Key Takeaways & Executive Findings
- •• Proposes FedSTGCN, a novel framework integrating spatiotemporal graph neural networks (STGNNs) with federated learning for IoT intrusion detection. • Enables collaborative model training across distributed IoT devices without sharing raw data, effectively addressing data privacy concerns. • Achieves over 97% accuracy in binary classification and over 92% weighted F1-score in multiclass classification, outperforming existing methods. • Validates the approach on two widely used IoT intrusion detection datasets, demonstrating robust performance and practical applicability.
Abstract
The rapid growth and increasing complexity of Internet of Things (IoT) devices have made network intrusion detection a critical challenge, especially in edge computing environments where data privacy is a primary concern. Machine learning-based intrusion detection techniques enhance IoT network security but often require centralized network data, posing significant risks to data privacy and security. Although federated learning (FL)-based network intrusion detection methods have emerged in recent years to address privacy concerns, they have not fully leveraged the advantages of graph neural networks (GNNs) for intrusion detection. To address this issue, we propose a federated spatiotemporal graph convolutional network (FedSTGCN) model, which integrates the capabilities of spatiotemporal GNNs (STGNNs) and federated learning. This framework enables collaborative model training across distributed IoT devices without requiring the sharing of raw data, thereby improving network intrusion detection accuracy while preserving data privacy. Extensive experiments are conducted on two widely used IoT intrusion detection datasets to evaluate the effectiveness of the proposed approach. The results demonstrate that FedSTGCN outperforms other methods in both binary and multiclass classification tasks, achieving over 97% accuracy in binary classification tasks and over 92% weighted F1-score in multiclass classification tasks.
1. Introduction
With the rapid growth of the number and complexity of Internet of Things (IoT) devices, network intrusion detection has become increasingly important, particularly for edge computing devices. Devices in edge networks such as smart televisions, network cameras, smart curtains, and wireless sensors, which are highly convenient for both life and work, have become potential targets for cyberattacks (Ghasempour, 2019). With the exponential increase in the number and frequency of attacks, ensuring the security of these smart devices has become a key issue driving the continuous development of the IoT.
To ensure smart device security, researchers have proposed various network intrusion detection methods. Among them, machine learning-based intrusion detection algorithms are particularly popular because they can automatically learn and identify potential threat patterns by analyzing data flows. In recent years, a subfield of deep learning—graph neural network (GNN)—has been applied to network intrusion detection due to its advantages in learning from graph-structured data (Caville et al., 2022; Lo et al., 2022; Zhou et al., 2022; Hu et al., 2023). Although GNN-based intrusion detection methods address some challenges in network intrusion detection, they rely on centralized deep learning approaches. To train a generalized network intrusion detection model, raw data must be transmitted from edge devices to a central server for training, which exposes the data to potential attacks and raises privacy concerns. Therefore, this paper integrates spatiotemporal GNNs (STGNNs) with federated learning (FL) and proposes a federated STGNN (FSTGNN) model. When applied to network intrusion detection, this approach not only improves detection accuracy but also preserves data privacy.
Two key challenges must be overcome to apply the FSTGNN to network intrusion detection systems. The first challenge is how to construct local subgraphs from the network intrusion detection datasets on each client and then build a global graph across all clients. The second challenge is guaranteeing that the aggregation process maintains data privacy, since GNNs are used as the training model for each client in the FSTGNN architecture, which necessitates collecting information from surrounding nodes for training GNNs. To tackle the first challenge, this paper uses the graph construction method in N-STGAT proposed by Wang et al. (20
Loading authentic research manuscript (Pages 1–5)...
Yalu WANG, Jie LI, Zhijie HAN, Pu CHENG, Roshan KUMAR (2025). FedSTGCN: a novel federated spatiotemporal graph learning-based network intrusion detection method for the Internet of Things. Frontiers of Information Technology & Electronic Engineering. https://doi.org/10.1631/FITEE_2400932
Research & Educational Purpose Only:The translations, structured abstracts, analytical annotations, and data reports provided by SinoTechIntel are intended exclusively for academic research, internal corporate R&D, and educational benchmarking. They do not constitute formal engineering, chemical safety, legal, or professional advice.
Copyright & Intellectual Property Notice: Original copyright of the underlying source articles and experimental data remains with the respective authors, institutions, and original publishing journals. SinoTechIntel claims intellectual property only over its proprietary translations, analytical syntheses, and AEO structured enhancements in accordance with international fair use and academic citation principles.
Frequently Asked Questions
What is FedSTGCN?
FedSTGCN is a federated spatiotemporal graph convolutional network that integrates spatiotemporal graph neural networks (STGNNs) with federated learning for network intrusion detection in the Internet of Things (IoT). It enables collaborative model training across distributed devices while preserving data privacy.
How does FedSTGCN preserve data privacy?
FedSTGCN uses federated learning to train models locally on each IoT device or client, sharing only model updates (e.g., weights) with a central server rather than raw data. This ensures that sensitive network data never leaves the local devices, mitigating privacy risks.
What are the key performance results of FedSTGCN?
In extensive experiments on two widely used IoT intrusion detection datasets, FedSTGCN achieved over 97% accuracy in binary classification tasks and over 92% weighted F1-score in multiclass classification tasks, outperforming other compared methods.
Why are graph neural networks used in FedSTGCN?
Graph neural networks are effective at learning from graph-structured data, which suits the relational and spatiotemporal nature of IoT network traffic. By modeling devices and their interactions as graphs, GNNs capture complex patterns that improve intrusion detection accuracy.
What datasets were used to evaluate FedSTGCN?
The paper evaluates FedSTGCN on two widely used IoT intrusion detection datasets, specifically chosen to assess its effectiveness in both binary and multiclass classification tasks, though the exact dataset names are not mentioned in the provided abstract.
Related Technical Papers & Translations
Design and optimization of a high-efficiency distillation process for cellulosic fuel ethanol integrated with thermal coupling and molecular sieve adsorption
To address the challenges of high energy consumption and prominent costs in the traditional three-columns distillation process for cellulosic fuel ethanol, a distillation—molecular sieve coupling separation process is proposed. This process integrates a three-column (crude distillation column, first distillation column, second distillation column) system with a 3A molecular sieve adsorption deep dehydration unit. A thermal coupling network is constructed via differential pressure design (steam from medium/high-pressure columns as mutual heat sources, reboiler liquid waste heat for feed preheating), and molecular sieve adsorption conditions are optimized. The study first performs a thermodynamic consistency test on the ethanol—water system, determines optimal non-random two-liquid (NRTL) model binary interaction parameters via experimental data regression for Aspen Plus simulation. Aiming at minimum total annual cost (TAC), Aspen Plus is used to optimize process parameters (theoretical tray number, feed location, reflux ratio, side-draw position, etc.). Economic analysis shows this process reduces CO2 emission costs by 27.56%, TAC by 15.58% (to 5.123 × 106 USD·a-1), and increases ethanol purity to ＞99.6%, providing an effective solution for green, efficient separation.
A cohesion loss model for determining residual strength of deep bedded sandstone
Rock residual strength, as an important input parameter, plays an indispensable role in proposing the reasonable and scientific scheme about stope design, underground tunnel excavation and stability evaluation of deep chambers. Therefore, previous residual strength models of rocks established were reviewed. And corresponding related problems were stated. Subsequently, starting from the effects of bedding and whole life-cycle evolution process, series of triaxial mechanical tests of deep bedded s
Federated model with contrastive learning and adaptive control variates for human activity recognition
Recent attention to privacy issues demands a communication-safe method for training human activity recognition (HAR) models on client activity data. Federated learning (FL) has become a compelling technique to facilitate model training between the server and clients while preserving data privacy. However, classical FL methods often assume independent and identically distributed (IID) data among clients. This assumption does not hold true in practical scenarios. Human activity in real-world scena