How Does a Trust-Aware Federated Framework Detect Intrusions Across Edge Networks Without Sharing Raw Data?

Why Edge Devices Expand the Attack Surface

Edge computing moves data processing toward users and IoT devices. This shift decentralizes workloads and cuts latency. Backhaul bandwidth congestion drops. But the attack surface grows exponentially. Heterogeneous devices with limited resources sit in unmanaged administrative domains. Each gateway becomes a potential entry point. Traditional perimeter defenses cannot cover this spread. The preprint frames this as a fundamental tension: proximity helps performance but hurts security.

Raw data stays local.

Model updates travel to the server instead. Privacy regulations remain satisfied because no packet payloads cross domain boundaries.

How the Hybrid Model Learns Locally

The proposed framework stitches together an autoencoder, a 1D convolutional neural network, and a bidirectional LSTM. Each component handles a different feature type. Spatial patterns emerge from the convolutional layers. Temporal dependencies surface through the recurrent layers. The autoencoder compresses normal traffic into a latent baseline. Together they form a unified deep learning engine. This engine runs on each gateway. Training happens through federated learning. Raw telemetry never leaves the local gateway.

What the Trust Metric Blocks

A server-side aggregation step checks every client update before integration. Cosine similarity measures how much a local model aligns with the global trend. Outliers get downweighted. This counters model poisoning attempts. An attacker controlling a subset of gateways cannot easily skew the global model. The mechanism evaluates reliability continuously. No fixed reputation scores are assigned. The metric adapts as the global model evolves. Byzantine fault tolerance emerges from this dynamic filtering.

The paper reports high tolerance under adversarial scenarios.

How many compromised nodes the system withstands in practice, the preprint does not specify.

Where the Evaluation Stands

Experiments run on three benchmark datasets. UNSW-NB15 and CICIDS2017 provide multi-vector traffic. Edge-IIoTset adds industrial IoT scenarios. The framework shows higher detection accuracy than baselines. Convergence arrives in fewer rounds. Byzantine fault tolerance holds under adversarial conditions. Ten pages and seven figures document the method. The submission date is 30 Sep 2026. Code availability is not mentioned in the abstract. Deployment constraints on specific hardware, the preprint does not address.