an identical privacy mechanism. A Wilcoxon signed-rank test across five random seeds showed the proposed model winning in every seed against every baseline, with the authors candidly noting that the minimum attainable p-value of 0.0625 falls just short of the conventional 0.05 threshold, though the 100 percent win rate suggests a systematic effect.

The authors are equally transparent about the limits of their privacy guarantee. The framework assumes an honest-but-curious aggregation server that follows the protocol but may try to infer information from updates, and it assumes clients are non-adversarial. It does not defend against model poisoning, Byzantine behavior, or backdoor attacks, in which compromised clients submit maliciously crafted updates; Byzantine-robust aggregation typically requires inspecting individual updates in ways that can conflict with formal privacy accounting, and reconciling the two remains an open problem. The reported epsilon values are also loose relative to conventional strong-privacy thresholds around 1, which the authors frame as the cost of formally tracking privacy leakage rather than minimizing it. They further acknowledge that a strategically dishonest client could report artificially low validation loss to gain disproportionate aggregation weight, a vulnerability the lightweight per-round score does not guard against.

Scalability findings are encouraging for real deployments: because the framework samples a fixed-size cohort of clients per round, the privacy budget does not grow with the number of participating devices, a property the authors highlight as desirable for large IoT fleets. The model also converged rapidly, with only marginal gains beyond ten communication rounds, and global loss on CICIoT2023 fell from 0.1480 at three rounds to 0.0305 at ten rounds with ten clients. False positives in the best configurations numbered 4,585 out of 183,585 benign test samples on CICIoT2023 and 5,131 out of 197,754 on IoT23, modest fractions that the authors caution could still translate into substantial absolute alert volumes at deployment scale, potentially requiring complementary false-positive suppression techniques.

All experiments were conducted in simulation on benchmark datasets rather than on physical constrained hardware, and the authors state that empirical benchmarking on devices such as Raspberry Pi-class hardware, along with comparisons against DP-aware baselines like DP-FedAvg and DP-SGD under equivalent privacy budgets, remain future work. Even so, the study marks a meaningful step in a field where privacy and accuracy are usually traded off against each other. By demonstrating that a formally accounted privacy mechanism and a lightweight quality-aware aggregation scheme can coexist in a single framework, and even reinforce each other, the researchers offer a template for protecting both the availability of IoT networks and the confidentiality of the data flowing through them, at a moment when the scale of connected devices, and the botnets that hijack them, continues to grow.

Subject of Research: Privacy-preserving federated learning for DDoS attack detection in IoT networks

Article Title: Dynamic weighted federated learning with client level differential privacy for DDoS detection in IoT networks

Article References: Maryam, L., Qaisar, B. S., Raza, M., & Sattar, M. A. (2026). Dynamic weighted federated learning with client level differential privacy for DDoS detection in IoT networks. Discover Artificial Intelligence, 6(1), Article 1388. https://doi.org/10.1007/s44163-026-02452-0

Image Credits: AI Generated

DOI: 10.1007/s44163-026-02452-0

Keywords: federated learning, differential privacy, DDoS detection, Internet of Things, network security, Renyi differential privacy, non-IID data, intrusion detection, Gaussian mechanism, weighted aggregation, CICIoT2023, IoT23