FELACS: Federated learning with adaptive client selection for IoT DDoS attack detection

FELACS: Federated Learning with Adaptive Client Selection for IoT DDoS Attack Detection Mulualem Bitew Anley , Pasquale Coscia , Angelo Genovese ∗, Vincenzo Piuri Department of Computer Science, Universit` a degli Studi di Milano, Italy Abstract Distributed denial-of-service (DDoS) attacks pose a significant threat to network security by overwhelming systems with malicious traffic, leading to service disruptions and potential data breaches. The traditional centralized machine learning (ML) methods for detecting DDoS attacks in Internet of Things (IoT) environments raise privacy and security concerns due to their collection and distribution of data to a central entity that may not be trusted to perform model training. Federated learning (FL) offers a privacy-preserving solution that enables distributed collaboration by training a model only on local clients, without data exchanges, where the central entity only performs global model aggregation. However, the current practice of random client selection, combined with the statistical heterogeneity of client data and the device heterogeneity encountered in IoT environments, requires many training rounds to reach optimal accuracy, increasing the imposed computational overhead. To address these challenges, we propose a multiobjective optimization-based FL with adaptive client selection (FELACS) approach that maximizes client importance scores while satisfying resource, performance, and data diversity constraints. Experiments are carried out on the CIC-IDS2018, CIC-DDoS2019, BoT-IoT, and CIC-IoT2023 datasets, demonstrating that FELACS improves upon the accuracy of the existing approaches while exhibiting increased convergence speed when training a model in an FL scenario, hence reducing the number of communication rounds required to achieve the target accuracy, making it highly effective for performing IoT-based DDoS attack detection in FL scenarios. ∗Corresponding author Email addresses: [email protected] (Mulualem Bitew Anley ), [email protected] (Pasquale Coscia ), [email protected] (Angelo Genovese ), [email protected] (Vincenzo Piuri ) Preprint submitted to Computer & Security July 12, 2025 © 2025 Elsevier. Personal use of this material is permitted. Permission from Elsevier must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. Keywords: Adaptive client selection, Federated learning, DDoS attack detection, Cybersecurity, IoT security, Privacy-preserving model. 1. Introduction1 Internet of Things (IoT) devices range from personalized health systems and2 home appliances to smart cities, playing a crucial role in everyday activities3 while frequently managing sensitive personal data. Safeguarding the privacy and4 security of these devices thus remains a critical challenge, with distributed denial-5 of-service (DDoS) attacks currently being among the major threats encountered6 in IoT environments (Pakmehr et al.,2024). Centralized intrusion detection sys-7 tems (IDSs) based on machine learning (ML) and deep learning (DL) have been8 extensively researched for detecting these attacks (G¨um¨us¸bas¸ et al.,2021;Aktar9 and Nur,2023). However, centralized DL-based IDSs are often inadequate for10 scaling and adapting to the distributed nature and privacy requirements of IoT en-11 vironments (Fotse et al.,2024). Federated learning (FL) has since been considered12 for detecting cybersecurity threats, enabling collaborative data analyses without13 requiring the transfer of private data between organizations (McMahan et al.,2017;14 Nguyen et al.,2025;Mazid et al.,2025;Rahmati,2025;Olanrewaju-George and15 Pranggono,2025).16 FL begins with the central server distributing an initial model to a subset of17 the selected clients. The client selection process plays a crucial role, as it directly18 influences both the performance and convergence rate of the global model. In19 IoT-based environments, additional client selection challenges are posed by the20 high degree of device heterogeneity. In fact, IoT devices produce datasets that21 can vary significantly in their sizes and feature spaces, resulting in devices that22 possess many samples for certain types of DDoS attacks while having minimal data23 for others. Such heterogeneity necessitates distinct representations of data across24 different organizations, which is a requirement that existing FL frameworks might25 not fulfill without adaptations for addressing diverse feature spaces and device26 capabilities. Furthermore, DDoS attacks executed in IoT environments exhibit27 different characteristics across various devices, further complicating the analysis28 due to their statistical heterogeneity (Li et al.,2024;Anley et al.,2025).29 The client selection approaches described in the literature often do not explicitly30 account for the relevance and importance of the data held by each client since31 the selection of clients traditionally occurs via either a random or semirandom32 approach (McMahan et al.,2017;Nishio and Yonetani,2019;Wu et al.,2023).33 2 In fact, such approaches can lead to the selection of less valuable data, resulting34 in suboptimal model performance in the presence of heterogeneous clients (Fu35 et al.,2023). While more recent works have proposed algorithms that consider36 criteria such as accuracy, CPU capacity, memory, energy levels, and response37 times (Zhao et al.,2018;Li et al.,2021;Wang et al.,2020;AbdulRahman et al.,38 2020;Seo et al.,2022;Maciel et al.,2023;Sun et al.,2024;Nguyen et al.,2025;39 Mazid et al.,2025), they do not dynamically adapt to changing data quality and40 device performance conditions throughout the training rounds of FL, resulting in41 possible model training inefficiencies and slower convergence speeds. In fact,42 most of the existing methods focus on either data importance or computational43 efficiency but rarely combine these factors into a unified approach. Furthermore,44 most current client selection strategies assume static client participation, whereas45 real-world IoT environments are characterized by high client mobility rates and46 frequent connectivity disruptions (Zhang et al.,2024).47 In this paper, we propose federated learning with adaptive client selection48 (FELACS): a novel and adaptive framework that is designed to optimize the client49 participation level for performing DDoS detection in IoT environments.1FELACS50 introduces a multicriteria, multiobjective optimization-based selection strategy51 that integrates client resource constraints, data diversity, relevance, and system52 efficiency for each training round. This comprehensive framework evaluates key53 factors such as data entropy, statistical variance, computational efficiency, energy54 consumption, and communication latency. By leveraging these diverse criteria,55 FELACS ensures the adaptive selection of high-impact clients in each round, facil-56 itating robust model updates, a faster convergence speed, and improved detection57 accuracy. Moreover, our proposed approach addresses the unique challenges posed58 by DDoS attack detection in IoT-based FL scenarios, where timely and accurate59 client selection is critical for achieving effective real-time threat detection. In this60 context, FELACS prioritizes clients with higher-level representations of attack-61 related data, thus improving the relevance and quality of the updates derived from62 participating clients. This strategy accelerates the attack detection procedure,63 reduces the required convergence time, and enhances the responsiveness of the64 system. By shifting from resource-centric selection to a data-driven and adaptive65 approach, FELACS establishes a new paradigm for selecting clients in FL settings.66 The remainder of the paper is organized as follows. Section 2provides an67 1The source code will be made available upon the acceptance of this work at https://github. com/mulerkal/FELACS. 3 overview of the related works in the field of FL for IoT security, IoT IDSs, and68 DDoS attack detection, with a focus on client selection strategies. Section 369 describes the system model, problem formulation, and FL learning process of70 the developed method. Section 4outlines the methodology and algorithm of our71 proposed approach, including the experimental design, dataset details, and model72 architecture. Section 5presents the results of our proposed methodology and a73 corresponding performance analysis. Finally, Section 6summarizes this work and74 concludes the paper.75 2. Related Works76 FL in IoT Security and Intrusion Detection Scenarios. Unlike centralized ML-77 based DDoS attack detection (Agostinello et al.,2023;Anley et al.,2024), which78 poses challenges such as privacy risks, high latency, and potential network con-79 gestion (Feng et al.,2021), an FL-based IDS provides a decentralized alternative80 in which the model training process is distributed across different IoT devices,81 thereby minimizing the data transfer requirements and reducing privacy concerns82 (Li et al.,2020a;Kairouz et al.,2021;Lim et al.,2020). FL-based IDSs can83 achieve comparable accuracy to that of centralized methods while preserving data84 privacy (Roy et al.,2023) and simultaneously addressing the distributed nature of85 IoT networks, where devices may have varying computational capabilities and data86 characteristics (Ruzafa-Alc´ azar et al.,2021). In fact, several works have explicitly87 considered FL tasks with nonindependent and identically distributed (non-IID)88 data, which are caused by IoT devices often having skewed data distributions, with89 certain devices collecting extensive data on specific attack types while possess-90 ing limited data on other types (Ma et al.,2022;Zhao et al.,2018). Because of91 the presence of non-IID data, traditional aggregation techniques such as feder-92 ated averaging (FedAvg), which consider the contributions of each client equally93 (McMahan et al.,2017), struggle to manage the high degree of data heterogeneity94 encountered in real-world scenarios. This heterogeneity can hinder the overall95 performance and convergence speed of the global model.96 Client Selection in FL. In FL, the learning process is distributed across multiple97 clients, which collaboratively train a global model by sharing their locally com-98 puted updates instead of raw data. Efficient client selection mechanisms ensure99 an effective model training procedure while optimizing the incurred communica-100 tion costs and preserving the diversity of the given data (McMahan et al.,2017;101 Bonawitz et al.,2019). Studies on the selection of clients in FL tasks have102 4 explored various strategies that consider client availability, data quality, computa-103 tional capacity, and model performance contributions (Wang et al.,2020;Nishio104 and Yonetani,2019).105 The simplest way to perform client selection, other than a random-based ap-106 proach (McMahan et al.,2017;Nishio and Yonetani,2019;Wu et al.,2023;Ginan-107 jar et al.,2025), consists of considering only the contributions of clients to reducing108 the loss function of the global model. For example, the approaches described in109 (Wang et al.,2020;Seo et al.,2022) prioritize clients with higher expected model110 accuracy contributions, improving their convergence speeds relative to that of ran-111 dom client selection, particularly in heterogeneous data environments where some112 clients possess more informative or diverse data than others do. However, these113 approaches overlook the computational capacities of clients and the associated114 communication costs, potentially leading to increased latency and inefficiencies115 in resource-constrained IoT networks. To improve this model, more recently de-116 veloped approaches also consider resources and device capabilities (Maciel et al.,117 2023). For example, the federated proximal (FedProx) approach was designed to118 handle systems with varying computational resources by enabling partial client119 participation during training, thus reducing the update variability caused by het-120 erogeneous datasets (Li et al.,2020b). However, FedProx does not account for121 the diversity and significance of client data during the selection process. Exten-122 sions to resource-aware client selection are represented by the FedCS (Nishio and123 Yonetani,2019) and FedMCCS (AbdulRahman et al.,2020) methods, which se-124 lect clients on the basis of availability, computational power, and communication125 bandwidth; dynamically adjust the number of selected clients; and allocate more126 resources to those with higher capabilities. However, these approaches assume that127 clients are willing to fully disclose their resource states, which may not be feasible128 because of privacy concerns or the risk of unreliable self-reporting in real-world129 IoT environments.130 Recent advances have also explored client selection approaches based on data131 diversity to increase the generalizability of FL models. In the method described132 in (Zhao et al.,2018), the issue of data heterogeneity is addressed through a data-133 sharing mechanism, where a small amount of globally shared data is used to align134 the learning objectives of different clients. This method improves the convergence135 of the global model but undermines the fundamental privacy-preserving principle136 of FL, as even minimal data sharing could expose sensitive information. To137 counteract this issue, the method proposed in (Li et al.,2021) considers a diversity-138 aware client selection scheme that encourages participation from clients with139 diverse data distributions, thereby enhancing the robustness of the model without140 5 requiring data sharing. While promising, this approach relies heavily on the141 accurate estimation of data diversity, which may not always be feasible, especially142 in environments with highly dynamic IoT network data distributions.143 To account for both dataand resource-based device client characteristics,144 multicriteria client selection schemes have been proposed for ensuring reliable145 and secure participation in FL. As an example, (Tahir et al.,2025) proposed Se-146 cureFedPROM, a framework that integrates security, performance, and system147 efficiency metrics into a weighted multiarmed bandit (MAB) model for dynami-148 cally ranking clients. The method introduced in (Ami et al.,2025) further leverages149 an MAB-based scheduler to learn the computational and network profiles of clients150 over time, thereby minimizing the training latency induced per round.151 3. System Model and Problem Formulation152 In this section, we introduce FELACS, an adaptive client selection algorithm153 that is designed to enhance the FL-based DDoS detection process in IoT environ-154 ments. We begin by describing the system model and then formalize the FELACS155 problem. Table 1summarizes the notations and symbols used in the equations156 presented in this work.157 3.1. System Model158 The proposed FELACS framework operates within an FL environment to detect159 DDoS attacks in IoT networks. The system consists of a central server and a set of160 distributed clients N, where each client k∈ N owns a local dataset Dkconsisting161 of traffic from its private network. The central server maintains a global model162 wt, which is a classifier of the normal and DDoS traffic encountered in iteration t.163 In each iteration t, each client downloads the model, trains it on its local data, and164 transmits updates back to the server.165 After an initialization phase, the training process is divided into communication166 rounds, each of which consists of three phases: i) client selection, ii) client167 updating, and iii) model aggregation. The process then follows the subsequent168 steps until the maximum number of communication rounds is reached or until the169 convergence criteria are satisfied.170 Step 1: Client Selection. In each round t, the server assesses the capabilities171 of each device (i.e., its network latency, power consumption, and computational172 resources) and uses the proposed FELACS algorithm to select a subset of clients173 St⊆ N from the total pool of clients N, with |N| =Ktotal clients. This step is174 explained in detail in Section 3.2.175 6 Table 1: Notations and descriptions used throughout the paper. Symbol Description NSet of all clients participating in FL. kClient index, where k∈ N. DkLocal dataset held by client k. tCommunication round index. St⊆ N Subset of clients selected in round t. wtGlobal model in round t. wt kUpdated local model parameters after client ktrains on Dkin round t. ∇Fk(wt)Gradient of the loss function Fkof client kevaluated at wt. ηLearning rate for local stochastic gradient descent (SGD) updates. KUpper bound imposed on the number of clients selected per round. Rmax Total resource budget available for client selection. Lmax Maximum allowable communication latency per client. Hmin Minimum Shannon entropy required for the data of a client to qualify. α, β, γ, δ Hyperparameters for weighting the components of the importance score. IiImportance score of client i, defined as Ii=α H(Di) + β V (Di)−γ Pi−δ Li. ENumber of local training epochs executed on each selected client per round. yc iOne-hot encoded true label of sample ifor class c. f(xi;wt)cPredicted probability of class cfor input xiunder model wt. CTotal number of classes involved in the classification task. nkNumber of data points contained in Dk. nPk∈StnkTotal number of samples across all selected clients in round t. RiResource consumption (e.g., CPU cycles) of client i. PiPower consumption of client i. LiNetwork latency of client i. uiUtility score of client i. H(Di)Shannon entropy of the data distribution at client i. V(Di)Variance of the data distribution of client i. Tdl model size downlink bandwidth +latency. T(i) comp E·Ni batch size ·t(i) batch. T(i) ul update size uplink bandwidth +latency. Tagg Aggregation time per round. 7 Step 2: Client Updating. The selected clients download the current global model176 wt. Each client k∈Sttrains the model on its local dataset Dkfor Eepochs177 and computes the updated local model parameters wk t. The update process is as178 follows:179 wk t=wt−η∇Fk(wt),(1) where ηis the learning rate and ∇Fk(wt)represents the gradient of the local180 loss function Fk(wt), which quantifies the error induced by the model on the181 local dataset of the client Dk. We define the local loss function Fk(wt)as the182 cross-entropy loss:183 Fk(wt) = −1 |Dk|X i∈Dk C X c=1 yc ilog f(xi;wt)c,(2) where yc iis the one-hot encoded label produced for class c,f(xi;wt)cis the184 predicted probability for class c, and Cis the total number of classes.185 Step 3: Model Aggregation. The server aggregates the local updates obtained186 from the selected clients to update the global model. The server-side steps involve187 collecting updates wk tfrom each selected client k∈Stand aggregating the updates188 to form a new global model, thereby obtaining wt+1:189 wt+1 =X k∈St nk nwk t,(3) where nkis the number of data points for client kand n=Pk∈Stnk. By190 aggregating these updates from the selected clients, the global model optimizes191 the overall objective:192 F(wt) = 1 K K X k=1 Fk(wt),(4) where Kis the total number of clients. The system model is detailed in Algo-193 rithm 1.194 3.2. FELACS Problem Formulation195 The objective of FELACS is to increase the convergence rate and maximize the196 DDoS attack detection accuracy of the developed model by selecting an optimal197 subset Stof clients during each communication round t. The client selection198 process is framed as an optimization problem aimed at maximizing the achieved199 8 Algorithm 1: FELACS System Model Input: Client pool N, total number of rounds T, maximum number of clients per round K, number of local epochs E, learning rate η. Output: Global model wt. Initialization. w0←initial model parameters for t←0to T−1do Step 1: Client Selection. St←SelectClients(N, K)(see Algorithm 2) Step 2: Client Updating. foreach k∈Stin parallel do Client kdownloads wtand trains for Eepochs on Dk wk t←wt−η∇Fk(wt) Step 3: Model Aggregation. nk=number of data points for client k wt+1 =X k∈St nk Pj∈Stnj wk t detection accuracy while respecting the imposed computational and communica-200 tion constraints, and it is guided by the total importance score Iiof the selected201 clients. The importance score for client iis defined as follows:202 Ii=αH(Di) + βV (Di)−γPi−δLi,(5) where H(Di)is the Shannon entropy of the data of client i, representing the203 diversity of the data; V(Di)is the variance of the local data of client i, which reflects204 the statistical heterogeneity of the data distribution of this client; Pirepresents the205 power consumption of client i;Lirepresents the network latency of client i; and206 α, β, γ, δ are hyperparameters for controlling the relative influence of each factor207 (see also Table 1).208 We model the process of selecting an optimal subset of clients Stin each209 round tas a multiobjective optimization problem, specifically a multidimensional210 knapsack problem (MDKP). In this formulation, each candidate device iis char-211 acterized by a cost vector (resource, power, latency) and a utility that reflects its212 data relevance and expected contribution to the global model. The objective is to213 maximize the total utility under the constraint that the sum of the costs does not214 9 Table 5: Proposed 1D-CNN architecture of the model. Layer Filters/Units Output Shape Activation Parameters Input window – (|input|)–0 Conv1D 64 (254,64) Sigmoid 256 MaxPool1D – (127,64) – 0 Dropout – (127,64) – 0 Conv1D 128 (125,128) ReLU 24 704 MaxPool1D – (62,128) – 0 Dropout – (62,128) – 0 Conv1D 256 (60,256) ReLU 98 560 MaxPool1D – (30,256) – 0 Dropout – (30,256) – 0 Flatten – (7 680) – 0 Dense 256 (256) ReLU 983 168 Dropout – (256) – 0 Dense (output) (|output|)Softmax 256 For comparison purposes, we also consider Visual Geometry Group 16 (VGG16),345 which is a 16-layer convolutional network composed of five convolutional blocks,346 each comprising consecutive 3×3convolutions followed by maximum pooling,347 and three fully connected layers at the top. Its deeper architecture allows for a more348 hierarchical feature extraction process than that performed by our CNN, exhibiting349 high accuracy in DDoS attack detection scenarios (Anley et al.,2024;Agostinello350 et al.,2023). In our evaluations, we integrate FELACS with both the shallow351 CNN and VGG16, with the resulting models referred to as FELACS+CNN and352 FELACS+VGG16, respectively, to assess how increased depth can influence the353 convergence speed and classification accuracy of a model under heterogeneous354 IoT traffic distributions.355 During the model evaluation procedure, we apply an early stopping criterion356 at the local client level to halt the training process when the performance plateaus.357 In the FL framework, we vary the number of communication rounds to observe its358 update dynamics, and the pool of participating clients for each round is determined359 according to our FELACS-based selection strategy. The learning rate is carefully360 tuned to balance the convergence and stability of the model, and a dropout rate361 of 20% is enforced to enhance its robustness against noisy or incomplete IoT362 data. For the loss computation, we use the binary cross-entropy loss to distinguish363 between benign and DDoS traffic and employ the categorical cross-entropy loss364 when classifying specific DDoS attack types.365 16 4.5. Evaluation Metrics366 To assess the performance of our FL models, we consider the following metrics:367 i) accuracy, which is defined as the proportion of correctly classified instances out368 of the total number of instances; ii) precision, which is defined as the ratio of true-369 positive predictions to the total number of predicted positives; iii) recall, which370 is expressed as the ratio of true-positive predictions to the total number of actual371 positives; iv) the F1 score, which is computed as the harmonic mean of precision372 and recall; and v) the training time, which is measured as the total time required373 to complete the training rounds, including the communication and computation374 times.375 We define the total training time Ttotal as the sum of the per-round computation376 and communication latencies over all Rfederated rounds:377 Ttotal = R X r=1 Tdl + max i∈S T(i) comp +T(i) ul +Tagg.(13) In each federated round, client iperforms local computations on its own data in378 time T(i) comp E×Ni batch size ×t(i) batch. The server first incurs a download delay of379 Tdl when the global model is sent to clients (server(client). After the local training380 process, client iuploads its update in time T(i) ul (client(server). Since the server381 waits for the slowest client, the combined communication and computation cost in382 that round is maxi∈S T(i) comp +T(i) ul +Tdl. Once all the updates arrive, the server383 aggregates them in time Tagg.384 5. Results and Discussion385 This section includes an evaluation of the proposed adaptive client selection386 approach for conducting FL to detect DDoS attacks within IoT environments. We387 first assess the performance of the model in client-side evaluations. Next, we388 conduct experiments within FL settings, comparing the results with those of the389 centralized model. We apply the proposed client selection algorithm and compare390 its performance with that of the state-of-the-art methods, analyzing the accuracies391 of the tested models under both IID and non-IID data settings. Finally, we evaluate392 the communication overhead, latency, sensitivity, and convergence time of the393 proposed model throughout the communication rounds.394 17 5.1. Classification Accuracy Achieved on the Client Side395 In this experiment, we first establish a local training baseline by measuring the396 detection accuracies of the CNN architecture trained independently and in a cen-397 tralized manner on the different partitions of the dataset, each of which resembles398 the data captured by a separate and heterogeneous IoT client. For the CIC-IDS2018399 dataset, the evaluation is conducted across five distributed clients. Table 6presents400 the corresponding results. The table shows that the model demonstrates robust401 performance in terms of detecting various IoT attacks across multiple clients,402 achieving accuracy, precision, recall, and F1 score values of 100.00% for benign403 traffic across all clients in the CIC-IDS2018 dataset. For the DDoS and other DoS404 attack types, the model maintains high precision and recall levels, with an average405 precision of 99.28% across the different attack types. However, the SlowHTTPTest406 attack detection results show a minimum recall of 44.57% because these attacks407 have low cardinality. Overall, the average accuracy of 99.28% achieved by the408 model across diverse clients and attack types underscores its effectiveness for de-409 tecting DDoS attacks in IoT environments. In client-side evaluations, it achieves410 an average accuracy of 99.28%, a precision of 98.05%, a recall of 97.86%, and an411 F1 score of 96.54%.412 For the CIC-DDoS2019 dataset, we report the per-class performance achieved413 across 12 DDoS attack types and benign traffic. As shown in Table 7, our client-414 side evaluation yields an overall accuracy of 95.85%. Benign traffic is classified415 with 98.10% accuracy, whereas the average accuracy attained for the DDoS attack416 classes is 95.60%. Across those attack categories, the model attains a mean417 precision level of 95.47%, a mean recall of 95.40%, and a mean F1 score of418 95.50%.419 For the BoT-IoT dataset, the results in Table 8describe the classification per-420 formance metrics achieved in the IoT DDoS attack detection scenarios. The results421 demonstrate that most metrics reach values that are close to or equal to 100%. In422 particular, the models achieve perfect or almost perfect scores for the Benign and423 Reconn classes across all the metrics and clients, indicating their robustness and424 reliability in terms of detecting these types of traffic. The DDoS and Theft classes425 also exhibit high accuracy levels, consistently yielding scores >99.00% for most426 metrics, underscoring the effectiveness of the proposed model in identifying these427 attacks. Even the Scan class–which is often considered more challenging–provides428 excellent performance, with a classification accuracy of approximately 98%. Over-429 all, the client-side evaluation of the model demonstrates an average accuracy of430 99.20%, a precision of 99.70%, a recall of 99.85%, and an F1 score of 99.58%.431 18 Table 6: Client-side evaluation results obtained on the CIC-IDS2018 dataset. Class Metric Client accuracy [%] IoT1 IoT2 IoT3 IoT4 IoT5 Benign Precision 100.00 100.00 100.00 100.00 100.00 Recall 100.00 100.00 100.00 100.00 100.00 F1 score 100.00 100.00 100.00 100.00 100.00 DDOS attack–HOIC Precision 97.12 97.23 97.14 97.18 97.34 Recall 97.59 97.36 98.23 99.49 98.16 F1 score 97.86 97.66 97.09 98.12 98.54 DDOS attack–LOIC-UDP Precision 78.03 76.38 77.98 74.86 74.22 Recall 87.20 89.10 84.18 85.00 87.00 F1 score 83.34 84.48 84.08 84.80 84.00 DDOS attack–LOIC-HTTP Precision 92.26 92.22 94.86 94.59 94.93 Recall 98.21 99.87 98.49 98.99 98.62 F1 score 95.12 95.10 96.91 96.87 96.93 DoS attack–GoldenEye Precision 95.66 95.09 98.80 98.81 98.02 Recall 98.21 99.02 99.87 99.49 99.99 F1 score 96.04 97.64 99.13 99.81 99.64 DoS attack–Hulk Precision 97.07 98.42 98.08 98.76 98.74 Recall 99.27 98.82 99.41 98.51 99.36 F1 score 98.19 99.85 99.30 99.87 99.15 DoS attack–SlowHTTPTest Precision 77.11 67.48 68.82 78.37 79.02 Recall 44.57 44.46 44.41 44.87 44.05 F1 score 61.13 61.81 61.64 61.51 61.64 DoS attack–Slowloris Precision 82.11 89.48 79.62 84.37 82.02 Recall 77.40 75.62 76.49 76.98 76.50 F1 score 88.07 85.42 86.08 86.64 86.32 Avg. accuracy 99.28 For the CIC-IoT2023 dataset, which includes eight DDoS attack types and benign432 traffic, the client-side evaluation yields an overall accuracy of 96.95% (Table433 9). Benign samples are detected with 97.50% accuracy on average, whereas the434 average accuracy attained for the IoT attack types is 96.80%. Across these attack435 categories, the mean precision is 96.70%, the mean recall is 96.60%, and the mean436 F1 score is 96.65%.437 5.2. Comparison with Centralized with Federated Learning Models438 In this experiment, we compare the accuracy of the proposed FELACS ap-439 proach with those of centralized standalone models and FL-based aggregation440 strategies, including random selection (Ruan et al.,2021;Ginanjar et al.,2025),441 FedAvg (McMahan et al.,2017), FedProx (Li et al.,2020b), and FedMCCS (Ab-442 dulRahman et al.,2020).443 19 Table 7: Client-side evaluation results obtained on the CIC-DDoS2019 dataset. Class Metric Client accuracy [%] IoT1 IoT2 IoT3 IoT4 IoT5 Benign Precision 98.98 99.08 98.85 98.75 98.72 Recall 99.60 99.55 99.34 99.73 99.86 F1 score 99.29 99.31 99.09 99.24 99.29 DNS Precision 71.75 80.00 75.95 73.41 74.09 Recall 67.65 76.33 75.16 78.87 79.67 F1 score 69.86 78.93 73.85 74.81 76.98 SNMP Precision 83.64 69.20 65.72 78.94 73.88 Recall 86.28 74.71 63.55 75.14 74.61 F1 score 85.70 77.85 62.59 76.05 74.15 LDAP Precision 51.75 65.37 73.15 69.98 67.27 Recall 52.28 71.28 86.41 90.25 65.53 F1 score 56.83 68.03 79.34 81.16 66.26 MSSQL Precision 89.22 85.16 93.15 92.69 88.67 Recall 94.38 93.19 93.89 95.57 93.89 F1 score 95.69 89.00 93.48 93.82 90.86 NTP Precision 99.51 99.63 99.63 99.54 99.32 Recall 99.05 99.44 99.35 99.06 99.34 F1 score 99.28 99.54 99.49 99.37 99.33 NetBIOS Precision 87.14 81.48 78.57 76.84 82.75 Recall 70.94 82.30 73.18 72.72 80.67 F1 score 81.36 85.69 75.78 74.78 81.54 SSDP Precision 76.45 71.39 83.15 76.37 73.41 Recall 82.28 73.23 93.89 73.72 71.29 F1 score 79.52 72.27 88.20 74.82 72.37 Syn Precision 98.50 97.25 97.63 98.62 95.24 Recall 96.12 95.83 98.73 98.72 99.17 F1 score 97.73 96.79 98.18 98.44 97.17 TFTP Precision 100.00 99.69 99.98 100.00 99.93 Recall 99.32 99.34 99.37 99.20 99.22 F1 score 99.66 99.65 99.67 99.60 99.57 UDP Precision 91.21 95.79 97.57 97.43 97.82 Recall 97.34 93.87 95.23 95.83 95.82 F1 score 94.05 94.65 96.40 96.62 96.89 WebDDoS Precision 77.14 73.66 76.85 82.96 76.68 Recall 69.43 71.28 74.18 95.57 74.34 F1 score 73.63 72.28 75.27 88.82 75.57 Avg. accuracy 95.85 20 Table 8: Client-side evaluation results obtained on the BoT-IoT dataset. Class Metric Client accuracy [%] IoT1 IoT2 IoT3 IoT4 IoT5 Benign Accuracy 100.00 100.00 100.00 100.00 100.00 Precision 100.00 100.00 100.00 100.00 100.00 Recall 100.00 100.00 100.00 100.00 100.00 F-measure 100.00 100.00 100.00 100.00 100.00 DDoS Accuracy 99.01 99.28 99.28 99.23 99.25 Precision 99.31 99.49 99.63 98.77 99.10 Recall 99.77 99.60 99.88 99.87 99.86 F-measure 99.73 99.72 99.82 99.84 99.86 Reconn Accuracy 100.00 100.00 100.00 100.00 100.00 Precision 99.73 98.59 99.70 99.60 99.29 Recall 100.00 100.00 100.00 100.00 100.00 F-measure 100.00 100.00 100.00 100.00 100.00 Theft Accuracy 99.00 99.00 99.00 99.00 99.00 Precision 99.03 99.10 99.11 99.11 99.37 Recall 100.00 100.00 100.00 100.00 100.00 F-measure 99.15 99.22 99.44 99.55 99.75 Scan Accuracy 97.00 98.00 98.00 98.00 98.00 Precision 98.00 98.08 98.15 98.08 98.15 Recall 98.83 99.93 99.93 99.93 99.93 F-measure 97.38 99.00 99.03 99.00 99.03 Avg. accuracy 99.20 For the CIC-IDS2018 dataset, the results show that the proposed FELACS444 method achieves ≈95.0% accuracy, as shown in Figure 1a, outperforming the445 other methods and even the centralized version. Similarly, for the CIC-DDoS2019446 dataset, the results are shown in Figure 1b. Among the federated strategies,447 FedMCCS and FELACS achieve the highest accuracies at ≈92.0%, also outperfor-448 ming the centralized baseline. On the BoT-IoT dataset, as illustrated in Figure 1c,449 FELACS also consistently outperforms the compared approaches, with ≈92.0%450 accuracy. Considering the CIC-IoT2023 dataset, Figure 1d shows that, on a451 more complex split, CL-sin reaches a top accuracy of approximately ≈99.0%;452 FELACS has the best performance among the FL-based approaches, with an453 average accuracy of ≈98.0%. Although the centralized model retains a small lead454 in this scenario, FELACS matches or exceeds all other federated baselines.455 The results obtained on the considered datasets confirm that our methodology456 effectively adapts to changing traffic conditions, maintaining high accuracy levels457 under all conditions, and is superior to other FL-based approaches, in some cases458 surpassing the centralized version. This finding underscores two key points.459 First, FL can approach or surpass the performance of centralized methods when460 21 Table 9: Client-side evaluation results obtained on the CIC-IoT2023 dataset. Class Metric Client accuracy [%] IoT1 IoT2 IoT3 IoT4 IoT5 Benign Precision 92.43 95.48 93.32 94.57 94.06 Recall 95.75 97.24 96.22 97.87 98.23 F1 score 93.08 93.20 93.20 93.20 93.20 BruteForce Precision 97.57 95.89 96.94 94.87 94.87 Recall 91.83 95.68 93.72 95.68 95.68 F1 score 95.32 95.40 95.34 94.64 94.96 DDoS Precision 99.67 97.64 98.39 98.74 99.82 Recall 99.94 98.30 98.92 97.34 97.07 F1 score 99.55 99.54 98.02 98.90 97.48 DoS Precision 97.56 95.47 89.43 94.23 95.92 Recall 87.57 89.66 87.76 93.64 96.04 F1 score 94.70 93.68 89.86 92.72 95.99 Mirai Precision 100.00 100.00 100.00 100.00 100.00 Recall 99.45 99.78 99.00 99.92 99.32 F1 score 99.78 99.89 99.58 99.98 99.74 Recon Precision 98.95 98.00 97.62 96.89 97.70 Recall 100.00 100.00 100.00 100.00 99.74 F1 score 99.08 99.01 98.76 98.46 98.68 Spoofing Precision 83.79 83.80 83.00 83.00 83.00 Recall 97.88 97.00 97.00 97.00 96.00 F1 score 89.90 89.34 89.20 89.32 89.67 Web Precision 74.64 89.00 78.27 76.66 74.64 Recall 79.69 72.62 78.68 80.70 81.71 F1 score 76.66 79.69 78.68 68.68 77.34 Avg. accuracy 98.86 heterogeneity is properly managed. Second, by dynamically prioritizing clients461 with the most informative data under resource constraints, FELACS injects higher-462 quality updates into each aggregation step, increasing the accuracy of the global463 model without sacrificing privacy or incurring centralization overhead. As a464 consequence, we believe that the proposed methodology is able to adapt to modern465 IoT networks under a variety of network conditions.466 5.3. Impact of the Number of Clients on Global Accuracy467 In this section, we evaluate the accuracy achieved by the proposed method468 when varying the number of clients. Table 10 shows the average accuracy attained469 by the global model over 50 communication rounds as we vary the number of par-470 ticipating clients (10,25, and 50) on four benchmarks. Across all the datasets, both471 FELACS+CNN and FELACS+VGG16 consistently outperform FedAvg, FedProx,472 22               (a) CIC-IDS2018               (b) CIC-DDoS2019 Cl-sin FedAvg FedProx Random FedMCCS FELACS 0.70 0.75 0.80 0.85 0.90 0.95 1.00 Accuracy (c) BoT-IoT               (d) CIC-IoT2023 Figure 1: Accuracies achieved by various aggregation strategies and centralized standalone models on the considered datasets. It is possible to observe how the proposed FELACS method achieves the highest accuracy among the tested FL-based techniques, in some cases surpassing the centralized version (CL-sin). FedMCCS, and random selection, with the VGG16 variant achieving the highest473 accuracy in every setting. In particular, on CIC-IDS2018, FELACS+CNN attains474 98.20%,99.80%, and 99.40% accuracy values with 10,25, and 50 clients, respec-475 tively, whereas FELACS+VGG16 further improves the performance to 98.50%,476 99.90%, and 99.60%–up to 1.40% higher than the metrics of the best baseline477 (FedProx). On CIC-DDoS2019, FELACS+CNN achieves 93.00%,94.00%, and478 94.50% accuracy values, whereas FELACS+VGG16 reaches 93.50%,94.50%, and479 95.00% accuracy values, exceeding those of FedProx by up to 1.40%. On BoT-IoT,480 the accuracies increase from 97.10%,97.90%, and 98.30% for FELACS+CNN to481 97.40%,98.10%, and 98.50% with FELACS+VGG16, surpassing the results of482 FedProx by as much as 1.40%. Finally, on CIC-IoT2023, FELACS+CNN delivers483 accuracies of 95.20%,95.80%, and 96.00%, and FELACS+VGG16 reaches values484 95.50%,96.10%, and 96.30%, outperforming all the baselines by 0.60 − −1.00%.485 23 Table 10: Impact of the number of clients on the accuracy of the global model. Algorithm CIC-IDS2018 CIC-DDoS2019 BoT-IoT CIC-IoT2023 10 25 50 10 25 50 10 25 50 10 25 50 FedAvg 97.00 97.80 98.20 91.80 92.40 93.00 96.80 97.60 98.00 94.20 94.80 95.10 FedProx 97.10 97.90 98.30 92.30 93.00 93.60 96.90 97.70 98.10 94.50 95.10 95.40 Random 96.80 97.50 97.90 91.20 91.80 92.40 96.60 97.30 97.80 93.80 94.30 94.60 FedMCCS 93.92 94.06 94.26 90.10 90.70 91.20 93.12 93.86 94.88 92.50 93.00 93.40 FELACS+CNN 98.20 99.80 99.40 93.00 94.00 94.50 97.10 97.90 98.30 95.20 95.80 96.00 FELACS+VGG16 98.50 99.90 99.60 93.50 94.50 95.00 97.40 98.10 98.50 95.50 96.10 96.30 The results produced with different numbers of clients confirm two key find-486 ings. First, enlarging the client population improves the performance of the global487 model by increasing the diversity of the samples. Second, integrating a deeper488 VGG16 backbone with FELACS yields additional accuracy gains over the CNN489 baseline, demonstrating robust and high-quality aggregated updates even under490 severe non-IID conditions. As the client pool further expands, the gains decrease:491 selecting up to 100 clients yields only marginal accuracy improvements over the492 results obtained using fewer participants. Although a larger cohort can capture493 more diverse data, this advantage plateaus beyond a certain point. Moreover, in-494 tegrating VGG16, which has a substantially larger parameter count and a deeper495 architecture, increases the computational and communication burdens imposed on496 resource-constrained edge devices and IoT nodes. In our experiments, selecting497 approximately 25 clients strikes the best balance between global accuracy and498 system efficiency, providing sufficient data diversity to avoid both underfitting and499 overfitting without incurring the excessive training time, memory usage, and band-500 width demands that arise when many devices must process or transmit updates501 for a heavyweight model such as VGG16. This underscores the importance of502 a strategic client selection strategy that jointly considers model complexity and503 limited edge resources.504 5.4. Classification Results505 The FL model classification results obtained on the CIC-IDS2018 dataset when506 our FELACS client selection strategy is applied are presented in Figure 2a. The per-507 formance metrics produced across 100 communication rounds demonstrate that the508 proposed FELACS approach outperforms the FedAvg, FedProx, FedMCCS, and509 Random methods, achieving higher accuracy throughout all the training rounds.510 Similarly, Figure 2b presents the accuracy curves obtained for CIC-DDoS2019.511 The figure shows that FELACS consistently outperforms the baselines, exceeding512 24 0 20 40 60 80 100 Communication Rounds 0.86 0.88 0.90 0.92 0.94 0.96 0.98 1.00 accuracy (%) FedAvg FedProx FedMCCS FELACS (a) CIC-IDS2018 0 10 20 30 40 50 60 70 80 90 100 Communication Rounds 88 90 92 94 96 98 100 accuracy (%) FedAvg FedProx FedMCCS FELACS (b) CIC-DDoS2019 0 20 40 60 80 100 Communication Rounds 0.86 0.88 0.90 0.92 0.94 0.96 0.98 1.00 accuracy (%) FedAvg FedProx FedMCCS FELACS (c) BoT-IoT 0 10 20 30 40 50 60 70 80 90 100 Communication Rounds 88 90 92 94 96 98 100 accuracy (%)) FedAvg FedProx FedMCCS FELACS (d) CIC-IoT2023 Figure 2: Detection accuracies attained over 100 communication rounds on the considered datasets with different client selection strategies. The proposed FELACS approach outperforms the other FL-based methods. 98.8% accuracy and maintaining stable performance. Figure 2c illustrates the513 accuracy achieved on the BoT-IoT dataset. The accuracy curves converge toward514 values near 100%, with the FELACS method reaching the highest final accuracy.515 On the CIC-IoT2023 dataset (Figure 2d), FELACS achieves over 98% accuracy by516 round 20 while also attaining the highest steady-state accuracy of approximately517 99.5%.518 5.5. Communication Overhead519 In this section, we evaluate the number of communication rounds needed to520 achieve convergence. In particular, Table 11 illustrates the numbers of rounds521 needed to reach 90% and 95% accuracy under both IID and non-IID splits for all522 25 Nguyen, Q.H., Hore, S., Shah, A., Le, T., Bastian, N.D., 2025. FedNIDS: A feder-699 ated learning framework for packet-based network intrusion detection system.700 Digital Threats: Research and Practice 6, 1–23.701 Nishio, T., Yonetani, R., 2019. Client selection for federated learning with hetero-702 geneous resources in mobile edge, in: Proc. of ICC, pp. 1–7.703 Olanrewaju-George, B., Pranggono, B., 2025. Federated learning-based intrusion704 detection system for the internet of things using unsupervised and supervised705 deep learning models. Cyber Security and Applications 3, 100068.706 Pakmehr, A., Aßmuth, A., Taheri, N., Ghaffari, A., 2024. Ddos attack detection707 techniques in IoT networks: a survey. Cluster Computing 27, 14637–14668.708 Puchinger, J., Raidl, G.R., Pferschy, U., 2010. The multidimensional knapsack709 problem: Structure and algorithms. INFORMS Journal on Computing 22,710 250–265.711 Rahmati, M., 2025. Federated learning-driven cybersecurity framework for IoT712 networks with privacy-preserving and real-time threat detection capabilities, in:713 arXiv:2502.10599, pp. 1–16.714 Roy, S., Li, J., Bai, Y., 2023. Federated learning-based intrusion detec-715 tion system for IoT environments with locally adapted model, in: Proc. of716 CSCloud/EdgeCom, pp. 203–209.717 Ruan, Y., Zhang, X., Liang, S.C., Joe-Wong, C., 2021. Towards flexible device718 participation in federated learning, in: Proc. of ICAIS, PMLR. pp. 3403–3411.719 Ruzafa-Alc´ azar, P., Fern´ andez-Saura, P., M´ armol-Campos, E., Gonz´ alez-Vidal, A.,720 Hern´ andez-Ramos, J.L., Bernal-Bernabe, J., Skarmeta, A.F., 2021. Intrusion721 detection based on privacy-preserving federated learning for the industrial IoT.722 IEEE Trans. on Industrial Informatics 19, 1145–1154.723 Seo, S., Lee, J., Ko, H., Pack, S., 2022. Performance-aware client and quantization724 level selection algorithm for fast federated learning, in: Proc. of WCNC, pp.725 1892–1897.726 Sharafaldin, I., Lashkari, A.H., Ghorbani, A.A., 2018. Toward generating a new727 intrusion detection dataset and intrusion traffic characterization. ICISSp 1,728 108–116.729 32 Sharafaldin, I., Lashkari, A.H., Hakak, S., Ghorbani, A.A., 2019. Developing730 realistic distributed denial of service (DDoS) attack dataset and taxonomy, in:731 Proc. of ICCST, pp. 1–8.732 Sun, S., Sharma, P., Nwodo, K., Stavrou, A., Wang, H., 2024. FedMADE: Robust733 federated learning for intrusion detection in IoT networks using a dynamic734 aggregation method, in: Proc. of ICIS, pp. 286–306.735 Tahir, M., Mawla, T., Awaysheh, F., Alawadi, S., Gupta, M., Ali, M.I., 2025.736 SecureFedPROM: A zero-trust federated learning approach with multi-criteria737 client selection. IEEE Journal on Selected Areas in Communications 43, 2025–738 2041.739 Vardhan, H., Yu, X., Rosing, T., Mazumdar, A., 2025. Client selection in federated740 learning with data heterogeneity and network latencies, in: arXiv:2504.01921,741 pp. 1–23.742 Wang, H., Yurochkin, M., Sun, Y., Papailiopoulos, D.S., Khazaeni, Y., 2020.743 Federated learning with matched averaging, in: Proc. of ICLR, pp. 1–16.744 Wang, S., Ji, M., 2022. A unified analysis of federated learning with arbitrary745 client participation, in: Proc. of NIPS, pp. 19124–19137.746 Wu, H., Tang, X., Zhang, Y.J.A., Gao, L., 2023. Incentive mechanism for federated747 learning with random client selection. IEEE Trans. on Network Science and748 Engineering 11, 1922–1933.749 Yang, H., Liu, Z., Liu, J., Dong, C., Momma, M., 2023. Federated multi-objective750 learning. Advances in neural information processing systems 36, 39602–39625.751 Zhang, J., Li, S., Wang, C., 2024. Utility aware optimal data selection for differ-752 entially private federated learning in IoV. IEEE Internet of Things Journal 11,753 33326–33336.754 Zhao, Y., Li, M., Lai, L., Suda, N., Civin, D., Chandra, V., 2018. Federated755 learning with non-IID data, in: arXiv:1806.00582, pp. 1–12.756 33