EdgeDetect: Importance-Aware Gradient Compression with Homomorphic Aggregation for Federated Intrusion Detection

Noor Islam S. Mohammad

Source-linked AI summary

EdgeDetect: Importance-Aware Gradient Compression with Homomorphic Aggregation for Federated Intrusion Detection

Noor Islam S. Mohammad

arXiv:2604.14663v1Apr 16, 2026cs.CR

TL;DR

Federated intrusion detection must address centralized IDS limitations, including scalability and communication constraints, while protecting gradient updates from inference attacks. EdgeDetect combines median-based gradient binarization with Paillier homomorphic encryption, achieving centralized-level detection performance with substantially lower communication and protected aggregation on CIC-IDS2017.

Problem
Federated intrusion detection faces excessive bandwidth demands from high-dimensional gradients and gradient-inference risks, while centralized IDS struggle with scalability, latency, failure centralization, high dimensionality, and severe class imbalance.
Method
EdgeDetect median-thresholds local gradients into {+1, −1} representations and applies Paillier homomorphic encryption so the server sees only aggregated updates.
Results
98.0% accuracy and 97.9% macro F1 on CIC-IDS2017 match centralized performance while per-round communication falls from 450 MB to 14 MB, a 96.9% reduction.
Takeaways & Limitations
EdgeDetect provides a practical accuracy, communication, and privacy tradeoff for federated intrusion detection in resource-constrained 6G-IoT environments.

Abstract

from arXiv · show

Federated learning (FL) enables collaborative intrusion detection without raw data exchange, but conventional FL incurs high communication overhead from full-precision gradient transmission and remains vulnerable to gradient inference attacks. This paper presents EdgeDetect, a communication-efficient and privacy-aware federated IDS for bandwidth-constrained 6G-IoT environments. EdgeDetect introduces gradient smartification, a median-based statistical binarization that compresses local updates to $\{+1,-1\}$ representations, reducing uplink payload by $32\times$ while preserving convergence. We further integrate Paillier homomorphic encryption over binarized gradients, protecting against honest-but-curious servers without exposing individual updates. Experiments on CIC-IDS2017 (2.8M flows, 7 attack classes) demonstrate $98.0\%$ multi-class accuracy and $97.9\%$ macro F1-score, matching centralized baselines, while reducing per-round communication from $450$~MB to $14$~MB ($96.9\%$ reduction). Raspberry Pi-4 deployment confirms edge feasibility: $4.2$~MB memory, $0.8$~ms latency, and $12$~mJ per inference with $<0.5\%$ accuracy loss. Under $5\%$ poisoning attacks and severe imbalance, EdgeDetect maintains $87\%$ accuracy and $0.95$ minority class F1 ($p<0.001$), establishing a practical accuracy, communication, and privacy tradeoff for next-generation edge intrusion detection.

I. INTRODUCTION

EdgeDetect targets federated intrusion detection bottlenecks by combining adaptive gradient compression with encrypted aggregation for resource-constrained 6G-IoT environments. The framework reports communication efficiency, privacy protection, and edge feasibility while maintaining detection performance.

Motivation and Contributions: 32× uplink compression converts local gradient updates into {+1, −1} representations using per-client median-based thresholding.The method is designed to preserve empirical convergence behavior and adapt to heterogeneous, heavy-tailed client distributions.
Motivation and Contributions: Paillier homomorphic encryption protects binarized updates so the server sees only aggregated model updates.The design addresses gradient inversion and honest-but-curious server threats without exposing individual updates.
Evaluation: 4.2 MB memory, 0.8 ms latency, and 12 mJ per inference on Raspberry Pi 4 support deployment on constrained edge devices.Accuracy degradation remains below 0.5% in the reported deployment.
Research Gap: Few prior approaches jointly optimize gradient compression and encrypted aggregation for resource-constrained intrusion detection.The paper positions EdgeDetect as addressing communication efficiency and privacy preservation together in this setting.

1) Phase 1: Client-Side Local Training:

The client-side pipeline engineers network-flow features, selects informative dimensions, and applies median-based gradient smartification before homomorphic encryption. This reduces transmitted representations while retaining directional information and protecting individual updates.

Gradient Smartification: Median-based binarization maps local gradients to {+1, −1} vectors, compressing representations by 32× while preserving directional information.The threshold is the median of the absolute values of the local gradient vector.
Privacy-Preserving Encryption: Paillier encryption is applied to binarized gradients so individual client updates remain confidential during transmission.The server performs encrypted aggregation rather than receiving raw updates.
Feature Engineering: Temporal inter-arrival statistics and packet-size entropy capture burstiness and distributional randomness associated with attacks.Entropy uses unique packet sizes and their empirical probabilities.
Feature Selection: Recursive Feature Elimination ranks features using Random Forest permutation importance before dimensionality reduction.Features are ranked according to their importance after permuting feature j in tree t.

C. Dimensionality Reduction via Incremental PCA

Incremental PCA reduces standardized feature dimensionality before federated training, while sampling and imbalance handling prepare the CIC-IDS2017 data for efficient classification. The secure aggregation pipeline then encrypts, combines, and normalizes client updates.

Dimensionality Reduction: 99.3% explained variance is preserved while feature dimensionality falls 55% after incremental PCA.PCA is applied to the standardized feature matrix to mitigate multicollinearity and computational overhead.
Class Balancing: 15,000 balanced instances result from random under-sampling for binary classification.The procedure balances benign and attack samples.
Class Balancing: Adaptive SMOTE uses density-aware interpolation with λ sampled from a Beta distribution parameterized by local minority sparsity.The local sparsity measure ρi determines the interpolation parameters.
Secure Federated Optimization: Each client trains locally, binarizes its update at the per-client median, and encrypts each resulting component before transmission.The algorithm uses θi = median(|∆i|) and maps components to +1 or −1 according to that threshold.
Secure Federated Optimization: Paillier ciphertext multiplication enables encrypted gradient aggregation, after which the summed result is decrypted, normalized, and applied globally.The updated global model is broadcast to clients for the next communication round.

F. Machine Learning Models

The evaluation compares classical and neural intrusion-detection models within a privacy-preserving federated framework. The reported configuration achieves high centralized-comparable accuracy while reducing communication overhead.

Machine Learning Models: Elastic-net logistic regression, RBF-kernel SVM, Random Forest, and a ReLU-dropout MLP constitute the evaluated model families.The MLP uses Adam optimization and a 35 →128 →64 →K architecture.
Federated Optimization: Federated training proceeds from client-local updates through secure aggregation and model updating with momentum.Clients compute updates at communication rounds before the server aggregates them.
Federated Evaluation: 98.7% of centralized accuracy is achieved while communication overhead falls by more than 30×.The result is reported for privacy-aware cross-domain intrusion detection under the federated framework.

H. Evaluation Metrics

The evaluation combines standard classification metrics, stratified validation, dimensionality reduction, feature analysis, and model-complexity reporting to assess performance and deployment robustness.

Evaluation uses stratified cross-validation and standard confusion-matrix metrics, including accuracy, precision, recall, F1-score, and ROC-AUC.
ROC-AUC measures discrimination as the probability that a randomly chosen positive receives a higher score than a randomly chosen negative.
The dataset pipeline samples 504,472 records, reduces 78 features to 35 components while retaining 99.3% variance, and uses stratified splits.The sampled subset was tested for distributional consistency before modeling.
Features are ranked by importance coefficients after selection before dimensionality reduction, with positive coefficients associated with attacks and negative coefficients with benign traffic.
Model complexity is reported alongside hyperparameters, including regularization, support vectors, tree structure, and stored training instances.

C. Learned Model Complexity

The paper evaluates tuned classical models and EdgeDetect’s federated compression and privacy mechanisms across accuracy, stability, communication, and inversion resistance.

98.09% accuracy was achieved by the tuned Random Forest, improving 2.11% over its baseline while halving variance from 3.45×10^-3 to 1.72×10^-3.The configuration used 200 trees and max depth=20.
97.93% accuracy was achieved by KNN with k = 3, improving 0.53% over k = 5 while retaining exceptional stability.The k = 5 model had the lowest variance, with std = 0.89×10^-3.
EdgeDetect combines median-based adaptive thresholding with homomorphic encryption, unlike signSGD and stochastic quantization methods described as lacking adaptivity and privacy integration.
32× compression matched full-precision FedAvg convergence with no measurable accuracy degradation, limited to ∆< 0.2 percentage points.Median thresholding preserved directional alignment at cosine similarity 0.87±0.04 while suppressing low-magnitude noise.
15.1 dB PSNR and 14.3% label recovery were measured for EdgeDetect under gradient inversion analysis, reducing reconstruction toward minimally discernible structure and near-random label guessing.FedAvg produced 31.7 dB PSNR, while signSGD produced 16.8 dB.

C. Binary Classification Performance Analysis

Binary classification results show that tuned classical models perform strongly and reproducibly, with Random Forest achieving the best accuracy and KNN offering the strongest stability-efficiency tradeoff.

27.2% higher mean absolute coefficient magnitude: weaker logistic-regression regularization produced minimal accuracy improvement from 92.2% to 92.5%.Eight of the top ten components remained preserved, indicating stable discriminative ordering.
SVM showed the largest hyperparameter sensitivity at +13.14%, whereas logistic regression gained only +0.30%.The SVM improvement came from replacing a linear kernel with RBF; logistic regression remained comparatively limited.
Across evaluated models, fold-wise variability remained below 2%, supporting reproducibility under stratified cross-validation.The evaluation used five-fold stratified cross-validation on a balanced dataset with 35 PCA features retaining 99.3% variance.

J. Multi-Class Classification Performance

Multi-class evaluation covers seven balanced traffic categories and compares model performance, feature concentration, and federated deployment tradeoffs. Results identify strong overall accuracy while exposing sensitivity in discriminative representation and gradient approximation.

98.0% multi-class accuracy: Random Forest Config. 2 achieved the highest performance across seven attack categories.The balanced dataset contained 35,000 samples, with 5,000 samples per class after SMOTE and undersampling.
72.4% of total ℓ2-norm: the top ten principal components captured most discriminative mass under weaker regularization, versus 70.3%.The Gini coefficient increased from 0.412 to 0.428 while more than 94% of components remained active.
96.9% communication reduction: EdgeDetect reduced per-round communication from 450 MB to 14 MB while achieving 98.0% accuracy.The framework also supports CPU-only Raspberry Pi 4 deployment with 4.2 MB memory and 0.8 ms latency.
Coordinate-wise bias remains a limitation of median-threshold binarization, despite its reported directional alignment and convergence behavior.The bias is explicitly described as E[∆bin] ≠ ∇L.

1) Proposition: Alignment of Median-Threshold Smartification:

The proposition frames median-threshold smartification as a direction-preserving compression method whose performance depends on data heterogeneity and attack-class structure. Experiments report strong alignment and competitive convergence under both IID and non-IID partitions.

Alignment guarantee: Median thresholding reduces variance for heavy-tailed gradients, and the paper reports stable convergence when variance reduction outweighs added bias.The theoretical setup assumes symmetric heavy-tailed coordinate distributions with finite second moment and zero median shift.
Non-IID evaluation: 95.1% accuracy: EdgeDetect combined with FedProx to produce the best reported heterogeneous result at α = 0.1.At the same heterogeneity level, EdgeDetect exceeded signSGD at 94.2% versus 92.1% accuracy.
Scalability: 201 to 467 rounds: increasing clients from K = 10 to K = 500 raised R98 sublinearly, indicating stable aggregation with a noisier client pool.The evaluation varied IID, Dirichlet quantity skew, label skew, and client participation conditions.
Alignment guarantee: 0.87 ± 0.04 mean cosine similarity: EdgeDetect preserved most update-direction information despite 32× compression.The paper connects this alignment with near-parity IID convergence.

D. Training Efficiency and Robustness

EdgeDetect’s training pipeline combines dimensionality reduction, imbalance handling, adaptive gradient compression, and encrypted aggregation to improve efficiency, privacy, and robustness. Ablations show that smartification sharply reduces communication with negligible utility loss, while SMOTE and encryption address minority-class degradation and gradient leakage.

Communication and convergence: 14 MB versus 450 MB per round demonstrates a 32× communication reduction from gradient smartification, with accuracy changing only from 98.0% to 98.2% and p > 0.05.The ablation reached 98% in 289 rounds versus 287 rounds without smartification.
Privacy resilience: PSNR 15.1 dB versus 31.7 dB and 14.3% label recovery show that combined binarization and homomorphic encryption resist gradient inversion without accuracy loss.Disabling encryption enabled gradient inversion with more than 95% label recovery while accuracy remained 98.0%.
Robustness: 94.2% accuracy and 0.934 macro F1 after removing SMOTE show that imbalance handling is necessary for minority-class performance.SMOTE–undersampling improved minority recall from 0.39 to 0.98.
Training efficiency: 98.0% accuracy and 97.9% macro F1 were achieved with Random Forest stability of σ = 0.0017, supporting robust deployment.Random Forest used 12.3s training and 0.87 ms inference.
Robustness: 87% accuracy and 0.95 minority-class F1 were maintained under 5% poisoning and severe imbalance, while Raspberry Pi 4 used 4.2 MB memory and 0.8 ms latency.The edge deployment required 12 mJ per inference with minimal accuracy degradation.

APPENDIX

The appendix explains how median-centered gradient binarization differs from signSGD and sketches its convergence behavior. It states that dominant directions are preserved under bounded-noise assumptions, while formal proof remains incomplete.

Relationship to signSGD: Median-centered binarization suppresses low-magnitude coordinates below a per-client median instead of thresholding gradients at zero.The design targets small-noise sign flips in high-dimensional IDS feature spaces.
Key distinction: Median-thresholding reduces sign-flip probability and gradient variance when stochastic gradients contain small perturbations.The appendix models the observed gradient as true gradient plus stochastic noise and reports improved stability under heterogeneous client distributions.
Convergence sketch: Under L-smoothness, unbiased stochastic gradients, and bounded variance, the analysis frames convergence relative to signSGD.The stated assumptions include an L-smooth loss and bounded stochastic-gradient error.
Convergence sketch: Gradient Smartification is claimed to preserve expected directional alignment with the loss gradient by discarding only low-magnitude coordinates.The appendix says its asymptotic convergence behavior matches signSGD under bounded-noise assumptions.
Convergence sketch: A degradation factor 1/γ is associated with binarization in the stationary-point convergence statement.This result is presented as part of the appendix’s convergence clarification.

D. Bias and Stability of Gradient Smartification

Gradient smartification introduces coordinate-wise bias, while the evaluation examines computational feasibility, per-class behavior, and robustness under heterogeneous client data. These analyses identify where performance varies across attack families and class distributions.

Bias and Stability: Coordinate-wise bias is explicitly identified as a property of median-threshold binarization.The reported bias concerns the binarized gradient representation.
Computational Feasibility: Training time and inference latency are evaluated across all tested models for real-time intrusion-detection feasibility.The benchmark includes training-time and per-sample inference-latency measurements.
Per-Class Performance: Per-class errors are asymmetric across attack families, reflecting differences in separability within the PCA feature space.The breakdown uses the best Random Forest configuration, with one-vs-rest class metrics and macro averages weighting classes equally.
Data Heterogeneity: Per-class F1 decreases smoothly as α decreases, with minority and overlapping classes most affected under increasing heterogeneity.Here, smaller α corresponds to greater heterogeneity, and the reported trend is averaged over five runs.