Federated Web Attack Detection on Edge-IIoTset using 1D-CNN and Flower 🌐🧠

This repository presents the federated learning extension of our web attack detection framework. It builds upon the centralized models developed in the companion repository:

👉 Centralized Version: edge-web-attack-detection-centralized

The goal of this repository is to evaluate how Federated Learning (FL) performs under IID and Non-IID client data distributions using a lightweight 1D-CNN model and the Flower framework, enabling decentralized cyberattack detection in IIoT environments.

---

📌 Project Overview

• ⚙️ Federated Learning Framework: Flower
• 🧠 Model Architecture: 1D-CNN for time-series network traffic data
• 🧪 Classification Tasks:
  • Binary (Attack vs. Normal)
  • 6-Class (Main attack families)
  • 15-Class (Specific attack types)
• 🧩 Data Distributions:
  • IID: Uniform data distribution across clients
  • Non-IID: Realistic skewed client data (e.g., device- or location-specific attacks)

---

📝 Related Publication

This repository accompanies the following manuscript, which presents the full methodology and experimental evaluation:

“A Novel Intrusion Detection System for Dew Computing Environments Based on an Enhanced Federated Deep Learning Model” (Alireza Fadaei, Assoc. Prof. Dr. Behrang Barekatain, 2025)

📄 Download Manuscript (PDF)

Please cite this work if you use the code or results.

---

📂 Dataset

Edge-IIoTset is a comprehensive dataset for evaluating IIoT cyber-attack detection systems, particularly in edge and federated environments.

📎 Download on Kaggle

---

🧠 Model Architecture

The federated model is based on a 1D-CNN, chosen for its efficiency and suitability for edge deployment:

• 1D Convolution Layer
• ReLU Activation
• Global Max Pooling
• Fully Connected (Dense) Layer
• Softmax Output

The model is kept compact to ensure compatibility with edge devices.

---

⚙️ Federated Learning Setup

Component	Framework	Notes
Server	Flower	Coordinates aggregation and training rounds
Clients	Flower	Each client trains on local Edge-IIoT data
Strategy	FedAvg	Other strategies (FedAdam, FedProx) optional

🧪 Data Partitioning

• IID: Each client receives a random, balanced subset.
• Non-IID: Clients receive data biased by attack type, label frequency, or device-specific patterns.

---

📊 Evaluation Metrics

• Accuracy
• Precision, Recall
• Macro and Weighted F1-Score
• Confusion Matrix
• Inference Time
• Model Size (MB)

All metrics are reported per classification task and data distribution.