Multi-Agent Agentic AI and Federated Learning for Attack Detection in Sustainable IoT

Abstract

The Internet of Things (IoT) comprises a vast number of digitally networked devices. Machine learning (ML), deep learning (DL), and federated learning (FL), all subfields of artificial intelligence (AI), have recently been investigated as cybersecurity solutions for protecting these networked devices from intrusions and cyberattacks. However, existing ML and DL techniques for Sustainable IoT data carry significant privacy implications. Because of its inherent suitability for IoT settings, AI-based cybersecurity, and FL in particular, has become critical, yet traditional FL-based approaches themselves fall short in several respects. We need a framework that prioritizes privacy while enabling effective FL on edge-generated data. This research aims to address three persistent problems in traditional FL-based systems: class imbalance, unequal data distribution across devices, and computational complexity. To this end, we propose a novel Multi-Agentic AI framework in which each device decomposes its local workload across three cooperating: Agent 2 performs data preprocessing, including WGAN-based oversampling to correct class imbalance; Agent 1 performs data distribution, applying a vertical federated learning (VFL) partitioning scheme to address the unequal data distribution that typically affects FL-based IoT systems; and Agent 3 performs classification, training a deep autoencoder and an MLP on the resulting features while keeping the computational load on each device manageable. Experiments on the Modbus ICS network and ToN-IoT datasets show that our framework improves on the performance of comparable ML models while overcoming the limitations of existing FL-based techniques. Our VFL approach delivers consistent data distribution and higher attack detection accuracy, reaching 99.56% and 99.62% on the two datasets, respectively. Overall, this multi-agent agentic AI methodology offers a practical way to address the core challenges of FL and meaningfully improve AI effectiveness in privacy-sensitive sustainable IoT domains.

1. Introduction

IoT-enabled systems and devices are interconnected entities that continuously exchange data over a network, enabling dynamic communication and coordinated operation across a wide range of applications [1]. IoT links together everything from industrial equipment to smart household appliances [2,3]. Cybersecurity is essential for protecting these systems and networks against unauthorized access and a range of threats, including malware [4], phishing [5], ransomware [6], and social engineering [7]. The widespread connectivity that makes IoT useful is the same property that expands its attack surface [8], and cybercriminals routinely exploit IoT and network vulnerabilities to steal data or take unauthorized control of devices. Encrypting device communications, applying security updates promptly, and replacing default passwords all help reduce this risk, and consistent cybersecurity practice is what keeps the benefits of IoT from being outweighed by its hazards [9].

Conventional attack detection systems (ADSs) [10] monitor network traffic for suspicious activity, but because they depend on predefined rule sets, they tend to struggle at scale and are slow to recognize attack types they have not seen before [11]. This limitation drives up false alarm rates and leaves systems exposed to single points of failure at the central server. FL-based ADSs avoid centralizing data, but introduce their own obstacles to accurate detection, among them high communication costs and inconsistency across the data held by different devices [12]. Recent work confirms that these problems persist: FL-based intrusion detection systems built on FedAvg or similar aggregation schemes still struggle to generalize across heterogeneous IoT networks, which shows up as more false alarms, under-fitted models, and reduced detection accuracy once client data stops looking alike [13]. Data imbalance and divergent data distributions across devices compound the problem further, degrading the quality of the federated model updates.

Artificial intelligence (AI), and machine learning (ML) in particular, is increasingly central to security applications because of its capacity to learn directly from large volumes of data. Neural networks have shown strong potential for improving both detection accuracy and adaptability [14]. In a typical IoT deployment, devices collect, stream, and transmit data, while the actual learning happens in an ML or AI model running at the edge or in the cloud [15]. Combining IoT with these techniques enables real-time analysis of data from distributed devices, which supports proactive threat detection and ongoing system optimization [14]. Table 1 lists the acronyms used throughout this paper.

Table 1. List of Acronyms.

Acronym	Definition
DAs	Deep Autoencoders
FL	Federated Learning
CSV	Comma-Separated Values
GRU	Gated Recurrent Unit
SMOTE	Synthetic Minority Over-sampling Technique
PCAP	Packet Capture
HFL	Horizontal Federated Learning
LM	Local Model
MSE	Mean Squared Error
SGD	Stochastic Gradient Descent
LR	Learning Rate
GAN	Generative Adversarial Network
VFL	Vertical Federated Learning
ML	Machine Learning
MLP	Multilayer Perceptron
DL	Deep Learning
IoT	Internet of Things
QoE	Quality of Experience
FTML	Federated Teacher Mimic Learning
XSS	Cross-Site Scripting

Traditional ML-based anomaly detection also has drawbacks: it typically requires pooling raw data at a central point, which can compromise privacy [16] and adds communication overhead [17]. FL addresses part of this problem by enabling cooperative model training without ever releasing raw data, which preserves privacy and reduces communication costs. Even so, FL-enabled attack detection systems still contend with class imbalance, inconsistent data distributions, and long training times, and these limitations have not gone away in the most recent literature [18]. Where earlier work leaned on techniques such as SMOTE, Wasserstein Generative Adversarial Networks (WGANs) offer a more capable alternative for imbalanced IoT security datasets, since they combine data augmentation, feature-space consistency, and noise reduction in one mechanism [19]. The Wasserstein loss function was originally introduced to address mode collapse, a common failure mode in conventional Generative Adversarial Networks (GANs) in which the generator produces limited or repetitive outputs and fails to capture the diversity of the real data distribution; using the Wasserstein loss stabilizes training by giving the generator a smoother, more informative gradient to learn from [20].

FL is particularly valuable in sectors such as healthcare and banking, where data privacy is non-negotiable. It is not without cost, however: training complex architectures such as those built on GRU layers is computationally expensive [21], which limits scalability, and horizontal federated learning (HFL) models remain sensitive to biased or inconsistent data distribution across clients [21]. Existing FL-based IoT security work, including the studies discussed above, largely treats each device as a single monolithic learner responsible for preprocessing, distributing, and classifying its own data all at once, which is part of why class imbalance, uneven distribution, and computational overhead persist together rather than being addressed individually. Agentic AI marks a shift away from single-pass generative models toward systems that reason, plan, and act across multi-step tasks, usually by splitting the work across several cooperating agents instead of asking one model to do everything. That shift has moved fastest in security operations: a single LLM can summarize an alert, but it cannot reliably pull the right data, check its own output, or hand a decision off to the next stage of an investigation. Multi-agent pipelines close that gap by breaking the workflow into role-specific agents that can be inspected, swapped out, and improved on their own, rather than debugging one model that is trying to do preprocessing, analysis, and response all at once [22]. We apply the same idea to IoT threat detection.

We instead take an agentic AI approach, in which each device’s workload is decomposed across multiple cooperating agents, with each agent handling one well-defined sub-task rather than one model attempting all three at once. Concretely, every device in our framework runs three agents in sequence: Agent 2 handles data preprocessing, cleaning each device’s raw traffic and applying WGAN-based oversampling to correct class imbalance before the data goes any further; Agent 1 handles data distribution, applying a vertical FL (VFL) partitioning scheme so that each device works on a consistent, feature-wise subset of the data rather than an arbitrarily uneven split; and Agent 3 handles classification, training a deep autoencoder and an MLP on the features Agent 2 has prepared, and sharing only the resulting model update, never raw data, with the central server. Separating these responsibilities keeps each agent’s task simple, independently verifiable, and easier to improve in isolation, and lets us target class imbalance, uneven distribution, and computational cost with a dedicated agent for each, rather than asking a single model to solve all three simultaneously. Unlike conventional HFL/FedAvg, where clients typically train on different subsets of samples with a common feature space and the server aggregates local model updates [23], our VFL-based architecture distributes different feature subsets of the same samples across clients [24]. Thus, the proposed framework learns from complementary feature representations rather than simply averaging independently trained local models. This study evaluates that agentic, multi-agent FL framework for IoT threat detection. Through a comprehensive evaluation, we show that the proposed technique improves attack detection accuracy while resolving key limitations of FL-enabled devices in IoT environments.

1.1. Motivation

FL for IoT applications is still not widely adopted, largely because of uneven data distribution, class imbalance, and computational complexity. In IoT scenarios, class imbalance arises when abnormal or attack-related events are heavily underrepresented relative to normal operational data. This imbalance can mislead learning algorithms into favoring the majority class, producing high overall accuracy alongside poor detection of the minority classes that matter most, such as cyberattacks or system faults. To address these limitations, we propose an agentic AI method in which each device runs three complementary agents: Agent 2 handles data heterogeneity and class imbalance during preprocessing; Agent 1 applies a vertical FL approach to handle uneven distribution across devices; and Agent 3 compresses high-dimensional data with a deep autoencoder and performs classification, reducing the computational cost of model training. Specifically, Agent 3 uses deep autoencoder neural network models trained on the Modbus ICS network dataset [25]. This agentic AI strategy is intended to improve the accuracy and efficiency of FL systems operating in imbalanced, heterogeneous IoT environments, and in doing so, make FL more practically viable for real-world adoption.

1.2. List of Contributions

We make the following contributions in this work:

• We introduce an agentic AI design in which each device’s workload is decomposed across three cooperating, autonomous agents, Agent 1 (data distribution), Agent 2 (data preprocessing), and Agent 3 (classification), rather than treating each device as a single monolithic learner.
• We propose VFL, applied by Agent 1, to provide a more equitable distribution of data across IoT devices.
• We employ Wasserstein Generative Adversarial Networks (WGANs), applied by Agent 2, to address class imbalance by generating synthetic data for underrepresented attack classes, improving the robustness of our IoT attack detection model.
• Our framework combines WGANs, deep autoencoders (DAs), and a multilayer perceptron (MLP), coordinated across the three agents, for improved IoT attack detection. CICFlowMeter [26] and Anaconda are used for the implementation.
• We introduce ordinal encoding, applied by Agent 2, to improve compatibility with and integration across diverse IoT data types, ensuring efficient data processing.
• We evaluate the proposed framework on the ToN-IoT and Modbus ICS datasets [25] to detect IoT attacks.

The rest of the paper is organized as follows: Section 2 presents the literature review. Section 3 describes the proposed methodology. Section 3.16 presents the evaluation results and discussion, and Section 4 presents the conclusions and future directions.

2. Related Literature

This section surveys the previous studies concerning the detection of attacks in IoT networks in three categories: ML approaches, DL approaches, and FL approaches. The studies mentioned below are summarized in Table 2.

2.1. ML for IoT Attack Detection

Sensitive information is routinely gathered and transmitted by IoT devices, which are an appealing target, and because of their limited security on the device, this data is vulnerable. The reported attack types include spyware, ICMP flooding, and other variants of DDoS attacks [27,28], man-in-the-middle interception [29], phishing [30] and SQL injection [31]. With the access, the attackers can cause damage to devices, inject malware or steal data from the network.

Rego et al. [32] mixed reinforcement learning (RL) with a DL classifier to schedule smart home services in order to minimize disruption to the service and predict the next service required by the user. Their DL classifier was superior to a KNN baseline, and adding RL to this learning approach increased the measured quality of experience (QoE) to 8.7/10 in the best-case scenario, based on data obtained from a Markov chain model of user behavior. Bikila and Čapek [33] adopted an alternative method: they have used an elastic deep autoencoder to reduce the features and a Grey Wolf Optimizer to fine-tune the XGBoost classifier. The model was tested on the CICIoT2023 and CICIDS2017 datasets, achieving an accuracy of 99.85%, and it is sufficiently lightweight to be deployed in practice.

IDS-Agent, the first LLM-agent-based intrusion detector for IoT traffic, is built around a reasoning loop that does preprocessing, classification, and knowledge retrieval as distinct actions. Useful if you want to contrast a single-agent LLM loop against your three-agent decomposition [34].

Table 2. Summary of Literature Review, Including Dataset and Key Limitation per Study.

Ref.	Year	Novel Framework	Algorithms	Accuracy	Dataset/Key Limitation
ML for IoT Attack Detection
[32]	2022	RL + deep learning intelligent system for smart home QoE	RL, DL, KNN	8.7 (QoE scale)	No named attack dataset; QoE metric, not attack-detection accuracy—not directly comparable
[33]	2025	Autoencoder-based, GWO-optimized attack detection for IoT	EDA, XGBoost (GWO-tuned)	99.85%	CICIoT2023, CICIDS2017; centralized, not federated or privacy-preserving
DL for IoT Attack Detection
[35]	2020	DL for IoT botnet detection from network traffic	RNN, CNN, LSTM-RNN	89.75%	N-BaIoT; centralized; no client/round protocol (not FL)
[36]	2021	BiLSTM-CNN for DDoS detection on N-BaIoT	BiLSTM-CNN, CNN, RNN, LSTM-RNN	89.79%	N-BaIoT; marginal gain (+0.04 pp) over [35]; centralized
[37]	2020	Sequential architecture for botnet detection with feature selection	Decision tree, ANN, naive Bayes	99%	N-BaIoT; centralized; result depends on hand-selected feature subset
[38]	2023	Comparative ML traffic classification	KNN, RF, LR, DT, XGB	95%	Unspecified real-time traffic dataset; binary and multiclass tasks use different evaluation settings; centralized
[39]	2022	Ensemble learning for IoT botnet detection (ELBA-IoT)	AdaBoosted, RUSBoosted, and bagged decision trees	98.02%	Newer IoT benchmark datasets; datasets not explicitly named, limiting reproducibility; centralized
[28]	2023	Survey of DDoS/ICMP-flood detection methods across internet-enabled networks	Statistical, ML, and DL methods	N/A	Survey rather than an empirical study; included for contextual comparison
FL for IoT Attack Detection
[40]	2020	Federated mimic learning for privacy-preserving intrusion detection	DL, FedAvg-style mimic learning	98.11%	NSL-KDD; general network intrusion dataset rather than IoT-specific; client/round details not reported
[21]	2022	Federated learning for IoT malware detection	MLP, autoencoder, FedAvg	Up to 94%	N-BaIoT; performance is task-dependent and protocol details are limited
[41]	2022	Federated IoT attack detection using decentralized edge data	Deep autoencoder, FedAvg	98%	Decentralized edge data; dataset and federated protocol are not fully detailed
[42]	2022	GAN-augmented federated IDS for smart IoT systems (FEDGAN-IDS)	Federated GAN (CNN generator/discriminator)	Dataset-dependent	Smart-home, e-health, and smart-city traffic; no single accuracy value reported
[43]	2023	Autoencoder-based federated anomaly detection with FedProx vs. FedAvg comparison	Autoencoder, VAE, adversarial AE; FedAvg/FedProx	On par with or above FedAvg under non-IID data	USTC-TFC2016, CIC-IDS2017/2018; useful aggregation comparison, but no single accuracy figure
[44]	2024	Ensemble knowledge distillation for heterogeneous FL-based IDS (FLEKD)	Local model ensembles + knowledge distillation	Outperforms conventional FL	CICIDS2019; single dataset and limited client/round information
[45]	2023	Ensemble deep federated learning for IIoT threat hunting	Deep federated representation learning + one-class classifiers	95–99%	IoT-23, N-BaIoT, CICIDS2017; accuracy varies across three datasets

Table 2. Summary of Literature Review, Including Dataset and Key Limitation per Study.

Ref.	Year	Novel Framework	Algorithms	Accuracy	Dataset/Key Limitation
ML for IoT Attack Detection
[32]	2022	RL + deep learning intelligent system for smart home QoE	RL, DL, KNN	8.7 (QoE scale)	No named attack dataset; QoE metric, not attack-detection accuracy—not directly comparable
[33]	2025	Autoencoder-based, GWO-optimized attack detection for IoT	EDA, XGBoost (GWO-tuned)	99.85%	CICIoT2023, CICIDS2017; centralized, not federated or privacy-preserving
DL for IoT Attack Detection
[35]	2020	DL for IoT botnet detection from network traffic	RNN, CNN, LSTM-RNN	89.75%	N-BaIoT; centralized; no client/round protocol (not FL)
[36]	2021	BiLSTM-CNN for DDoS detection on N-BaIoT	BiLSTM-CNN, CNN, RNN, LSTM-RNN	89.79%	N-BaIoT; marginal gain (+0.04 pp) over [35]; centralized
[37]	2020	Sequential architecture for botnet detection with feature selection	Decision tree, ANN, naive Bayes	99%	N-BaIoT; centralized; result depends on hand-selected feature subset
[38]	2023	Comparative ML traffic classification	KNN, RF, LR, DT, XGB	95%	Unspecified real-time traffic dataset; binary and multiclass tasks use different evaluation settings; centralized
[39]	2022	Ensemble learning for IoT botnet detection (ELBA-IoT)	AdaBoosted, RUSBoosted, and bagged decision trees	98.02%	Newer IoT benchmark datasets; datasets not explicitly named, limiting reproducibility; centralized
[28]	2023	Survey of DDoS/ICMP-flood detection methods across internet-enabled networks	Statistical, ML, and DL methods	N/A	Survey rather than an empirical study; included for contextual comparison
FL for IoT Attack Detection
[40]	2020	Federated mimic learning for privacy-preserving intrusion detection	DL, FedAvg-style mimic learning	98.11%	NSL-KDD; general network intrusion dataset rather than IoT-specific; client/round details not reported
[21]	2022	Federated learning for IoT malware detection	MLP, autoencoder, FedAvg	Up to 94%	N-BaIoT; performance is task-dependent and protocol details are limited
[41]	2022	Federated IoT attack detection using decentralized edge data	Deep autoencoder, FedAvg	98%	Decentralized edge data; dataset and federated protocol are not fully detailed
[42]	2022	GAN-augmented federated IDS for smart IoT systems (FEDGAN-IDS)	Federated GAN (CNN generator/discriminator)	Dataset-dependent	Smart-home, e-health, and smart-city traffic; no single accuracy value reported
[43]	2023	Autoencoder-based federated anomaly detection with FedProx vs. FedAvg comparison	Autoencoder, VAE, adversarial AE; FedAvg/FedProx	On par with or above FedAvg under non-IID data	USTC-TFC2016, CIC-IDS2017/2018; useful aggregation comparison, but no single accuracy figure
[44]	2024	Ensemble knowledge distillation for heterogeneous FL-based IDS (FLEKD)	Local model ensembles + knowledge distillation	Outperforms conventional FL	CICIDS2019; single dataset and limited client/round information
[45]	2023	Ensemble deep federated learning for IIoT threat hunting	Deep federated representation learning + one-class classifiers	95–99%	IoT-23, N-BaIoT, CICIDS2017; accuracy varies across three datasets

2.2. DL for IoT Attack Detection

Sriram et al. [35] evaluated various architectures, such as CNN, RNN, and LSTM-RNN, for DDoS attack detection in IoT networks, simulated using N-BaIoT, a dataset created from nine IoT devices infected with the Mirai and Bashlite botnets. The overall best performance was achieved by the plain RNN, with 89.75% in accuracy, recall, precision and F-measure, outperforming both the LSTM-RNN and CNN variants. Despite all these past efforts, Hezam et al. [36] noted that the problem of DDoS attacks on IoT is still not solved, and suggested a hybrid model of bidirectional LSTM and CNN which achieved 89.79% accuracy on the same N-BaIoT dataset compared to CNN, RNN, and LSTM alone. Instead, Soe et al. [37] looked into feature selection for botnet detection using an ANN in combination with a decision tree and naive Bayes classifier in a sequential pipeline. They were able to achieve 99% accuracy on N-BaIoT with a carefully selected subset of features, indicating that this approach can be a viable alternative to larger models without sacrificing accuracy when careful feature engineering is conducted.

A more general comparison was made by Gebrye et al. [38], who compared random forest, decision tree, KNN, logistic regression, Gaussian naive Bayes, and XGBoost using real-time traffic data. The classification accuracy of 0.99 F1 was achieved by tree-based classifiers on a binary classification problem, while logistic regression and Gaussian naive Bayes failed to achieve an accuracy of 95% for the multiclass problem and the training time increased with a reduction in the number of features. Tree-based classifiers were able to achieve 0.99 F1 classification accuracy on a binary classification problem; logistic regression and Gaussian naive Bayes were not able to achieve an accuracy of 95% on a multiclass problem, and the training time decreased as the number of features was reduced for all classifiers except logistic regression and Gaussian naive Bayes.

Abu Al-Haija and Al-Dala’ien [39] proposed ELBA-IoT, an ensemble of decision-tree-based learners (AdaBoosted, RUSBoosted, and bagged trees) for botnet detection, evaluated on network traffic converted into connection records from newer IoT benchmark datasets. Their ensemble outperformed a standard ML baseline (97.88%), reaching 98.02% accuracy.

Adedeji et al. [28] step back from any single model and instead survey how DDoS attacks—including ICMP floods, TCP SYN floods, and reflection/amplification variants—get detected across internet-enabled networks broadly, IoT included. Rather than reporting one accuracy figure, they group existing detection methods by the stage of attack they target (volumetric, protocol-level, or application-layer) and by whether they rely on statistical thresholds, classical ML, or DL. Read alongside the model-specific results above, their survey is a useful reminder that the choice of detection method should track which class of DDoS attack a deployment is actually exposed to, since a model tuned for volumetric floods will not necessarily catch a slower protocol-level exploit.

2.3. FL for IoT Attack Detection

Al-Marri et al. [40] built a privacy-preserving intrusion detection system around federated mimic learning, pairing FL with a teacher-student mimic setup so that raw data never leaves the local agent. On the NSL-KDD dataset, their federated teacher mimic learning (FTML) variant reached 98.11% detection accuracy close to a centralized DL baseline, while their federated student mimic learning (FSML) variant traded a little accuracy for lower computational cost.

Many FL-for-IoT papers assume agents can freely hand data to a central server [46], an assumption that breaks down once privacy constraints are taken seriously: conventional ML treats all of that pooled data as one batch, which is precisely what makes it unsuitable for privacy-sensitive deployments. Mothukuri et al. [46] instead trained GRU models locally on each agent across federated rounds, sending only the learned weights to a central server, which aggregates them into an updated global model. Rey et al. [21] evaluated a related federated setup with MLP and autoencoder components on the N-BaIoT dataset, and found it outperforming a non-federated centralized baseline in their supervised setting.

Regan et al. [41] took the decentralization further, training a deep autoencoder directly on each agent’s traffic data so that source IP, MAC address, and destination IP features never leave the edge layer. Their model reached 98% anomaly-detection accuracy, and the authors report it scaling and generalizing better than the centralized alternatives they compared against.

Tabassum et al. [42] tackle a different bottleneck: FL models are only as good as the local data each client has, and IoT clients often have too little of it, or too little of the attack classes that matter. Their FEDGAN-IDS gives each IoT agent its own generator-discriminator pair, both CNNs, so that an agent can synthesize additional local training examples before the federated round runs. Across smart-home, e-health, and smart-city traffic, the resulting model converged faster and matched or beat several standalone and federated baselines, without ever sharing raw traffic between agents.

Idrissi et al. [43] instead push on the aggregation algorithm itself. Their Fed-ANIDS system trains autoencoders (a plain autoencoder, a variational autoencoder, and an adversarial autoencoder) locally on each client and flags anomalies from reconstruction error, but the interesting result is in how the models get combined: swapping the standard FedAvg aggregator for FedProx, which adds a regularization term tying each local model back toward the global one, held up noticeably better once client data stopped being identically distributed. Tested across USTC-TFC2016, CIC-IDS2017, and CIC-IDS2018, adversarial-autoencoder variants under FedProx were consistently on par with or ahead of FedAvg, which matters directly for IoT deployments, where traffic patterns differ sharply from one agent type to the next.

Shen et al. [44] target the same non-IID problem from a different angle: rather than changing the aggregation rule, they let each client train a locally specialized model and then reconcile the resulting model ensemble through knowledge distillation, an approach they call FL Ensemble Knowledge Distillation (FLEKD). This gives the aggregation step more flexibility than a straight weight average, and on the CICIDS2019 dataset, it trained faster and detected more unknown attacks than either local-only training or conventional FL, a result the authors also confirm across three simulated real-world deployment scenarios.

Jahromi et al. [45] target IIoT rather than consumer IoT: each client trains two federated representation-learning components—one on normal traffic and one on threat traffic—and shares only the learned parameters with a server, which aggregates them into global models. Clients then train several one-class classifiers locally on top of these shared representations. Across the two test conditions the authors report, the ensemble model held up well as the number of clients changed and trained faster than comparably complex centralized approaches, reaching 95% accuracy on the IoT-23 dataset and 99% on N-BaIoT and CICIDS2017.

Taken together, this body of work points to three recurring limitations: non-identically distributed data across devices in horizontal FL settings, the communication overhead of repeatedly syncing model parameters across a large, heterogeneous device population, and the practical difficulty of getting enough representative local data, stable aggregation, or interpretable results once clients genuinely differ from one another. Vertical FL is one route around the first problem, since it partitions data by feature rather than by client, which is the direction we build on. Beyond adopting VFL, however, we also note that this surveyed work almost universally treats each device as a single learner responsible for preprocessing, distributing, and classifying its own data all at once—-which leaves the three problems above entangled rather than addressed individually. Our approach instead takes an agentic AI view of the local pipeline: each device runs three cooperating agents, Agent 2 for preprocessing, Agent 1 for feature-wise VFL distribution, and Agent 3 for training deep autoencoders on the resulting features, so that devices holding different feature subsets of the same traffic can collaborate on attack detection without ever pooling raw data. This extends the largely horizontal-FL and centralized designs surveyed above, and lets each of the three recurring limitations be targeted by a dedicated agent rather than by a single monolithic model.

3. Methodology

This section presents the details of the proposed method, including data preprocessing, the FL model architecture, and its implementation, all aimed at achieving reliable anomaly detection while preserving user privacy. The methodology strengthens IoT data privacy by combining deep autoencoders (DAs), an MLP, and VFL to address uneven data distribution and improve computational efficiency. Each participating device implements a multi-agent design, in which three cooperating agents are each responsible for a distinct stage of the local pipeline: Agent 1 performs data distribution, Agent 2 performs data preprocessing, and Agent 3 performs classification. Data distribution (Agent 1) partitions each device’s local feature set according to the VFL scheme, ensuring a consistent, feature-wise split of the data. Data preprocessing (Agent 2) then involves converting Modbus traffic data into CSV format and removing unnecessary information, with WGANs generating synthetic data to address class imbalance, followed by ordinal encoding and min-max scaling to improve model interpretability and normalize the data. Classification (Agent 3) then trains DA and MLP models on the resulting features, while Federated Averaging (FedAvg) optimizes training by averaging local updates from each device, improving both performance and privacy on the Modbus ICS and ToN-IoT datasets. Figure 1 illustrates the design of our framework.

Figure 1. Architecture of the proposed methodology.

3.1. Threat Model and Privacy Scope

Because the framework is described as privacy-preserving throughout this paper, the scope of this claim and its limitations are stated explicitly. The framework assumes an honest-but-curious (semi-honest) central server and participating devices, where all parties correctly follow the FedAvg protocol but may attempt to infer additional information from legitimately received data [47]. Under this model, raw traffic data, assigned feature subsets, and locally held labels remain on the devices. Only Agent 3’s model parameters, including DA and MLP weights, are transmitted to the server, which returns the aggregated global model to the participating devices. Thus, the framework provides privacy through the elimination of raw data sharing across devices and with the server.

This privacy scope has three limitations. First, the framework does not protect against a malicious (Byzantine) server or devices that deviate from the protocol, such as by submitting poisoned updates or actively probing other clients. Addressing such threats would require mechanisms such as robust aggregation and client authentication beyond standard FedAvg. Second, model updates can still be vulnerable to privacy attacks. Gradient-based and model inversion attacks may partially reconstruct training examples, while membership inference attacks may determine whether a specific record was used during training [48,49]. The framework does not currently use differential privacy, gradient perturbation, or secure aggregation [50], and these mechanisms are considered future work. Third, the VFL partitioning assumes that the feature grouping and sample alignment metadata do not themselves reveal sensitive information. Therefore, the privacy contribution is limited to preventing raw data sharing and does not provide protection against all possible inference attacks on model updates.

3.2. Multi-Agent Architecture per Device

Rather than treating each federated device as a single monolithic learner, the proposed framework decomposes the local workload into three specialized agents. These agents are implemented using the AutoGen [51] multi-agent framework and coordinated through a LangGraph-based sequential workflow [52], enabling structured information flow and autonomous decision-making at each federated client.

• Agent 1 (Data Distribution): Applies the vertical FL partitioning scheme to the device’s raw feature set, assigning each device a distinct, logically grouped subset of features while preserving a shared set of data samples across devices (Section 3.3).
• Agent 2 (Data Preprocessing): Cleans the device’s assigned traffic data, applies WGAN-based oversampling to correct class imbalance, and encodes and normalizes the resulting features (Section 3.4).
• Agent 3 (Classification): Trains a deep autoencoder and an MLP classifier on the preprocessed feature subset produced by Agent 2, and forwards the resulting local model update to the central server for aggregation via FedAvg (Section 3.5).

This separation of concerns keeps each agent’s task simple and independently verifiable, and mirrors how the local pipeline is organized in Figure 1: raw device data flows upward through Agent 1, then Agent 2, and then Agent 3, before the resulting update leaves the device for the server.

3.3. Data Distribution (Agent 1)

In the Modbus ICS dataset, raw data is provided as PCAP files captured at different hours. Data from the same hour is first concatenated, after which the relevant features are extracted and saved to a separate CSV file. We used the PySyft library [53] to create a number of virtual workers, representing local devices. The same procedure was applied to the ToN-IoT dataset.

The proposed VFL feature partitioning is motivated by complementary observation capabilities in IoT monitoring. Connection metadata and traffic-volume statistics can be associated with network-flow collectors, whereas DNS, SSL/TLS, and HTTP attributes can be associated with protocol-aware inspection components. Assigning these feature groups to different clients provides a realistic interpretation of distributed feature ownership, while acknowledging that the availability of individual attributes depends on the monitoring infrastructure and traffic visibility.

VFL requires the feature subsets held by participating clients to correspond to the same underlying observations. For a column-partitioned benchmark, this correspondence can be maintained through shared observation identifiers and identical training, calibration, and test assignments across clients. Preprocessing must be fitted exclusively on training observations. Complete synthetic feature vectors, if generated before partitioning, can retain correspondence through shared synthetic identifiers; independently generated feature subsets require an additional coordination mechanism.

In a physical deployment, independently captured observations would require entity matching before joint training. Shared flow identifiers incorporating endpoint information, protocol, and an agreed time window could support this process, potentially through Private Set Intersection (PSI) [24]. These requirements distinguish a simulated feature-partitioning design from a deployment involving independently operated sensors.

Each device’s Agent 1 performs this distribution step independently, before handing the resulting feature subset to Agent 2 for preprocessing. This keeps local anomaly detection decentralized: no device needs to see another device’s assigned features, and only Agent 3’s resulting model updates—never raw data—are shared onward.

3.4. Data Preprocessing (Agent 2)

The Modbus network traffic dataset consists of PCAP files converted into CSV files using CICFlowMeter [54]. The dataset comprises 43 CSV files across five categories, containing 576,752 traffic records, each described by 80 statistical features.

First, the original observations are assigned to training, calibration, and test sets using shared observation identifiers. These assignments are retained across all subsequent client partitions to prevent an observation used for training on one client from appearing in another client’s calibration or test set. Next, imputation, encoding, and scaling parameters are estimated exclusively from the training observations and applied unchanged to the calibration and test sets. Where augmentation is required, the WGAN is trained only on the designated training records. Complete synthetic feature vectors are generated and added exclusively to the training set.

Agent 1 then partitions the feature columns across n virtual clients, retaining shared observation identifiers and identical split assignments. Each synthetic vector also retains a shared identifier across its feature partitions. This preserves correspondence between complementary feature subsets of the same real or synthetic observation.

Agent 3 subsequently performs detection-model training and evaluation. Calibration and test observations are excluded from preprocessing fitting, WGAN training, and detection-model optimization. Calibration data are used to determine detection thresholds, while the test set is reserved for final evaluation.

3.4.1. Oversampling Using WGAN

GANs are DL models composed of a generator and a discriminator network. The generator produces synthetic data, while the discriminator attempts to distinguish real data from synthetic data [55]. Through adversarial training, GANs learn to produce realistic, high-quality samples, which makes them effective for tasks such as image generation and data synthesis.

$$\begin{array}{cc}\hfill \underset{G}{\min }\underset{D}{\max }V(D,G)=& {\mathbb{E}}_{x\sim p_{\mathrm{data}}}\left[\log D\left(x\right)\right]\hfill \\ \hfill & +{\mathbb{E}}_{z\sim p_z}\left[\log \left(1-D\left(G\right(z\left)\right)\right)\right].\hfill \end{array}$$

(1)

In Equation (1), G denotes the generator and D the discriminator. The real sample x is drawn from the data distribution $p_{\mathrm{data}}$, while the noise vector z is drawn from the prior distribution $p_z$. The generator maps z to a synthetic sample $G\left(z\right)$. The discriminator estimates whether its input is real. This equation describes the conventional GAN objective; the WGAN used in this study employs a Wasserstein objective instead.

As part of its preprocessing role, Agent 2 adopts the architecture and training setup of a Wasserstein Generative Adversarial Network (WGAN), following the WGAN-DL-IDS framework [20]. The generator network takes a 100-dimensional noise vector as input and consists of fully connected layers with ReLU activation functions; its output layer uses a linear activation to produce feature vectors matching the structure of the original dataset. The discriminator network accepts either real or synthetic data samples as input, and likewise consists of fully connected layers, using ReLU activations in the hidden layers and a linear activation in the output layer to produce a Wasserstein loss score.

Training follows the standard WGAN strategy: the Wasserstein loss function is optimized using the RMSProp algorithm, hidden layers use ReLU activation, and the output layer uses a linear activation, with kernel weights initialized using He normal initialization. The model is trained for 100 epochs, with a training ratio of 99 discriminator updates per generator update, and a batch size of 100.

This architectural design improves training stability and increases the diversity of generated samples, mitigating common GAN issues such as mode collapse.

To confirm that the synthetic data were meaningful rather than artifacts, we applied several validation strategies. t-SNE visualization showed overlapping clusters between real and generated samples, indicating close similarity in feature space; statistical analysis of feature distributions (mean and variance) showed less than 5% deviation between real and synthetic data; classifier performance remained stable or improved when trained on GAN-augmented data; and discriminator accuracy approached 50% in later training epochs, indicating that the generator had converged successfully.

Agent 2 uses GANs to generate synthetic data for the underrepresented MITM class, producing a more balanced dataset. The Scanning class contains 7,140,161 instances, compared with only 1052 instances for the MITM class. If the resulting ratio R falls between 1 and 5000, the distribution is considered balanced; otherwise, further adjustment is required.

$${\displaystyle \frac{N_{\mathrm{majority}}}{N_{\mathrm{minority}}}}={\displaystyle \frac{\mathrm{7,140,161}}{1052}}=7687.22$$

To resolve this class imbalance, we generated 10,000 additional synthetic samples for the minority class:

$${\displaystyle \frac{\mathrm{7,140,161}}{1052+\mathrm{10,000}}}={\displaystyle \frac{\mathrm{7,140,161}}{\mathrm{11,052}}}=646.051$$

3.4.2. Ordinal Encoding

Ordinal encoding is a technique for transforming categorical variables with an inherent order into numerical representations. It assigns integer values (e.g., Scanning Attack = 0, DoS Attack = 1, DDoS Attack = 2, and so on) to each category, reflecting their relative position. This allows for the model to capture the order between categories, unlike one-hot encoding. Figure 2 shows the ordinal encoding workflow performed by Agent 2.

Figure 2. Sequence of Steps and Decisions in the Ordinal Encoding Process.

3.4.3. Normalization

Min–max scaling normalizes features to a specified range, typically $[0,1]$ or $[-1,1]$. Equation (2) rescales feature values using the minimum and maximum values estimated from the training data. This transformation reduces differences in numerical scale between features, helping prevent features with larger ranges from dominating scale-sensitive learning algorithms. The same training-derived scaling parameters are applied to the calibration and test sets without refitting. This is the final preprocessing step performed by Agent 2 before the processed data are passed to Agent 3.

$$X_{\mathrm{normalized}}={\displaystyle \frac{X-X_{\min }}{X_{\max }-X_{\min }}}$$

(2)

3.5. Classification (Agent 3)

Once Agent 2 has preprocessed a device’s feature subset, Agent 3 trains and evaluates the deep autoencoder (DA) and MLP independently for local anomaly detection. Each model uses the preprocessed features directly; neither uses the other model’s output, and their results are reported separately. Agent 3 sends the model parameters to the central server while keeping the underlying data on the device. The server maintains separate aggregation processes for the DA and MLP, combining updates only within the same model type using Federated Averaging (FedAvg) to produce separate global models. These global models are then returned to each device for the next communication round, completing the cycle shown in Figure 1.

3.6. Deep Autoencoder Model Architecture

Autoencoders learn to reconstruct their inputs through an encoded representation [56]. A deep autoencoder (DA) uses multiple layers to learn nonlinear representations of the input data. Unlike standard linear principal component analysis (PCA), a DA can model nonlinear relationships through its activation functions. The work of Meidan et al. [57] motivated the use of reconstruction-based anomaly detection for IoT traffic in this study.

The network architecture is shown in Figure 3. The model is fully connected and symmetric, with four encoder layers and four decoder layers. The final encoder layer forms a single bottleneck. The output dimension equals the input dimension because the model reconstructs the input rather than directly predicting an attack class. The DA is trained exclusively on benign traffic using mean squared reconstruction error.

Figure 3. Architecture of the Proposed Deep Autoencoder (DA).

For input dimension d, the encoder layer widths are $\lfloor 0.75d\rfloor$, $\lfloor 0.50d\rfloor$, $\lfloor 0.33d\rfloor$, and $\lfloor 0.25d\rfloor$. For the implemented $d=80$ configuration, these widths are 60, 40, 26, and 20 neurons. The decoder reverses this progression through layers containing 26, 40, 60, and 80 neurons. These percentages specify layer widths relative to the input dimension, not proportions of the dataset. All encoder and decoder layers use hyperbolic tangent activations.

The multilayer encoding and decoding operations are expressed as follows:

$$\begin{array}{cc}\hfill h^{\left(0\right)}& =x,\hfill \\ \hfill h^{(\ell )}& =\tanh \left(W_{\mathrm{enc}}^{(\ell )}{h}^{(\ell -1)}+b_{\mathrm{enc}}^{(\ell )}\right),\ell =1,\dots ,4,\hfill \\ \hfill z^{\left(0\right)}& =h^{\left(4\right)},\hfill \\ \hfill z^{(\ell )}& =\tanh \left(W_{\mathrm{dec}}^{(\ell )}{z}^{(\ell -1)}+b_{\mathrm{dec}}^{(\ell )}\right),\ell =1,\dots ,4,\hfill \\ \hfill \widehat{x}& =z^{\left(4\right)}.\hfill \end{array}$$

(3)

Here, x is the input vector, $h^{\left(4\right)}$ is the bottleneck representation, and $\widehat{x}$ is the reconstructed input. The matrices $W_{\mathrm{enc}}^{(\ell )}$ and $W_{\mathrm{dec}}^{(\ell )}$ and their corresponding bias vectors are the trainable parameters of each fully connected layer.

$$L(x,\widehat{x})={\displaystyle \frac{1}{d}}{\displaystyle \sum _{j=1}^d}{(x_j-{\widehat{x}}_j)}^2.$$

(4)

The training objective averages this reconstruction loss over the training observations. After training, reconstruction error is used as an anomaly score, following the reconstruction-based detection approach of Meidan et al. [57]. An observation is classified as anomalous when its score exceeds the client-specific threshold described in the classification subsection.

3.7. Multilayer Perceptron Model Architecture

The recommended network design for the MLP is shown in Figure 4. MLPs are trained using backpropagation to optimize the weights and biases, making them suitable for supervised learning tasks such as classification and regression.

$$\begin{array}{cc}\hfill \mathrm{Input}\mathrm{Layer}\text{:}& {\mathbf{a}}^{\left(0\right)}=\mathbf{x}\hfill \\ \hfill \mathrm{Hidden}\mathrm{Layers}\text{:}& {\mathbf{z}}^{\left(l\right)}=\sigma ({\mathbf{W}}^{\left(l\right)}{\mathbf{a}}^{(l-1)}+{\mathbf{b}}^{\left(l\right)})\hfill \\ \hfill \mathrm{Output}\mathrm{Layer}\text{:}& {\mathbf{a}}^{\left(L\right)}=\sigma ({\mathbf{W}}^{\left(L\right)}{\mathbf{a}}^{(L-1)}+{\mathbf{b}}^{\left(L\right)})\hfill \\ \hfill \mathrm{Loss}\mathrm{Function}\text{:}& J(\mathbf{W},\mathbf{b};\mathbf{x},\mathbf{y})={\displaystyle \frac{1}{N}}{\displaystyle \sum _{i=1}^N}\mathcal{L}({\mathbf{y}}_i,{\mathbf{a}}_i^{\left(L\right)})\hfill \end{array}$$

(5)

Figure 4. Architecture of the Proposed Multilayer Perceptron (MLP).

Equation (5) represents the loss function used in the MLP model, where N is the number of samples in the dataset, $y_i$ is the true label of the i-th sample, and ${\widehat{y}}_i$ is the predicted output of the model for the i-th sample. The loss function measures the discrepancy between the true labels and the predicted outputs, and the goal is to minimize this discrepancy during the training process. This loss value serves as a measure of how well the MLP model is performing on the given task, with lower values indicating better performance.

The neural network that comprises the MLP model consists of three linear layers and two activation functions. It receives 80 dimensions as input and returns the same number of dimensions as input. The input is subjected to ReLU activation for nonlinearity as the model traverses successive levels of 64 and 32 dimensions, where it undergoes progressive transformation [58]. The final layer translates the 32-dimensional output into the intended 80-dimensional output using sigmoid activation. The 80 output values represent reconstructed input features rather than attack-class probabilities. For reconstruction $\widehat{x}$ of input x, the anomaly score is

$$s\left(x\right)={\displaystyle \frac{1}{80}}{\displaystyle \sum _{j=1}^{80}}{(x_j-{\widehat{x}}_j)}^2.$$

An observation is classified as an attack when $s\left(x\right)>\tau$ and as normal otherwise, where $\tau$ is determined using benign calibration observations. Throughout this mapping procedure, values are constrained to be between 0 and 1. The purpose of the model is to identify data patterns in order to improve the accuracy of operations such as binary classification and probability estimation.

3.8. Threat Model and Privacy Assumptions

The proposed FL framework takes into account the fact that the raw IoT data produced by the devices participating in the FL are sensitive and should not be shared directly with the central server or other participating clients. Hence, the architecture is based on data locality, keeping raw data on the devices, and local feature representations on the devices. Updates are only sent to the central server from the model updates created during the local training. The honest-but-curious central server is the main adversary in the threat model. The server implements the FL protocol as described, but may make educated guesses about the sensitive information transmitted in the model updates. A participating client can also try to get information about other clients’ data. The server and the client(s) involved, however, are presumed not to have direct access to the raw datasets stored on other devices.

The proposed framework’s privacy goal is to ensure that raw IoT data and locally computed features are kept on the participating devices to reduce direct exposure of raw IoT data and locally computed feature information. The utilization of VFL also reduces the possibility of direct sharing of feature subsets between the participating clients. But the information in the models may include local training data. Thus, the proposed framework does not provide 100% protection from sophisticated model-inversion, membership-inference, malicious-client, and fully compromised-server attacks. Various other privacy-enhancing mechanisms (e.g., differential privacy, secure aggregation, and cryptographic techniques) would be needed to prevent such attacks, and these would not be addressed in this study.

3.9. Method for Detecting Anomalies via FL

We combine FL with the DA model so that each device’s Agent 3 can identify anomalous traffic without centralizing raw data, letting the DA model be trained across multiple devices while keeping their data private. This removes the need to store or exchange sensitive information centrally, reducing the risk of a data breach. Data preprocessing on every device is handled by Agent 2 in the same way described for local detection, and federated training then begins simultaneously across devices: each device’s Agent 3 trains its DA model locally, sends the resulting weights to a central server, and the server aggregates them (e.g., via FedAvg) before returning the updated global weights to every device’s Agent 3 for the next round of local training.

Each communication round in FL consists of two key steps: forward processing, in which each device sends its local weights to the global server for aggregation, and backpropagation, in which each device updates its local model using the newly aggregated global weights. Model performance generally improves as the number of communication rounds increases. A partial-client-selection mechanism is also built into the federated architecture to improve efficiency and robustness, meaning only a subset of devices participate in training during any given communication round. Once training is complete, the resulting federated model can automatically perform anomaly detection on both existing devices and any new devices added to the network.

3.10. Federated Averaging

Federated optimization is built on stochastic gradient descent (SGD). Three properties are central to this approach:

• In its simplest form, federated optimization performs a single batch gradient computation per communication round.
• This computation must be fast enough to support frequent rounds.
• A large number of training iterations are typically needed to produce an accurate model.

At the start of each iteration, the FL method selects a subset of devices—a fraction N of the total client population—and computes the gradient of the loss via backpropagation on each selected device’s local model (LM). In the most common configuration of FedSGD, the learning rate is set to $\eta =1$ and the client fraction to $N=1$, so that each device k computes its update independently as follows:

$$w_{t+1}\leftarrow w_t-\eta {\displaystyle \sum _{k=1}^K}{\displaystyle \frac{n_k}{n}}{g}_k$$

(6)

The server then averages the resulting models after each device applies the current global model’s gradient to its own local data. Additional computation can be assigned to each device by repeating this local update step before the averaging phase:

$$w^k\leftarrow w^k-\eta \nabla F_k\left(w^k\right)$$

(7)

This is precisely what defines Federated Averaging (FedAvg): extra local computation is performed on each device by iterating the local update multiple times before the resulting models are averaged at the server. From a statistical standpoint, FedAvg has been empirically shown to diverge when data is not identically distributed across IoT devices, which is one of the core problems our VFL-based design is intended to address. The full procedure is given in Algorithm 1: the dataset is divided into N subsets, one per edge node; each edge node trains and updates its local model for E epochs on its own subset; the resulting local updates are combined to refresh the global model; and this process repeats for T communication rounds, after which the final global model is used for attack detection.

Algorithm 1 Scalable Federated Algorithm

Input: Server do Initialize global model parameters $w_g$. Divide the dataset into N disjoint subsets. for $t=1$ to T do    for each edge node i do      Initialize local model parameters: $w_i=w_g$.      Train the local model on the local dataset for E epochs: $$w_i\leftarrow w_i-\eta \nabla L(w_i,D_i)$$      where $\eta$ is the learning rate and $\nabla L(w_i,D_i)$ is the gradient of the loss function L      with respect to the local model parameters $w_i$ on the local dataset $D_i$.      Compute the local model update: $\mathrm{\Delta }{w}_i=w_i-w_g$      Aggregate the parameters: $w_g\leftarrow w_g+{\displaystyle \frac{1}{N}}\sum \mathrm{\Delta }{w}_i$    end for    Update the global model to predict attack detection: $$w_g(t+1)\leftarrow w_g\left(t\right)+{\displaystyle \frac{1}{N}}\sum \mathrm{\Delta }{w}_i$$ end for

3.11. Modbus ICS Dataset

The Modbus ICS dataset [25] was made because Modbus/TCP was used to automate small-scale processes in a supervisory control and data acquisition (SCADA) system. Based on the liquid’s temperature, a set of criteria determines the motor’s speed. The Modbus Remote Terminal Unit (RTU) simulates a temperature reading with the help of an Arduino and a potentiometer. Both the PLC and the RTU can exchange information horizontally. Tcpdump captures traffic to a PCAP file. Attack Initiation and Production: The primary device will intermittently send out bogus ARP packets. After an adjustable delay, the second thread sends each packet in the queue. When the main thread is done processing the packets, it places them in the queue. The following types of attacks have been used in the dataset: TCP SYN flooding, ping DDoS flood attack, Modbus query flooding, and MITM. These network attacks are summarized below.

• TCP SYN Flooding: It is when an attacker sends many fake requests to a server, causing it to become overwhelmed and unable to respond to real requests. This can cause the server to crash or become unavailable to regular users.
• Ping DDoS Flood Attack: It is when a large number of requests are sent to a website or network at the same time, causing it to crash and become unavailable to regular users. This is done by flooding the target with ping requests, overwhelming its resources.
• Modbus Query Flooding: It is a type of cyberattack in which an attacker sends a large number of Modbus protocol queries to a targeted device, overwhelming its resources and causing it to become unresponsive. This attack can lead to a denial of service (DoS) and disrupt the normal functioning of the device.
• Man-in-the-Middle Attack: It is a sort of cyberattack in which a third party intercepts communication between two parties and can eavesdrop, edit, or manipulate the message to their advantage. It can be used to steal important information or passwords, or to inject malicious content into the communication stream.

3.12. ToN-IoT Dataset

The ToN-IoT dataset [59] was developed to include both normal and malicious activities. Legitimate operations of synchronized and middleware servers were utilized to generate typical scenarios. These scenarios encompassed telemetry data publishing and subscription, network traffic generation, and the provision of FTP, HTTP, and DNS services. There are nine categories of hacking scenarios that target vulnerable IoT and industrial IoT components, and they are described in Table 3.

Table 3. Description of Attacks in the Dataset.

Attack Type	Description	No. of Instances
Scanning Attack	Tools such as Nessus and Nmap identify active IP addresses and open ports in a network to detect compromised systems.	7,140,161
Denial-of-Service (DoS) Attack	IoT and IIoT networks are flooded with excessive traffic or fake requests, overwhelming the target and disrupting normal services.	2,405,330
Distributed Denial-of-Service (DDoS) Attack	Multiple malware-infected systems form a botnet to overwhelm a target with traffic, commonly launched using Python or Bash scripts.	5,497,110
Ransomware Attack	Data and services are encrypted, and attackers demand payment for recovery. Metasploit is commonly used to execute these attacks.	72,805
Backdoor Attack	Hidden access points allow attackers to maintain persistence, steal information, deploy malware, or remotely control compromised devices.	508,116
Injection Attack	Malicious commands or data are injected into applications by exploiting vulnerabilities such as SQL or PHP injection.	452,659
Password Cracking Attack	Brute-force and dictionary attacks are used to guess passwords of operating systems and IoT devices.	1,365,958
Cross-Site Scripting (XSS) Attack	Malicious scripts are injected into trusted web pages to execute unauthorized code in users’ browsers.	3,108,944
Man-in-the-Middle (MITM) Attack	Attackers intercept and manipulate communications between users and applications using tools such as Ettercap.	1052

3.13. Resources

The experiments were conducted in Punjab, Pakistan, using Python 3.7.6 within an Anaconda environment. NumPy [60] and pandas [61] were used for data manipulation. Scikit-learn [62] was used for preprocessing and computing evaluation metrics, while PyTorch was used to implement the local and federated models. The experimental configuration included NVIDIA CUDA 11.6. The hardware specifications are summarized in Table 4.

Table 4. Hardware Resources.

Hardware	Configuration
CPU	Intel Core i5-10300H, 2.50 GHz
GPU	NVIDIA GeForce GTX 1650
Storage (SSD)	40 GB
RAM	8 GB

3.14. Classification Performance

In this analysis, different metrics like accuracy, F1 score, true positive rate (TPR), and precision were used to measure how well the suggested algorithm trained anomaly detection models. The dataset was divided into two parts: a training set with 80% of the data and a testing set with 20% of the data. Metrics such as false positives (FP), true positives (TP), false negatives (FN), true negatives (TN), TPR, and true negative rate (TNR) were used to evaluate the algorithm’s effectiveness. These measures were used to compare and evaluate various strategies for detecting anomalies.

Accuracy: It is a statistic that indicates how accurately a classification or prediction model predicts the target variable.

$$Acc={\displaystyle \frac{TP+TN}{TP+TN+FP+FN}}$$

(8)

Precision: It is a metric that calculates the proportion of accurately anticipated positive instances among all positive instances.

$$Pr={\displaystyle \frac{TP}{TP+FP}}$$

(9)

Recall: It is a metric that calculates the proportion of accurately predicted positive events among all positive events.

$$Rc={\displaystyle \frac{TP}{TP+FN}}$$

(10)

F1 Score: Binary classification models are evaluated using the harmonic mean of precision and recall.

$$F1={\displaystyle \frac{2\ast TP}{2\ast TP+FP+FN}}$$

(11)

TPR: It is also known as sensitivity since it estimates the percentage of correctly predicted positive events among all actual positive instances.

$$TPR={\displaystyle \frac{TP}{TP+FN}}$$

(12)

FPR: It is the proportion of negative events that are wrongly labeled as positive by a classification model.

$$FPR={\displaystyle \frac{FP}{FP+TN}}$$

(13)

Training Time: When estimating how long it will take to complete a training round in FL, we consider not only the time required to complete the training itself, but also the time spent communicating with each FL LM. The formula for the computations is as follows:

$$TrainingTime=N_{iter}\times t_{iter}$$

(14)

Each row in Table 5 needs a different set of changes to the parameters of the experiment and different ways to do the experiment itself.

Table 5. Experimental Parameters.

Parameter	Value	Meaning
Learning Rate (LR)	0.001	Learning rate used for training the deep autoencoder (DA).
Batch Size	32, 128	Number of samples processed in each training iteration.
Epochs	150	Number of training epochs for each local classifier (Agent 3).
Activation Function	Tanh(), Softmax()	Activation functions used in the DL model.
Communication Rounds	50	Number of communication rounds required to train the global federated model.

3.15. Ablation Study

Table 6 presents the reported component comparisons for the Modbus ICS and ToN-IoT datasets. The analysis considers WGAN-based augmentation and the choice of detection architecture. For ToN-IoT, the reported DA accuracy decreases from 99.62% to 98.50% when WGAN is removed, corresponding to a difference of 1.12 percentage points. The Modbus ICS full-model and without-WGAN rows have identical settings and accuracy; therefore, these entries do not provide a separate estimate of the contribution of WGAN.

Table 6. Ablation Study of the Proposed Framework with HFL Comparison.

Dataset	Model	WGAN	VFL	HFL	Agents	Algorithm	Accuracy
Modbus ICS	Full Model	×	✔	×	✔	DA	99.56%
Modbus ICS	Without WGAN	×	✔	×	✔	DA	99.56%
Modbus ICS	Without VFL	×	×	✔	✔	DA	92.25%
Modbus ICS	MLP Model	✔	✔	×	✔	MLP	98.89%
ToN-IoT	Full Model	✔	✔	×	✔	DA	99.62%
ToN-IoT	Without WGAN	×	✔	×	✔	DA	98.50%
ToN-IoT	Without VFL	✔	×	✔	✔	DA	98.77%
ToN-IoT	MLP Model	✔	✔	×	✔	MLP	99.39%

✔: component included; ×: component excluded.

The reported DA accuracies are 99.56% and 99.62% for Modbus ICS and ToN-IoT, respectively, compared with 98.89% and 99.39% for the MLP. These correspond to differences of 0.67 and 0.23 percentage points. The results describe the performance of the two detection alternatives under the reported configurations.

Table 6 reports performance for the listed configurations. A difference can be attributed to an individual component only when the remaining experimental settings are held constant. In particular, the Modbus ICS DA and MLP configurations differ in both detection architecture and WGAN usage; their accuracy difference therefore cannot be attributed solely to model choice. The identical Modbus ICS full-model and without-WGAN entries represent the same component configuration.

3.16. Results and Discussion

Training and evaluation were carried out using the scikit-learn Python package [62]. In our multi-agent formulation, each device’s three agents run in sequence: Agent 1 distributes the device’s local data according to the vertical FL partitioning scheme, Agent 2 preprocesses it, and Agent 3 trains the DA and MLP classifiers on the resulting features before Agent 3’s model update is shared in the federated exchange, without ever sharing raw traffic. The deep autoencoder (DA) and MLP classifiers trained by Agent 3 achieved their best results on Device 3, reaching 99.99% and 99.89% accuracy respectively. Averaged across all devices, the two models achieved 99.56% and 98.89% accuracy, with a training time of 0.834 min (50 s), based on the confusion matrix results obtained after 50 communication rounds, as shown in Figure 5.

Figure 5. Tracking the Convergence of Global Loss in the Model.

On the ToN-IoT dataset, Agent 3’s MLP classifier shows strong precision, recall, and F1 score, combining accurate positive predictions with effective capture of positive instances, and reaching an average accuracy of 99.39%. Agent 3’s DA model performs comparably well on the same dataset, with high precision, recall, and F1 score, and notably fewer false positives, giving an average accuracy of 99.62%. Each training round randomly selects a subset of devices; on each selected device, Agent 1 distributes the local data, Agent 2 preprocesses the resulting features, and Agent 3 trains its classifier independently before the client-level and global loss are computed. Table 7 summarizes the average accuracy and training time of the proposed algorithms.

Table 7. Average Accuracy and Training Time of the Proposed Algorithms.

Dataset	Algorithm	Average Accuracy	Training Time
Modbus ICS	MLP	98.89%	2.12 min
	DAs	99.56%	0.834 min
ToN-IoT	MLP	99.39%	3.14 min
	DAs	99.62%	2.01 min

Figure 6 and Figure 7 present accuracy, precision, recall, FPR, TPR, and F1 score for both classifier types across the different devices. On every device, Agent 3’s DA and MLP classifiers both achieve high precision, with the DA classifier showing an edge in recall and F1 score and the MLP classifier holding a more consistent precision. TPR is high across all devices, though FPR varies somewhat by device type. Overall, both classifiers show strong potential within the FL setting, with the DA classifier slightly ahead on recall and F1 score; the consistent data distribution that Agent 1 enforces across devices via VFL likely contributes to how stable these metrics are for both classifier types.

Figure 6. Evaluation Of Metrics across Devices Using a Multilayer Perceptron.

Figure 7. Evaluation of Metrics across Devices Using Deep Autoencoders.

As Figure 8 shows, Device 3 achieved the highest accuracy and Device 1 the lowest, for both the MLP and DA classifiers trained by Agent 3. Table 7 reports training times for the evaluated DA and MLP configurations. These measurements characterize the present experimental setup and do not establish lower computational complexity than GRU- or CNN-based methods evaluated under different hardware and training conditions.

Figure 8. Testing Accuracy of Different Devices.

The architecture’s focus on reducing dimensionality and representing data compactly is what drives this efficiency, making DAs a strong choice for Agent 3 to run on resource-constrained devices whenever input sizes vary and the data itself is non-sequential.

Table 8 shows an in-depth comparison between the proposed methodology and representative federated learning-based intrusion detection methods. Compared studies have various data distribution strategies, learning architectures, datasets, and underlying assumptions. In Modbus ICS data, Mothukuri et al. [46] assume that the clients have different samples in the same feature space and use GRU with FedAvg in an HFL setting. Likewise, Ferrag et al. [63] employ CNN/RNN models that use FedAvg and HFL on several IoT datasets. These methods have privacy benefits in that they do not involve direct sharing of raw data but do not tackle feature-wise data distribution or autonomous decision-making.

Table 8. Comparison with Previous Studies.

Ref.	Year	Dataset	FL/DL Classifier	Agent	Data Distribution	Numerical-to-Categorical Conversion	Accuracy
[46]	2021	Modbus ICS	GRU, FedAvg	×	HFL	One-Hot Encoding	90.25%
[63]	2021	ToN-IoT, Bot-IoT, MQTTset	CNN, RNN, FedAvg	×	HFL	Label Encoding	98.87%
[64]	2024	ToN-IoT	DNN, Blockchain, FedAvg	×	HFL	Not Specified	98.21%
Proposed Methodology	–	Modbus ICS, ToN-IoT	DAs, MLP, FedAvg	✔	VFL	Ordinal Encoding	99.56%, 99.62%

✔: component included; ×: component excluded.

In the context of IoT IDS, Begum et al. [64] propose a new approach called blockchain-assisted federated learning. Although blockchain can offer more integrity and coordination capabilities, its implementation can also result in increased communication and computation costs. The proposed methodology, on the other hand, uses VFL in which complementary feature subsets are distributed among participating clients. This is more appropriate for a heterogeneous IoT environment where the devices or participants may have different feature information for the same traffic instances.

The results of the evaluations should also be considered in the context of the various datasets and experimental conditions and not just on the basis of accuracy values. The present evaluation concerns attack detection. It does not demonstrate autonomous attack prevention or mitigation. Comparisons with previous studies provide methodological context rather than evidence of superiority under matched experimental conditions. The independent benefit of agent orchestration also requires a controlled comparison. The proposed approach is evaluated on the datasets and the accuracy is 99.56% and 99.62% respectively. But it is not a sure sign of better performance—the experimental conditions are different across the studies. The main difference is that the proposed approach integrates VFL-based feature distribution, local preprocessing, class-imbalance handling, and agentic AI capabilities into a single framework, whereas the compared approaches are mostly federated intrusion detection with no autonomous attack mitigation.

4. Conclusions and Future Work

We present an FL-based anomaly detection system for reliable threat identification in IoT networks. Rather than treating each device as a single monolithic learner, our approach decomposes every device’s local workload across three cooperating agents—Agent 2 for data preprocessing, Agent 1 for data distribution, and Agent 3 for classification—which strengthens the implementation of FL while keeping each agent’s task simple and independently verifiable. Agent 3 uses multiple layers of autoencoders (AEs) to achieve high accuracy in attack classification, building on the consistently distributed data that Agent 1 provides through VFL. The privacy-preserving nature of FL adds a critical layer of security throughout this pipeline, since only Agent 3’s model updates never raw data ever leave a device, increasing the overall reliability of IoT networks. Compared with HFL-based intrusion detection systems, our method delivers superior performance, achieving an average accuracy of 99.56% on the Modbus ICS dataset and 99.62% on the ToN-IoT dataset.

In future work, we plan to test our method on real IoT devices instead of only simulated data, so we can see how well it detects both known and new types of attacks in practice. We also want to make the agent setup more flexible: instead of every device always running all three agents (Agents 1, 2, and 3), a device could run fewer agents, or lighter versions of them, depending on how much processing power and battery it has left. Another goal is to let Agent 3 do more than just detect attacks; once it flags something suspicious, it should be able to respond automatically, for example, by blocking the bad traffic, isolating the affected device, or cutting its network access, instead of waiting for a person to act. Beyond this, we plan to test Agent 1’s data-splitting approach on more complicated, uneven setups, check how well the system holds up if one agent is hacked or sends bad updates, and see how the whole framework performs as we add many more devices than we tested here.