Abstract

With the rapid expansion of Internet of Things (IoT) networks, ensuring secure and privacy-preserving communication has become increasingly important. Anomaly-based Network Intrusion Detection Systems (NIDS), which rely on transmitting large volumes of network data to central servers to train NIDS, are becoming less ideal in IoT contexts due to growing concerns about data privacy and the limitations of centralized processing. Federated Learning (FL) offers a promising alternative by enabling decentralized model training across distributed devices without the need to share data. However, FL alone often struggles due to the limited availability of labeled intrusion data in real-world settings. To address these limitations, this thesis proposes a Federated Few-Shot Learning (FFSL) framework that integrates FL with Few-Shot Learning (FSL) to enhance generalization from a small number of labeled examples while preserving user privacy. The approach leverages a metric-based prototypical network integrated with a Long Short-Term Memory (LSTM)
architecture to model temporal patterns in network traffic. Evaluations on the ToN IoT dataset show that the FFSL framework achieves strong performance in terms of precision, recall, and F1-score.
Despite demonstrating effectiveness in overcoming issues of data privacy and limited labeled data, deploying such models on real-world IoT devices presents several challenges. Most IoT devices operate under strict resource constraints, including limited processing power, memory, and battery capacity, making it difficult to run large deep learning models efficiently. Furthermore, selecting IoT devices for FL training without considering their available resources can lead to suboptimal performance and premature device failure. To address this, the thesis introduces resource-aware lightweight extension of the FFSL framework designed specifically for resource-constrained IoT devices. Light-FFSL incorporates dynamic scheduling to adaptively select participating devices based on their available resources, and uses convergence-based updates to reduce communication overhead. Moreover, a prune-and-quantize strategy is applied to the LSTM-based prototypical model, significantly reducing model size and inference latency for resource-constrained IoT devices. Experiments conducted on the ToN IoT and Bot IoT datasets and the results demonstrate that the proposed model maintains competitive detection performance while improving inference time and
reducing model size.