A Three-Stage Federated Distillation Framework for Robust Intrusion Detection in Heterogeneous IoT/Edge Networks

Abstract

Internet of Things(IoT)/edge intrusion-detection systems operate on distributed traffic and system-state data whose distributions vary across gateways, services, and attack conditions. We study a server-assisted federated setting in which a teacher reference is fitted from a permitted server-accessible training pool and explicitly distinguish this simulation assumption from fully decentralized deployment. The proposed framework evaluates progressive local training through boundary stabilization, confidence-weighted decision distillation, representation alignment, and validation-quality-aware aggregation. The evaluation uses a leakage-controlled protocol: server and client validation subsets are held out before federated training, update quality and early stopping use validation data only, and the final-test split is evaluated once. Results on NSL-KDD, CIC-IDS2017, Edge-IIoTset, and the ToN-IoT network dataset show competitive primary performance and stronger robustness in several severe label-skew settings. On the Telemetry of Things(ToN-IoT) with Dirichlet alpha = 0.1, the proposed method achieves 91.46 ± 5.54 F1, compared with 53.73 ± 49.00 for FedAvg and 53.77 ± 48.92 for FedProx. The results do not establish universal superiority or a universally optimal stage order: competing methods remain stronger in selected stable and attack-shift settings. The framework is therefore presented as a bounded, server-assisted robustness-oriented training strategy for heterogeneous IoT/edge intrusion detection.

1. Introduction

Internet of Things (IoT) and edge networks are increasingly deployed in smart cities, industrial monitoring, healthcare, transportation, and autonomous systems. These environments are usually composed of distributed sensing devices, edge gateways, communication links, and cloud-assisted services. While such infrastructures improve real-time perception and decision making, they also generate large volumes of heterogeneous traffic and system-state data. Abnormal behaviors caused by cyberattacks, device faults, misconfigurations, or malicious access may propagate through edge gateways and affect the reliability of the entire system. Therefore, robust anomaly detection has become a fundamental component of secure IoT and edge intelligence [1,2,3,4,5,6,7].

However, anomaly detection in distributed IoT/edge networks faces a significant non-IID robustness challenge. Data collected by different gateways or device groups are often non-independent and identically distributed because they may differ in device type, protocol configuration, user behavior, deployment environment, traffic pattern, and anomaly ratio. A detector trained on one edge client may perform well locally but become unstable when aggregated with clients that observe different feature statistics or attack distributions. This problem is particularly serious when anomalous samples are rare because local models can easily learn biased decision boundaries dominated by majority normal traffic. As a result, this paper focuses on robustness under heterogeneous edge-client data rather than claiming broad real-domain transfer from label-skew simulations alone [2,3,8,9].

Federated learning (FL) provides a promising solution for distributed anomaly detection because it enables multiple edge clients to collaboratively train a global model without sharing raw traffic or system-state data. Classical methods such as FedAvg reduce communication cost by averaging local model parameters, while FedProx improves optimization stability by constraining local model drift [8,10]. Nevertheless, standard parameter-level aggregation is insufficient when client distributions are strongly heterogeneous. Different edge clients may produce inconsistent gradients, biased local classifiers, and unstable feature representations. In such cases, simple aggregation may amplify unreliable updates and degrade the global detector, especially under severe non-IID partitions [9,11,12].

Knowledge distillation offers an additional way to transfer decision and representation information across heterogeneous clients. Teacher soft labels can provide decision-level class-relation information, and feature-level distillation can encourage intermediate representations to become more consistent across clients [13,14,15]. These properties are useful for federated IoT intrusion detection, where hard labels and local empirical risks may be highly biased [16,17,18,19]. However, directly applying distillation throughout the whole local training process may introduce optimization conflicts. If strong distillation constraints are imposed too early, the student model may not establish a stable local decision boundary. If representation alignment is applied too late, client-specific bias may already have been embedded into the model. Therefore, a key question is how to schedule bias suppression, decision transfer, and representation alignment in a progressive and stable manner.

To address these issues, this paper studies a three-stage server-assisted federated distillation framework for robust intrusion detection in heterogeneous IoT/edge security networks. Rather than treating all distillation losses as a single uniform objective, the framework evaluates a progressive local-training protocol that separates boundary stabilization, teacher-guided decision transfer, and representation alignment. The substantive contribution is not a claim that these ingredients are individually new, nor that one fixed order is universally optimal. Instead, the contribution is an experimentally specified protocol that makes their timing, validation-based quality weighting, teacher assumption, and failure boundaries explicit under the same backbone and client partitions as direct FL, prototype, contrastive, and distillation baselines.

The evaluation uses NSL-KDD, CIC-IDS2017, Edge-IIoTset, and ToN-IoT. It covers balanced partitions, Dirichlet label skew, no-teacher and budget-matched controls, aggregation and schedule controls, and leave-one-attack testing. All results follow a leakage-controlled selection protocol with held-out server and local validation partitions. The empirical aim is deliberately bounded: to identify conditions under which the proposed server-assisted protocol is competitive or more stable, not to claim uniform superiority across data distributions or attack types.

The main contributions of this paper are summarized as follows:

(1)

We formulate and evaluate a progressive within-round training protocol that makes the timing of boundary stabilization, decision distillation, and representation alignment explicit. The contribution is a reproducible protocol-level comparison against joint and alternative schedules, rather than a claim that any individual loss term is new or that the default order is universally optimal.

(2)

We specify a server-assisted teacher mechanism that transfers confidence-weighted soft targets and intermediate features, while explicitly disclosing its data-access assumption. The teacher is fitted from a server-accessible pool constructed from client-training subsets in the experimental simulation; the paper therefore distinguishes this setting from fully decentralized federated learning and reports no-teacher and budget-matched controls.

(3)

We introduce validation-quality-aware aggregation based on post-training F1 from held-out local validation subsets. Final-test data are excluded from quality scoring, early stopping, checkpoint selection, and teacher fitting. This design directly tests whether update reliability can complement sample-size weighting under severe label skew.

(4)

We provide a leakage-controlled robustness evaluation across NSL-KDD, CIC-IDS2017, Edge-IIoTset, and ToN-IoT, including FedAvg, FedProx, FedBN, FedAdam, SCAFFOLD, MOON, FedProto, FLKD, and an FD-IDS-style surrogate. Five-seed severe-skew controls, schedule and aggregation analyses, server-assistance controls, and attack-type holdouts support a bounded conclusion: the method is competitive in stable settings and can be more robust in selected strong-heterogeneity settings, while several baselines remain preferable in other conditions.

The remainder of this paper is organized as follows. Section 2 reviews related work on IoT/edge anomaly detection, federated learning under non-IID data, and distillation-based representation alignment. Section 3 presents the proposed three-stage federated distillation framework. Section 4 reports the experimental results, ablation studies, and efficiency analysis. Section 5 discusses the findings, limitations, and deployment implications. Section 6 concludes the paper.

2. Related Work

2.1. Anomaly Detection in IoT/Edge Security Networks

IoT and edge networks have become important infrastructures for smart cities, industrial monitoring, healthcare, transportation, and autonomous systems. These networks usually consist of distributed sensing devices, edge gateways, communication links, and cloud-assisted services. During operation, they continuously generate network traffic, protocol-level records, and system-state features. Abnormal behaviors caused by cyberattacks, device faults, misconfigurations, or malicious access may affect the reliability and security of the entire IoT/edge system. Therefore, anomaly detection has become a key task for secure edge intelligence [1,2,3].

Traditional intrusion-detection and anomaly-detection methods can achieve promising performances when training and testing data follow similar distributions. However, real IoT/edge environments are usually heterogeneous. Different gateways may differ in device type, communication protocol, traffic pattern, deployment environment, and anomaly ratio. As a result, the detector trained in one domain may not generalize well to another domain. This issue is particularly important in security-oriented IoT scenarios because anomalous samples are usually rare and class distributions are highly imbalanced. Under such conditions, local models may easily form biased decision boundaries dominated by majority normal traffic [2,3,20,21].

Existing IoT security datasets, such as NSL-KDD, CIC-IDS2017, Edge-IIoTset, BoT-IoT, ToN-IoT, and N-BaIoT, provide useful benchmarks for evaluating anomaly detection under different traffic and attack conditions [4,5,6,7,22,23]. Among them, Edge-IIoTset is especially relevant to IoT/IIoT edge-security research because it contains heterogeneous sensors, protocols, edge/cloud configurations, and multiple attack categories [4]. However, these benchmarks also reveal a practical challenge: anomaly detectors should not only fit a single local data distribution but also remain robust when deployed across heterogeneous edge domains. This motivates the use of federated and robustness-oriented learning strategies for distributed IoT/edge anomaly detection.

2.2. Federated Learning Under Non-IID Edge Data

Federated learning provides a natural solution for distributed IoT/edge anomaly detection because it enables multiple clients to collaboratively train a global model without sharing raw data. FedAvg is the most widely used baseline, which reduces communication cost by averaging local model parameters [10]. FedProx further improves optimization stability by adding a proximal regularization term to restrict local models from drifting too far away from the global model [8]. These methods are simple and effective under moderately heterogeneous settings, and they have been widely used as basic baselines in federated intrusion-detection studies [1,16,24,25,26].

Nevertheless, standard federated optimization does not fully solve the non-IID problem. In IoT/edge security networks, different clients may observe different normal behaviors, attack categories, feature distributions, and class proportions. These differences can cause client drift, inconsistent gradients, and unstable global aggregation. FedBN shows that local normalization statistics can be an important source of heterogeneity and proposes to keep batch-normalization parameters local [9]. SCAFFOLD reduces client drift through control variates, and adaptive federated optimization methods improve server-side update stability [11,12]. These studies demonstrate that non-IID learning is a central problem in federated systems.

However, most parameter-stabilization methods mainly focus on optimization consistency rather than decision-level and representation-level generalization. When local clients have different anomaly ratios or traffic patterns, their classifiers may learn domain-specific decision boundaries. Directly averaging such models may weaken cross-domain robustness. Therefore, heterogeneous IoT/edge anomaly detection requires mechanisms that can coordinate not only model parameters but also decision distributions and intermediate representations.

2.3. Federated Distillation and Representation Alignment

Knowledge distillation transfers knowledge from a teacher model to a student model by using soft labels, intermediate representations, or relational information [13,14,15]. Compared with hard labels, teacher soft labels can provide richer class-relation information and reduce overfitting to local biased labels. Feature-level distillation can further encourage different models to learn more consistent intermediate representations. These properties make distillation attractive for federated learning under heterogeneous edge data.

Recent federated distillation studies have explored different forms of knowledge transfer, including output-level distillation, ensemble distillation, prototype-based transfer, contrastive representation learning, and model-contrastive learning [16,17,18,19]. These studies motivate the need to compare the proposed method not only with FedAvg and FedProx but also with non-IID-oriented baselines such as FedBN, SCAFFOLD, adaptive federated optimization, and MOON. In intrusion-detection scenarios, such baselines test different failure modes: feature-statistics shift, client drift, server-side optimization instability, and representation inconsistency.

Despite these advantages, existing distillation-based federated methods still face two limitations. First, many methods apply distillation as a uniform loss throughout local training. This may be suboptimal under strong non-IID conditions because early local training often suffers from unstable decision boundaries and local class imbalance. If strong distillation is imposed too early, the student model may receive unreliable guidance before forming a stable local representation. Second, output-level distillation alone may not sufficiently handle feature-distribution mismatch among heterogeneous edge domains. Therefore, a more progressive mechanism is needed to determine when to stabilize decision boundaries, when to transfer teacher decisions, and when to align intermediate representations.

2.4. Quality-Aware Aggregation in Heterogeneous Federated Learning

Another important issue in heterogeneous federated learning is how to aggregate local updates. Standard FedAvg uses sample-size-based weighting, assuming that clients with more data should contribute more to the global model [10]. However, in IoT/edge anomaly detection, a client with more samples is not necessarily more reliable. For example, a gateway may contain highly imbalanced data, noisy labels, domain-specific traffic, or unstable anomaly distributions. In such cases, sample-size-based aggregation may amplify low-quality local updates.

Several studies have attempted to improve server-side aggregation by considering optimization stability, adaptive learning rates, or client drift correction [11,12]. However, fewer works explicitly consider the quality of local anomaly-detection updates under strong non-IID security data. In anomaly detection, local performance indicators such as F1-score are useful because they jointly reflect precision and recall, especially when anomalous samples are imbalanced. Therefore, quality-aware aggregation can reduce the influence of unreliable clients and improve global robustness.

In this study, quality-aware aggregation is introduced to complement staged distillation. Instead of relying only on the number of local samples, the server assigns aggregation weights according to local update quality. This design is particularly suitable for heterogeneous IoT/edge security networks, where different clients may have significantly different anomaly distributions and training stability.

2.5. Research Gap and Motivation

Existing studies provide important foundations for federated IoT/edge anomaly detection, but several gaps remain. First, standard FL methods such as FedAvg and FedProx mainly stabilize parameter aggregation, but they do not explicitly address biased decision boundaries caused by local class imbalance and domain shift. Second, existing FL-KD methods often use a single-stage or uniform distillation strategy, which may introduce optimization conflicts when local decision boundaries are still unstable. Third, output-level distillation alone is insufficient to reduce representation mismatch among heterogeneous edge clients. Fourth, conventional sample-size-based aggregation may be unreliable when some clients produce unstable or biased updates.

To address these limitations, this paper proposes a three-stage federated distillation framework for robust anomaly detection in heterogeneous IoT/edge security networks. The framework progressively organizes local training into boundary stabilization, teacher-guided decision distillation, and representation alignment. This design first suppresses local boundary bias, then transfers decision-level teacher knowledge, and finally aligns intermediate representations after the local model becomes more stable. In addition, a quality-aware aggregation rule is used to reduce the influence of unreliable local updates. Compared with existing FL-KD intrusion-detection methods, the proposed framework emphasizes three underexplored aspects at the same time: the timing of distillation within a communication round, the hierarchy of decision- and feature-level transfer, and the reliability of client aggregation under strong non-IID updates. The stage order is an empirically motivated protocol whose role is assessed through the schedule-control experiments; it is not derived from a convergence theorem and is not claimed to be theoretically optimal.

3. Materials and Methods

3.1. Problem Formulation

Consider a federated IoT/edge intrusion-detection network with $K$ edge clients, where each client represents an edge client group, device group, or edge gateway. Client $k$ owns a local dataset $D_k=\left\{\left(x_{k,i},y_{k,i}\right)\right|i=\mathrm{1,2},\dots ,n_k\}$, where $x_{k,i}$ denotes the i-th traffic or system-state feature vector, $y_{k,i}$ is the corresponding binary label, and $n_k$ is the number of local samples. The total number of training samples is $N={\sum }_{k=1}^K{n}_k$. Let ${\theta }^t$ denote the global model maintained by the server at round $t$ and ${{\theta }_k}^t$ denote the local model on client $k$. Standard FL minimizes a weighted sum of local empirical risks.

In this study, the target IoT/edge network context specifically refers to security-oriented network traffic records and system-state monitoring vectors, distinguishing it from physical-layer wireless sensing signals such as Wi-Fi CSI, RFID, UWB, or radar.

$${\mathrm{m}\mathrm{i}\mathrm{n}}_{\theta }F\left(\theta \right)={\sum }_{k=1}^K\left({\displaystyle \frac{n_k}{N}}\right)F_k\left(\theta \right).$$

(1)

The local empirical risk on client k is defined as

$$F_k\left(\theta \right)=\left({\displaystyle \frac{1}{n_k}}\right){\sum }_{i=1}^{n_k}\mathsf{\ell }\left(f_{\theta }\left(x_{k,i}\right),y_{k,i}\right),$$

(2)

where $f_{\theta }$ (·) denotes the anomaly detector and ℓ(·) is the supervised classification loss. In heterogeneous IoT/edge intrusion-detection networks, local clients may differ in device configuration, protocol usage, traffic behavior, and anomaly distribution. Directly optimizing Equation (1) can therefore suffer from client drift and unstable non-IID aggregation. The proposed framework keeps the same FL interface but replaces the single local objective with three progressive stages designed for robustness-oriented training.

3.2. Base Detector and Preprocessing

The base anomaly detector is implemented as a multilayer perceptron. For a preprocessed input feature vector $x\in R^d$, the student model and the global model use three fully connected feature blocks followed by a binary classification layer. The overall network structure is $d\to 512\to 256\to 128\to 2$. Each feature block consists of a linear layer, batch normalization, ReLU activation, and dropout with a dropout rate of 0.2. The final classifier maps the 128-dimensional representation to two logits corresponding to normal and anomalous traffic. Therefore, the task is formulated as binary network anomaly detection rather than fine-grained multiclass attack classification.

The intermediate representations extracted from the three feature blocks are denoted as $h_1\in R^{512}$, $h_2\in R^{256}$, and $h_3\in R^{128}$. These hierarchical representations are used for feature-level distillation and representation alignment in the third training stage.

The experiments use NSL-KDD, CIC-IDS2017, Edge-IIoTset, and ToN-IoT as security-oriented intrusion-detection benchmarks. They evaluate network or edge-gateway traffic and system-state records, not physical-layer wireless sensing signals such as Wi-Fi CSI, UWB, RFID, or millimeter-wave radar. The ToN-IoT network telemetry data add a newer IoT/IIoT-oriented benchmark with heterogeneous network services and attack traffic. For ToN-IoT, high-cardinality metadata and direct identifiers are removed before binary anomaly detection, and the final train–test split is stratified before any server or client validation split is created.

3.3. Overview of the Proposed Framework

The framework contains an edge-side detector, a server-assisted teacher reference, and a validation-quality-aware aggregation module. In a fully decentralized deployment, clients can retain raw traffic locally and exchange models and scores. However, the present experiments additionally assume that the server can access a permitted training pool to fit the teacher reference. We therefore describe the method as server-assisted rather than claiming that teacher training is fully decentralized. This assumption is isolated through no-teacher and budget-matched controls.

Figure 1 illustrates the three-stage client update and server aggregation flow. In the experimental protocol, the teacher reference is fitted from a server-accessible pool derived from client-training subsets after server and client validation subsets are held out. This server-assistance assumption is explicit and is not presented as a fully decentralized deployment mechanism.

Figure 2 shows one communication round. The order 1→2→3 is the default protocol used for the main comparison, but alternative schedules and a joint objective are evaluated explicitly. The results are interpreted as schedule-dependent rather than as evidence that a single order must dominate across all datasets. To avoid ambiguity in the subsequent analysis,

Table 1. Canonical terminology and roles of the proposed modules.

Component	Canonical Term	Role	Evidence Reported
Stage 1	Boundary stabilization	Limits early local prediction bias using a balanced-output regularizer.	Schedule controls; severe label-skew tests.
Stage 2	Decision distillation	Transfers confidence-weighted teacher soft targets after initial local fitting.	No-teacher and budget-matched controls.
Stage 3	Representation alignment	Aligns teacher and student intermediate features and their first-block statistics.	Alternative schedule controls.
Server	Validation-quality-aware aggregation	Weights update by held-out local validation F1, not final-test performance.	Aggregation-rule ablation on ToN-IoT.
Teacher	Server-assisted reference	Fits a teacher on a server-accessible pool of client-training subsets in the simulation.	Explicit limitation; not a fully decentralized deployment claim.

consolidates the canonical terminology, intended role, and empirical evidence associated with each component of the proposed framework.

3.4. Three-Stage Local Training

3.4.1. Stage 1: Boundary Stabilization with Bias Suppression

The first stage aims to stabilize the initial decision boundary under local class imbalance and client-specific traffic behavior. Instead of freezing the feature extractor, the current implementation updates all parameters with mild optimization strength and a bias-suppression regularizer. The Stage 1 objective is

$$L_1=L_c+{\lambda }_1{L}_{\mathrm{F}\mathrm{B}\mathrm{R}}$$

(3)

where $L_{\mathrm{c}}$ is the class-weighted cross-entropy loss with label smoothing, $L_{\mathrm{FBR}}$ is the forward bias suppression regularization term, and ${\lambda }_1$ controls its strength. Let $z_{S,i}$ be the student logits for the i-th sample in a mini-batch of size $B$. The average predicted class probability of the student model is

$${\overline{p}}_S=\left({\displaystyle \frac{1}{B}}\right){\sum }_{i=1}^B\mathrm{s}\mathrm{o}\mathrm{f}\mathrm{t}\mathrm{m}\mathrm{a}\mathrm{x}\left(z_{S,i}\right).$$

(4)

Let u denote the uniform class distribution, u = (1/C, 1/C, …, 1/C), where C is the number of classes. In this work, C = 2. The forward bias suppression term is defined as

$$L_{\mathrm{FBR}}=\mathrm{K}\mathrm{L}\left({\overline{p}}_S∥u\right).$$

(5)

By penalizing excessive deviation from a balanced prediction distribution at the early stage, this term helps reduce the influence of local class imbalance on the initial decision boundary.

3.4.2. Stage 2: Teacher-Guided Decision Distillation

The second stage performs full-parameter fine-tuning and introduces teacher-guided soft-label distillation. In heterogeneous IoT/edge intrusion-detection clients, the teacher provides a more stable decision reference than purely local hard labels. The Stage 2 objective is

$$L_2=L_c+{\lambda }_2{L}_{\mathrm{IFBR}}+{\lambda }_3{L}_{\mathrm{KD}},$$

(6)

where $L_{\mathrm{IFBR}}$ is the inverse bias suppression term, $L_{\mathrm{KD}}$ is the knowledge distillation loss, and ${\lambda }_2$ and ${\lambda }_3$ are their corresponding weights. The inverse bias suppression term is defined as

$$L_{\mathrm{IFBR}}=\mathrm{K}\mathrm{L}\left(u∥{\overline{p}}_S\right).$$

(7)

Compared with Stage 1, this inverse form encourages the model to maintain sufficient coverage of both classes during full-parameter fine-tuning, thereby reducing excessive shrinkage toward local majority classes. Let $z_T$ and $z_S$ denote the teacher and student logits, respectively. With distillation temperature $\tau$, the softened teacher and student distributions are

$${p_T}^{\tau }=\mathrm{s}\mathrm{o}\mathrm{f}\mathrm{t}\mathrm{m}\mathrm{a}\mathrm{x}\left({\displaystyle \frac{z_T}{\tau }}\right),{p_S}^{\tau }=\mathrm{s}\mathrm{o}\mathrm{f}\mathrm{t}\mathrm{m}\mathrm{a}\mathrm{x}\left({\displaystyle \frac{z_S}{\tau }}\right).$$

(8)

The decision-level distillation loss is

$$L_{\mathrm{KD}}={\tau }^2\mathrm{K}\mathrm{L}\left({p_T}^{\tau }∥{p_S}^{\tau }\right).$$

(9)

In implementation, the effective weight of $L_{\mathrm{KD}}$ is adjusted according to teacher confidence. When the teacher prediction is more confident and stable, the distillation strength is increased; otherwise, it is reduced to alleviate possible negative transfer from unreliable soft labels.

3.4.3. Stage 3: Representation Alignment and Feature Calibration

The third stage extends distillation from the output space to the representation space. This stage encourages heterogeneous clients to learn more consistent intermediate representations, thereby improving robustness under non-IID training. The Stage 3 objective is

$$L_3=L_c+{\lambda }_4{L}_{\mathrm{MKD}}+{\lambda }_5{L}_{\mathrm{FLD}}+{\lambda }_6{L}_{\mathrm{cal}}+L_{\mathrm{prox}},$$

(10)

where $L_{\mathrm{MKD}}$ is the cross-module distillation loss, $L_{\mathrm{FLD}}$ is the feature-level distillation loss, $L_{\mathrm{cal}}$ is the feature distribution calibration loss, and $L_{\mathrm{prox}}$ is an optional proximal regularization term. The cross-module distillation loss adopts a symmetric KL divergence between the softened teacher and student output distributions:

$$L_{\mathrm{MKD}}=0.5\mathrm{K}\mathrm{L}\left({p_T}^{\tau }∥{p_S}^{\tau }\right)+0.5\mathrm{K}\mathrm{L}\left({p_S}^{\tau }∥{p_T}^{\tau }\right).$$

(11)

The feature-level distillation loss aligns the intermediate representations of the student and teacher models:

$$L_{\mathrm{FLD}}={\sum }_{l=1}^L{{\parallel {h_S}^{\left(l\right)}-{h_T}^{\left(l\right)}\parallel }_2}^2.$$

(12)

Here, ${h_S}^{\left(l\right)}$ and ${h_T}^{\left(l\right)}$ denote the student and teacher features at layer $l$, respectively, and $L$ is the number of feature layers used for distillation. In this work, $L=3$, corresponding to the 512-, 256-, and 128-dimensional feature blocks. The feature distribution calibration term is applied to the first feature block:

$$L_{\mathrm{cal}}={{\parallel \mu \left({h_S}^{\left(1\right)}\right)-\mu \left({h_T}^{\left(1\right)}\right)\parallel }_2}^2+{{\parallel \sigma \left({h_S}^{\left(1\right)}\right)-\sigma \left({h_T}^{\left(1\right)}\right)\parallel }_2}^2,$$

(13)

where μ(·) and σ(·) denote the mini-batch mean and standard deviation of the feature representation. This term encourages the first-level feature distribution to remain stable and reduces local feature drift caused by heterogeneous client data. The proximal regularization term is defined as

$$L_{\mathrm{prox}}=\left({\displaystyle \frac{{\mu }_p}{2}}\right){{\parallel {\theta }_k-{\theta }^t\parallel }_2}^2,$$

(14)

where ${\mu }_p$ is the proximal coefficient, ${\theta }_k$ is the local model parameter, and ${\theta }^t$ is the global model parameter broadcast by the server at round $t$. This term limits the deviation in local updates from the global model and improves training stability under strong heterogeneity.

3.5. Server-Side Teacher and Quality-Aware Aggregation

The teacher model is maintained on the server side. The implementation first fixes the final train–test split, then holds out 10% of the training split for server-side model selection and holds out 10% of each client subset for local validation. The teacher pool is the union of the remaining client-training subsets. Thus, the pool contains no final-test samples and no held-out validation samples, but it is server-accessible in this simulation. This is a material deployment assumption, not a privacy claim. The pool size, class composition, split indices, random seeds, and hyperparameters are recorded in the experiment artifacts.

To separate the contribution of server assistance from the training protocol, this study reports three explicit controls: (i) an Ours w/o teacher variant, (ii) an Ours budget-matched variant with comparable local optimization budget, and (iii) direct FLKD and FD-IDS-style distillation baselines. These controls do not eliminate the practical limitation of requiring server-accessible teacher data. Accordingly, Section 5 states that the proposed method is not directly applicable to a fully decentralized setting without an alternative public, synthetic, or privacy-preserving teacher source.

After local training, each client uploads model parameters and a scalar quality score. The score is calculated from the post-training F1 on that client’s held-out local validation subset and normalized across the selected clients. It is never calculated on the final-test set. Server validation F1 is used for early stopping and checkpoint selection; final-test performance is calculated once after the selected checkpoint is restored.

$${a_k}^t={\displaystyle \frac{{q_k}^t+\epsilon }{{\sum }_{j=1}^K{q_j}^t+\epsilon }}.$$

(15)

The global model is updated by

$${\theta }^{t+1}={\sum }_{k=1}^K{a_k}^t{{\theta }_k}^{t+1}.$$

(16)

Compared with sample-size-only aggregation, this strategy emphasizes the reliability of the current local update rather than simply reflecting the client data scale. Therefore, it can reduce the influence of unstable or low-quality client updates under strong non-IID conditions. For teacher updating, an optional exponential moving average strategy can be used:

$${{\theta }_T}^{t+1}=\left(1-\beta \right){{\theta }_T}^t+\beta {\theta }^{t+1}.$$

(17)

The teacher-update option is retained as an implementation detail. The primary clean-protocol experiments use the fixed server-assisted training pool; optional exponential moving-average updates are not used to support the central conclusions of this study.

3.6. Computational Cost

Compared with FedAvg and FedProx, the proposed framework introduces additional training costs from three sources. First, Stage 2 and Stage 3 require additional distillation loss computation. Second, the server maintains and updates an auxiliary teacher model. Third, quality-aware aggregation requires each client to compute a local post-training quality score. However, the proposed method does not increase the number of communication rounds. Moreover, the teacher model is only used during training and is not required during inference. Therefore, the inference-time model structure remains the same as the student detector, and no additional inference parameters are introduced.

Let $P$ denote the number of student model parameters and $R$ denote the maximum number of communication rounds. The parameter upload cost of each client per round remains approximately $\mathcal{O}\left(P\right)$. If the teacher model is separately downloaded by clients, the downlink communication may increase by another model parameter size, also approximately $\mathcal{O}\left(P\right)$. Therefore, the proposed method should be understood as a training-stage enhancement framework. Its additional cost is mainly reflected in local computation and possible teacher-model downlink transmission, rather than in inference-time deployment complexity.

4. Results

4.1. Experimental Setup

The evaluation uses four public dataset sources: NSL-KDD, CIC-IDS2017, Edge-IIoTset, and ToN-IoT. NSL-KDD is evaluated under two protocols: the official split includes the train–test shift, whereas the mixed protocol is more stable. CIC-IDS2017 provides a larger enterprise-network benchmark; Edge-IIoTset and ToN-IoT provide IoT/IIoT-oriented network traffic benchmarks. All datasets are reduced to binary normal/attack labels using documented preprocessing rules.

The evaluation is organized around four questions: primary performance under stable partitions, robustness under controlled label skew, the effect of server assistance and aggregation choices, and attack-type generalization.

Table 2. Main method comparison under the leakage-controlled primary protocol. Values are mean (standard deviation) over three seeds.

Dataset	Method	Accuracy (%)	F1 (%)	AUROC	AUPRC
NSL-KDD official	FedAdam	80.26	80.52 (0.73)	0.816	0.820
	Ours	78.94	78.72 (0.21)	0.860	0.917
	FedProto	79.00	78.63 (0.50)	0.865	0.913
	FedProx	78.91	78.59 (0.51)	0.862	0.912
	FedAvg	78.92	78.59 (0.49)	0.862	0.912
	FLKD	78.80	78.51 (0.32)	0.859	0.916
	MOON	78.68	78.45 (0.48)	0.894	0.914
	FedBN	78.30	77.96 (0.45)	0.869	0.923
	SCAFFOLD	74.69	73.31 (1.45)	0.930	0.943
NSL-KDD mixed	Ours	98.71	98.66 (0.06)	0.999	0.999
	FedProto	98.68	98.63 (0.07)	0.999	0.999
	FedAvg	98.65	98.60 (0.03)	0.999	0.999
	FedProx	98.65	98.60 (0.03)	0.999	0.999
	FLKD	98.58	98.53 (0.06)	0.999	0.999
	MOON	98.41	98.35 (0.14)	0.999	0.998
	FedBN	97.01	96.88 (0.32)	0.997	0.997
	SCAFFOLD	96.28	96.09 (0.10)	0.992	0.991
	FedAdam	92.02	91.83 (1.77)	0.921	0.879
CIC-IDS2017	Ours	97.98	95.08 (0.60)	0.998	0.994
	FLKD	97.88	94.82 (0.11)	0.998	0.992
	MOON	97.64	94.26 (0.59)	0.998	0.991
	FedAvg	97.31	93.57 (0.48)	0.998	0.992
	FedProx	97.30	93.54 (0.30)	0.998	0.992
	FedProto	97.26	93.45 (0.09)	0.998	0.992
	SCAFFOLD	96.61	91.95 (0.05)	0.996	0.985
	FedBN	96.73	91.94 (0.93)	0.994	0.981
	FedAdam	69.12	52.70 (18.87)	0.720	0.381
Edge-IIoTset	FedProto	98.65	97.49 (0.82)	0.999	0.998
	Ours	98.23	96.67 (2.12)	0.997	0.994
	MOON	97.55	95.35 (2.11)	0.996	0.992
	FLKD	97.54	95.35 (0.16)	0.998	0.995
	FedAvg	97.49	95.28 (0.95)	0.996	0.992
	FedProx	97.44	95.20 (1.12)	0.995	0.991
	SCAFFOLD	96.04	92.43 (0.28)	0.979	0.967
	FedBN	87.01	81.55 (15.04)	0.960	0.940
	FedAdam	64.36	57.58 (9.02)	0.701	0.423
ToN-IoT	Ours	91.43	94.10 (0.05)	0.988	0.996
	FedAvg	91.38	94.06 (0.09)	0.990	0.997
	FedProx	91.36	94.04 (0.07)	0.990	0.997
	FedProto	91.33	94.02 (0.10)	0.989	0.997
	FLKD	91.31	94.01 (0.08)	0.986	0.996
	FD-IDS surrogate	91.28	93.99 (0.05)	0.985	0.995
	MOON	91.28	93.99 (0.11)	0.982	0.994
	SCAFFOLD	91.21	93.94 (0.09)	0.980	0.994
	FedAdam	81.59	88.19 (0.81)	0.722	0.858
	FedBN	82.36	85.91 (13.95)	0.986	0.995

reports the primary comparison.

Table 3. F1-score sensitivity to Dirichlet heterogeneity on NSL-KDD official and ToN-IoT. Values are mean (standard deviation); n indicates the number of seeds.

Dataset	Dirichlet Alpha	Method	F1 (%)	n
NSL-KDD official	1.0	Ours	78.68 (0.14)	3
		FedAvg	79.41 (0.48)	3
		FedProx	79.32 (0.58)	3
	0.5	Ours	79.29 (0.55)	3
		FedAvg	77.28 (1.71)	3
		FedProx	77.54 (1.51)	3
	0.3	Ours	77.94 (2.54)	3
		FedAvg	77.01 (14.16)	3
		FedProx	77.45 (13.71)	3
	0.1	Ours	77.14 (3.54)	3
		FedAvg	50.93 (42.51)	3
		FedProx	50.82 (42.91)	3
ToN-IoT	1.0	Ours	94.04 (0.12)	3
		FedAvg	94.04 (0.07)	3
		FedProx	94.04 (0.05)	3
	0.5	Ours	94.11 (0.23)	3
		FedAvg	94.04 (0.12)	3
		FedProx	94.04 (0.12)	3
	0.3	Ours	94.11 (0.24)	3
		FedAvg	85.61 (13.67)	3
		FedProx	81.39 (21.96)	3
	0.1	Ours	91.46 (5.54)	5
		FedAvg	53.73 (49.00)	5
		FedProx	53.77 (48.92)	5

reports alpha sensitivity for NSL-KDD and ToN-IoT.

Table 4. Schedule controls under strong heterogeneity (Dirichlet alpha = 0.1). Values are mean (standard deviation) over five seeds.

Dataset	Schedule	F1 (%)	n
NSL-KDD official	1→2→3 (default)	76.57 (3.23)	5
	1→3→2	76.36 (3.20)	5
	2→1→3	76.73 (4.75)	5
	Joint objective	79.74 (5.01)	5
ToN-IoT	1→2→3 (default)	91.46 (5.54)	5
	1→3→2	88.38 (8.82)	5
	2→1→3	93.02 (3.97)	5
	Joint objective	90.55 (4.76)	5

,

Table 5. Aggregation-rule controls on ToN-IoT under Dirichlet alpha = 0.1. Values are mean (standard deviation) over five seeds.

Aggregation	Accuracy (%)	F1 (%)	AUROC	AUPRC	Evaluation Source	n
Sample size	60.98	53.68 (49.31)	0.959	0.987	Held-out local validation	5
Sample x quality	84.25	88.42 (10.01)	0.920	0.964	Held-out local validation	5
Clipped quality	83.94	88.49 (9.81)	0.913	0.961	Held-out local validation	5
Quality-aware	88.17	91.46 (5.54)	0.967	0.988	Held-out local validation	5

and

Table 6. Teacher and budget controls under strong heterogeneity. Values are mean (standard deviation) over five seeds.

Dataset	Method/Control	Accuracy (%)	F1 (%)	AUROC	AUPRC
NSL-KDD official	Ours	75.20	76.57 (3.23)	0.882	0.926
	Ours w/o teacher	66.62	55.20 (29.80)	0.787	0.869
	Ours budget-matched	76.79	75.43 (4.85)	0.833	0.898
	FLKD	67.37	61.65 (33.58)	0.823	0.884
ToN-IoT	Ours	88.17	91.46 (5.54)	0.967	0.988
	Ours w/o teacher	79.26	83.68 (16.89)	0.870	0.940
	Ours budget-matched	83.27	88.10 (8.60)	0.876	0.944
	FLKD	58.82	52.39 (47.76)	0.945	0.976
	FD-IDS surrogate	59.67	52.96 (48.21)	0.957	0.978

report schedule, aggregation, and teacher/budget controls.

Table 7. Edge-IIoTset leave-one-attack evaluation under the leakage-controlled protocol. The held-out attack type is used only for final testing; values are mean (standard deviation) over three seeds.

Held-Out Attack	Method	F1 (%)	AUROC	AUPRC
DDoS_HTTP	Ours	86.51 (9.02)	0.960	0.916
	FD-IDS surrogate	80.53 (17.27)	0.951	0.894
	FedAvg	80.26 (17.50)	0.951	0.886
	FedProx	79.43 (12.91)	0.948	0.875
	Ours budget-matched	79.32 (19.99)	0.952	0.886
	Ours w/o teacher	70.07 (24.33)	0.960	0.868
	SCAFFOLD	57.16 (32.48)	0.908	0.777
Password	Ours	72.20 (0.85)	0.880	0.788
	Ours budget-matched	71.47 (2.72)	0.864	0.763
	Ours w/o teacher	68.24 (8.20)	0.913	0.780
	SCAFFOLD	40.63 (29.34)	0.753	0.462
	FedAvg	39.49 (31.13)	0.677	0.446
	FedProx	39.34 (30.86)	0.673	0.440
	FD-IDS surrogate	32.53 (34.69)	0.668	0.431
SQL_injection	Ours budget-matched	77.27 (31.95)	0.940	0.867
	Ours	76.52 (34.17)	0.904	0.839
	Ours w/o teacher	70.89 (23.57)	0.898	0.804
	FD-IDS surrogate	63.40 (27.85)	0.951	0.803
	SCAFFOLD	31.57 (12.98)	0.857	0.609
	FedProx	23.72 (7.95)	0.986	0.913
	FedAvg	21.93 (11.50)	0.987	0.921

reports Edge-IIoTset leave-one-attack testing, and

Table 8. AUROC and AUPRC for the proposed method under the leakage-controlled primary protocol. Values are mean (standard deviation) over three seeds.

Dataset	Method	AUROC	AUPRC
NSL-KDD official	Ours	0.860	0.917
NSL-KDD mixed	Ours	0.999	0.999
CIC-IDS2017	Ours	0.998	0.994
Edge-IIoTset	Ours	0.997	0.994
ToN-IoT	Ours	0.988	0.996

reports AUROC and AUPRC. All analyses use a common leakage-controlled validation protocol.

For Edge-IIoTset, high-cardinality identifiers, payload-like fields, and the multiclass Attack_type field are excluded before binary detection. For ToN-IoT, the Train_Test_Network.csv network-telemetry file is used. Label columns, timestamps, identifiers, IP addresses, ports, and high-cardinality application metadata are removed before model fitting. The final 80/20 stratified train–test split is made before the 10% server-validation and 10% client-validation splits, thereby preventing direct identifier memorization and preventing test labels from entering training, selection, or aggregation. The five evaluation settings differ substantially in their normal-to-anomalous sample composition, which provides a practical source of distributional variation for the subsequent evaluation (Figure 3).

The implementation uses Ubuntu 22.04, Python 3.10, and PyTorch 2.5.1 on a single GPU with 64 GB memory. The main experiments use K = 5 clients, at most R = 10 communication rounds, and a batch size of 2048. All methods use the same client partitions, seeds, detector backbone, maximum rounds, and final-test split within each protocol. Primary comparisons and alpha-sensitivity sweeps use three seeds (42, 2025, and 3407). Selected severe-heterogeneity controls use five seeds (42, 777, 1234, 2025, and 3407), specifically the schedule, teacher/budget, and ToN-IoT aggregation controls reported in Table 4, Table 5, Table 6, Table A3, Table A4 and Table A5. Results are reported as mean (standard deviation);

Table A5. Two-sided t-based 95% confidence intervals for representative five-seed strong-heterogeneity F1 controls.

Dataset and Protocol	Method/Control	F1, Mean (SD)	95% CI
NSL-KDD official, alpha = 0.1	Ours	76.57 (3.23)	72.56–80.58
ToN-IoT, alpha = 0.1	Ours, order 1→2→3	91.46 (5.54)	84.58–98.34
ToN-IoT, alpha = 0.1	Order 1→3→2	88.38 (8.82)	77.43–99.33
ToN-IoT, alpha = 0.1	Order 2→1→3	93.02 (3.97)	88.09–97.95
ToN-IoT, alpha = 0.1	Joint objective	90.55 (4.76)	84.64–96.46

Intervals use the Student t distribution with four degrees of freedom. Because the paired Wilcoxon tests with Holm correction on the five-seed NSL-KDD strong-skew comparison did not show adjusted p < 0.05, the manuscript treats these results as robustness evidence and does not interpret small mean differences as statistically confirmed superiority.

also reports t-based two-sided 95% confidence intervals for representative five-seed strong-skew controls. For the five-seed NSL-KDD strong-skew comparison, paired Wilcoxon tests with Holm correction did not yield adjusted p < 0.05 across the tested method pairs; we therefore avoid claims of statistical superiority based on small numerical differences.

Every run first fixes the final train–test split. A stratified server-validation subset is then separated from the training data, and each client retains a stratified local validation subset. Server validation controls early stopping and checkpoint selection; local validation F1 controls quality-aware aggregation; neither mechanism accesses the final-test set. Baselines receive the same backbone, partitions, maximum rounds, and final-test protocol. The proposed method additionally has access to the server-assisted teacher pool, so the no-teacher and budget-matched controls are reported alongside FLKD and the FD-IDS-style surrogate.

The comparison set spans standard averaging (FedAvg), proximal regularization (FedProx), local batch-normalization personalization (FedBN), adaptive server optimization (FedAdam), drift correction (SCAFFOLD), model-contrastive regularization (MOON), prototype transfer (FedProto), single-stage federated distillation (FLKD), and an FD-IDS-style surrogate. The FD-IDS result is a compatible surrogate implementation under the common backbone and protocol, not a reproduction of the original authors’ code. This label is retained throughout the manuscript and tables.

4.2. Main Performance Comparison

Table 2 shows that performance is setting-dependent. The proposed method has the highest mean F1 on CIC-IDS2017, NSL-KDD mixed, and ToN-IoT, while FedAdam is higher on NSL-KDD official and FedProto is higher on balanced Edge-IIoTset. On ToN-IoT, the difference between the proposed method and conventional baselines is small under the balanced partition, so it should be interpreted as competitive rather than as a universal advantage. This pattern motivates the strong-skew and control analyses below. This pattern is more readily interpreted by comparing the F1-score profiles across all evaluation settings in Figure 4.

4.3. Non-IID Robustness Analysis

As alpha decreases, client label distributions become more heterogeneous. On NSL-KDD official, the proposed method is competitive at alpha = 0.5 and alpha = 0.3, and it maintains a materially higher mean F1 than FedAvg and FedProx at alpha = 0.1. For ToN-IoT at alpha = 0.1, the five-seed comparison gives 91.46 ± 5.54 F1 for Ours, compared with 53.73 ± 49.00 for FedAvg and 53.77 ± 48.92 for FedProx. These results support a robustness-oriented interpretation, not a claim that all competitor families fail in every non-IID condition.

ToN-IoT broadens the empirical scope beyond the older NSL-KDD and CIC-IDS2017 corpora. It is still a benchmark with a stratified split and synthetic client partitioning in this study, so it does not substitute for device-, service-, protocol-, or time-defined deployment domains. Edge-IIoTset leave-one-attack testing remains the closest attack-shift analysis in this study; future work should add real device or temporal client partitions and cross-site transfer.

Figure 5 visualizes the alpha sweeps for the proposed method, FedAvg, and FedProx. The figure highlights the sharp variance growth of sample-size aggregation under severe skew while preserving the uncertainty bars. It should be read together with Table 3 rather than as a significance claim.

4.4. Ablation Study

The schedule controls do not identify a universally optimal order. On NSL-KDD official, the joint objective has the highest mean F1, whereas on ToN-IoT the 2→1→3 schedule has the highest mean F1. The default 1→2→3 schedule remains a transparent pre-specified protocol used in the primary comparison, but the manuscript no longer claims that it is intrinsically optimal. The more defensible finding is that timing and schedule are material design variables whose effects depend on dataset and heterogeneity.

Figure 6 compares full, no-teacher, and budget-matched variants under severe skew. It makes the contribution of server assistance and additional local optimization visible without relying on final-test performance for either aggregation or selection.

4.4.1. Schedule and Aggregation Controls

Table 5 isolates aggregation behavior under strong ToN-IoT label skew. Quality-aware weighting attains 91.46 ± 5.54 F1, compared with 53.68 ± 49.31 for sample-size weighting and approximately 88.4 for the two mixed weighting rules. This is a within-framework ablation, not a proof that quality weighting dominates every federated optimizer. It nevertheless supports the use of held-out validation quality as a practical safeguard against unstable local updates in this protocol.

4.4.2. Teacher and Budget Controls

Table 6 separates the server-assisted teacher assumption from the staged local budget. On NSL-KDD official at alpha = 0.1, the full method obtains 76.57 ± 3.23 F1, the budget-matched variant obtains 75.43 ± 4.85, and the no-teacher variant obtains 55.20 ± 29.80. On ToN-IoT at alpha = 0.1, the corresponding values are 91.46 ± 5.54, 88.10 ± 8.60, and 83.68 ± 16.89. These controls indicate that both the server-assisted teacher and the training protocol matter in these settings, while they also confirm that the full method relies on an assumption unavailable in fully decentralized FL.

4.4.3. Edge-IIoTset Leave-One-Attack Evaluation

Table 7 provides a stricter attack-shift test by holding out complete attack types. The results are attack-dependent. The proposed method has a higher mean F1 on DDoS_HTTP and Password than the listed standard and distillation baselines, but the budget-matched control is slightly higher on SQL_injection. The large uncertainty on SQL_injection prevents a strong ordering claim. These outcomes strengthen the paper’s bounded interpretation: robustness is scenario-specific and should be evaluated under explicit shift protocols.

4.5. Ranking Metrics and Convergence

Table 8 reports threshold-independent ranking metrics for the proposed method on each primary dataset. AUROC and AUPRC remain high on CIC-IDS2017, Edge-IIoTset, and ToN-IoT, while the lower NSL-KDD official values are consistent with its train–test shift. Ranking metrics are presented as complementary evidence and are not used for model selection or aggregation. Figure 7 provides a graphical summary of the ranking metrics and the selected strong-heterogeneity comparison. Figure 8 visualizes the schedule-control results and reinforces that the effect of stage ordering is dataset-dependent.

4.6. Efficiency Analysis

The staged framework adds training-side computation for teacher fitting, distillation losses, and validation-quality scoring, but it does not change the deployed student architecture.

Table 9. Training and inference cost on NSL-KDD official. This implementation-level profile is reported separately from the leakage-controlled performance comparisons.

Method	Total Time (s)	Time/Round (s)	Latency (ms/Batch)	Latency (ms/Sample)	Throughput (Samples/s)	Peak Memory (MB)	Extra Inference Params
Ours	892.79 (371.57)	120.74 (31.72)	5.160	0.003	363,983	9.83	0
FedAvg	933.86 (211.67)	117.21 (2.89)	6.170	0.003	304,508	9.83	0
FedProx	817.06 (179.51)	117.38 (3.97)	5.160	0.003	363,848	9.83	0

is retained as an implementation profile rather than an efficacy result. Its absolute timing values depend on hardware, data loading, and early stopping, so the main practical conclusion is limited to a train-time versus inference-time trade-off.

5. Discussion

The results support a bounded robustness-oriented interpretation. The proposed method is competitive on stable settings and shows more favorable mean F1 under several severe label-skew settings, especially on ToN-IoT. It is not consistently the best method: FedAdam is higher on NSL-KDD official, FedProto is higher on balanced Edge-IIoTset, and alternative schedules can exceed the default schedule in the control studies. The evidence therefore supports a robustness-oriented design option, not universal superiority or a fixed universal curriculum. The rationale for the ordering is therefore empirical and mechanism-oriented: the schedule controls test whether separating early local boundary stabilization, subsequent decision transfer, and later representation alignment is useful under the evaluated heterogeneous conditions. These experiments do not constitute a general theoretical proof of convergence, optimality, or superiority for the proposed ordering.

The teacher controls clarify both a mechanism and a limitation. The server-assisted teacher improves or stabilizes performance in the reported strong-skew settings, while no-teacher and budget-matched variants show that local optimization alone does not fully explain all observed differences. At the same time, fitting the teacher on a server-accessible union of client-training subsets is incompatible with a strictly decentralized deployment that never exposes client records to a server. A practical decentralized extension would require a public reference set, synthetic data, secure aggregation of teacher statistics, or another privacy-preserving teacher-construction mechanism. We do not claim to solve that deployment problem here. This server-assisted requirement is a scope boundary of the present framework rather than a general solution for fully decentralized federated learning.

From a systems perspective, the main cost is concentrated during training. The teacher model, distillation losses, and quality-score computation increase per-round computation, but they do not increase the deployed inference model size. After training, each edge gateway can use the same anomaly detector architecture as the baseline student model, so deployment latency and memory footprint remain suitable for edge-gateway traffic monitoring.

This study concerns network and edge-gateway intrusion detection, not physical-layer sensing. The evaluation spans NSL-KDD, CIC-IDS2017, Edge-IIoTset, and ToN-IoT, together with five-seed strong-skew controls, held-out server and client validation, no-teacher and budget-matched variants, aggregation and schedule controls, and attack-type holdouts. Limitations remain. The FD-IDS comparison is a compatible surrogate rather than an exact reproduction; primary and attack-holdout results use three seeds; no observed mean difference is presented as statistically significant unless supported by the reported test; and client heterogeneity is still largely simulated by label skew. Future work should use device-, protocol-, time-, and site-defined client domains and an alternative teacher source for fully decentralized FL.

6. Conclusions

This paper evaluates a server-assisted, three-stage federated distillation protocol for intrusion detection in heterogeneous IoT/edge networks. This study makes the teacher data-access assumption, held-out validation protocol, and quality-score source explicit. It also evaluates progressive scheduling, teacher removal, budget matching, quality-aware aggregation, attack-type shift, and a fourth public dataset, ToN-IoT, under a common leakage-controlled protocol.

The evidence is deliberately bounded. The proposed method is competitive in stable partitions and shows favorable robustness in several severe label-skew and attack-shift settings, including ToN-IoT at Dirichlet alpha = 0.1. However, competitor methods and alternative schedules outperform it in selected conditions. The results therefore support server-assisted staged distillation as a useful robustness-oriented option, while not establishing universal superiority, a universally optimal stage order, or applicability to fully decentralized deployments without an alternative teacher source. The results likewise do not provide a formal convergence or optimality guarantee for the staged schedule.