Source-linked AI summary
SwarmSense-DNN: A Trustworthy and Decentralized Neural Framework for Proactive Anomaly Defense in Consumer IoT
Jing Yang, Vijay Govindarajan, Saad Arif, Xu Xu, Mohamed Kallel, Zaffar Ahmed Shaikh, Zhe Liu, Chunhong Yuan, Lip Yee Por
TL;DR
Consumer IoT anomaly detection needs defenses that are real-time, privacy-preserving, scalable, and resilient beyond centralized coordination and simple federated aggregation. SwarmSense-DNN combines swarm intelligence, federated learning, deep neural networks, dynamic-graph modeling, and privacy mechanisms for decentralized cooperative detection. Across the reported evaluations, it achieves strong detection performance and practical resilience, while remaining limited under network partitions and ultra-low-latency requirements.
Problem
Consumer IoT anomaly detection must address privacy, communication, scalability, reliability, and evolving AI-enabled threats, while existing approaches retain centralized coordination or simple aggregation limitations.
Method
SwarmSense-DNN combines swarm intelligence with federated learning and deep neural networks, using decentralized coordination, dynamic graphs, differential privacy, and self-healing strategies.
Results
95.44% detection accuracy was reported across five benchmarks, alongside strong precision, recall, F1, AUC, and reduced communication overhead in the reported evaluations.
Takeaways & Limitations
The framework supports privacy-preserving cooperative anomaly detection with reported resilience under node failures and adversarial conditions.
Takeaways & Limitations
Performance degrades during network partitions, reaching 89.6% accuracy, and the framework is unsuitable for ultra-low-latency applications requiring sub-second response.
Abstract
from arXiv · showhide
The rapid growth of consumer IoT devices has introduced unprecedented challenges in trustworthy anomaly detection against AI-enabled cyber threats, requiring real-time, privacy-preserving, and scalable defense mechanisms. Traditional centralized strategies face critical limitations, including communication bottlenecks, single points of failure, and privacy vulnerabilities when processing distributed consumer data. We propose SwarmSense-DNN, a novel decentralized neural framework employing swarm intelligence for secure, cooperative anomaly detection across distributed IoT environments. The framework integrates autonomous agents with deep neural networks to form a self-organizing defense system that detects evolving anomalies without centralized coordination. It utilizes hierarchical federated learning with graph neural networks and attention mechanisms to capture local and global anomaly behaviors while ensuring data privacy. Extensive experiments demonstrate SwarmSense-DNN's superior performance: it achieves 95.44% average detection accuracy across five benchmark datasets while reducing communication overhead by 67%. The framework maintains robust resilience against adversarial threats through differential privacy safeguards and demonstrates strong fault tolerance under node failures and AI-enabled attacks.
I. INTRODUCTION
Consumer IoT anomaly detection requires decentralized, privacy-preserving, scalable, and adaptive defenses because centralized and basic federated approaches remain limited. SwarmSense-DNN addresses this gap by combining swarm intelligence, federated learning, and deep neural methods for cooperative detection.
- Motivation: Consumer IoT environments require real-time anomaly detection while managing privacy, bandwidth, scalability, reliability, and AI-enabled threats.Centralized architectures face single points of failure, bandwidth inefficiency, and privacy risks.
- Swarm intelligence: Swarm intelligence enables autonomous agents to coordinate through local interactions and produce collective behavior without explicit central control.This provides a conceptual basis for adaptive distributed defense mechanisms.
- Research gap: Federated learning preserves privacy across decentralized datasets, but many anomaly-detection methods rely on aggregation and overlook swarm-based robustness and adaptability.Existing approaches also include centralized coordination or fail to capture complex heterogeneous dependencies.
- Proposed framework: SwarmSense-DNN fuses swarm intelligence with deep neural networks and federated learning for collaborative anomaly detection without centralized data aggregation.The framework uses autonomous nodes, hierarchical clustering, selective exchange, differential privacy, and self-healing strategies.
- Related work: Prior work spans federated anomaly detection, swarm coordination, deep learning, graph neural networks, edge deployment, and ensemble methods, but does not combine them into the proposed autonomous framework.The literature includes privacy-preserving federated learning, cooperative swarm learning, neural anomaly detection, topology-aware GNNs, and resource-constrained edge systems.
F. Ensemble Learning and Variational Methods
The cited literature positions ensemble and variational methods within broader anomaly-detection research, while SwarmSense-DNN models distributed IoT environments as dynamic graphs with sliding-window observations and pheromone-based coordination.
- Ensemble learning: Ensemble methods improve anomaly-detection robustness by combining models, while selective parallel ensembles balance diversity and accuracy.These approaches inform distributed and scalable anomaly-detection design.
- Research gap: Distributed anomaly detection still lacks integrated swarm intelligence and deep learning for autonomous, privacy-preserving, adaptive coordination.Existing methods commonly use simple federated aggregation or centralized neural models.
- System model: SwarmSense-DNN represents the network as a dynamic graph with time-varying links and weighted adjacency relationships between autonomous nodes.Connectivity depends on node distance, communication range, and connectivity-strength decay.
- System model: Each node observes local feature streams over sliding windows, with node-specific anomaly rates separating normal and anomalous distributions.The observations are represented as multidimensional local vectors across a window of length T.
- Coordination mechanism: The deployment uses edge–cloud collaboration without central control, while pheromone updates use confidence-driven deposits and decay for adaptive threat response.The reported pheromone decay rate is ρ = 0.1, selected with the trust smoothing factor β = 0.8 through IoT-23 validation grid search.
2) Assumptions
SwarmSense-DNN assumes partially connected networks, bounded Byzantine participation, differentiable local objectives, and available node privacy budgets. Its hierarchical local-node design combines preprocessing, temporal convolutions, self-attention, swarm context, and anomaly classification.
- Assumptions: The framework assumes partial connectivity, with each node maintaining at least kmin active neighbors over time.This condition is expressed through |Ni(t)| ≥ kmin.
- Assumptions: Byzantine nodes are bounded by |B| ≤⌊N/3⌋.B denotes compromised or malicious nodes.
- Assumptions: Local loss functions are twice continuously differentiable and satisfy a Lipschitz condition with constant L > 0.This regularity assumption supports the local optimization formulation.
- Assumptions: Each node has a positive differential privacy budget εi > 0.The assumption also constrains the aggregate privacy-budget setting.
- Hierarchical Architecture: The model uses three hierarchical tiers: local nodes, coordinated swarm clusters, and global inter-cluster communication.Cluster coordinators are dynamically elected and re-elected every 10 rounds or upon failure.
- Local Node Neural Network: Each node combines normalized inputs, temporal convolutional features, multi-head self-attention, swarm context integration, and anomaly classification.The classification head outputs anomaly probabilities pi ∈[0,1].
- Local Node Neural Network: Node-level attention processes temporal features, while cluster coordination uses GAT-based attention for inter-node communication.The architecture distinguishes local temporal modeling from cross-node coordination.
3) Swarm Intelligence Coordination Module
The swarm coordination module uses pheromone concentrations and trust-weighted consensus to support distributed anomaly decisions. Pheromone updates reflect anomaly evidence, while selective neighbor weighting replaces blind parameter averaging.
- Pheromone Coordination: Each node maintains pheromone concentrations for different anomaly types.Pheromone levels are updated according to detected anomaly evidence and confidence.
- Pheromone Coordination: Pheromone evaporation is controlled by ρ, while anomaly deposits depend on the factor φ and confidence conf(k).The parameters govern persistence and reinforcement of anomaly-related signals.
- Trust-Weighted Consensus: Trust-weighted consensus selectively incorporates parameters from trusted neighbors instead of blindly averaging all models.The consensus uses Ri,j(t) to weight neighbor parameters θj.
- Trust-Weighted Consensus: The trust-based aggregation is presented as more robust under heterogeneous data and adversarial conditions than FedAvg-style averaging.The passage contrasts selective trusted-neighbor incorporation with simple parameter averaging.
4) Graph Neural Network for Cluster Coordination
Cluster coordination combines neighbor trust, graph attention, privacy-preserving feature sharing, and secure aggregation. The architecture links these mechanisms to decentralized and resilient anomaly detection.
- Trust and Reputation: Each node maintains neighbor trust scores based on the consistency between nodes.The trust update includes a trust decay factor β.
- Graph Neural Network Coordination: A Graph Attention Network facilitates coordinated decision-making within each swarm cluster.Node embeddings are transformed and combined using learned attention parameters.
- Differential Privacy: Before feature sharing, nodes add calibrated Gaussian noise governed by sensitivity, privacy budget εi, and failure probability δ.The experiments set ε = 1.0 and δ = 10−5, with sensitivity ∆= 1.0 from L2-norm clipping.
- Secure Aggregation: Cluster-level statistics are aggregated with additive secret sharing, separating private values from random shares and shared secrets.This mechanism is used for secure aggregation of cluster statistics.
- Integrated Architecture: SwarmSense-DNN combines convolutional extraction, trust evaluation, adaptive clustering, differential privacy, and pheromone coordination.The stated design goal is secure, decentralized, and resilient anomaly detection.
C. Algorithms of SwarmSense-DNN
SwarmSense-DNN’s algorithms discover neighbors, compute local anomaly scores, exchange models and pheromones, and update local models through pheromone-weighted consensus. Pheromone decay and thresholding prevent signal disappearance.
- Protocol Inputs and Outputs: The decentralized coordination protocol takes nodes, neighborhood radius, initial weights, pheromone decay, and a minimum pheromone threshold as inputs.It returns updated local models for all nodes.
- Node Operations: Each node discovers neighbors within radius r, initializes pheromone levels, and computes a local anomaly score.These operations precede local information exchange.
- Swarm Consensus: Nodes exchange local weights and pheromones, then apply pheromone-weighted aggregation through swarm consensus.The protocol is decentralized because exchanges occur with neighborhood sets Ni.
- Pheromone Maintenance: Pheromone values undergo decay but are reset to τmin when they fall below the minimum threshold.The threshold prevents complete evaporation during protocol execution.
D. Evaluation Metrics
The evaluation defines an attention-guided swarm GNN with pheromone-based coordination for producing anomaly scores and updating cooperative threat-response state.
- The method inputs a graph with node features, attention parameters, model weights, and a pheromone matrix, then outputs anomaly scores and updated pheromone levels.
- Pheromone-modulated attention weights are computed within initialized GNN layers for each graph node.
- Anomaly scores are computed relative to an expected behavior embedding.
- Pheromone levels increase along anomalous paths and subsequently undergo evaporation.
2) Communication Efficiency Metrics
The evaluation measures communication, convergence, privacy, resilience, and recovery to characterize efficiency and robustness in decentralized anomaly detection.
- Communication and convergence: Communication overhead measures the total amount of data transmitted per time unit.
- Communication and convergence: Convergence time counts communication rounds required to reach stable performance, using a stability window and convergence threshold.
- Privacy: Privacy metrics quantify the fraction of privacy budget consumed and mutual information between shared and private data.
- Resilience: Fault tolerance measures performance degradation under node failures, while attack resistance measures performance under adversarial conditions.
- Resilience: Recovery time measures the time required to restore normal performance after disruption.
IV. RESULTS
Across the reported experiments, SwarmSense-DNN is evaluated for detection, dataset-specific robustness, communication efficiency, and privacy preservation using consolidated configurations and benchmark comparisons.
- Detection performance: 95.44% accuracy, 94.87% precision, 96.12% recall, 95.49% F1, and 0.967 AUC are reported across the benchmark datasets.The reported average gain over the best competitor is 5.23%.
- Dataset-specific performance: Over 95% accuracy is maintained across IoT-23, NSL-KDD, CICIDS2017, UNSW-NB15, and Industrial IoT.Improvements over baselines range from 4.3–6.5%.
- Communication efficiency: 72.9% lower bandwidth usage and convergence in 32 rounds are reported against FedAvg-AD and the best baseline, respectively.Bandwidth is reported as 585 MB/h versus 2160 MB/h for FedAvg-AD, while convergence is 64.1% faster than the best baseline.
- Privacy preservation: 93.2% accuracy is retained at ε = 1, alongside 94.3% attack resistance and leakage reduction from 0.847 to 0.089.
E. Fault Tolerance and Recovery Analysis
The evaluation examines fault tolerance, recovery, scalability, economic impact, and industrial deployment under node failures, disruptions, and larger network sizes.
- Fault tolerance and recovery: 87.9% accuracy is retained under 40% node failures, with recovery in as little as 2.3 rounds and self-healing above 88%.
- Fault tolerance and recovery: Byzantine stress tests include 10% false labels, gradient-based model inversion, and coordinated attacks involving 20% colluding nodes.Failures are randomly distributed across clusters to approximate worst-case conditions.
- Large-scale performance: 94.2% accuracy is sustained with 1000 nodes, while convergence grows as O(N0.67) and memory use remains 148–215 MB.
- Large-scale performance: The scalability index remains above 0.79 at 1000 nodes, with modest memory growth attributed to efficient swarm coordination protocols.
- Industrial IoT deployment: 92% anomaly detection, 75% fewer false positives, and 96% lower latency are reported in a 30-day industrial IoT deployment.The deployment also reports 18% higher energy efficiency and USD 47K cost savings.
H. Ablation Study
The ablation study finds that every major module improves SwarmSense-DNN, with swarm intelligence providing the strongest gains in accuracy, convergence, and communication efficiency. Attention improves learned-feature separability, while comparative results report substantial latency reduction with minor CPU overhead.
- The ablation study confirms that each component contributes to overall system performance.
- 4.4% accuracy drop occurs when swarm intelligence is removed, the largest ablation effect among the evaluated modules.Clustering and attention provide moderate gains, while privacy maintains accuracy.
- 2.4× faster convergence and 53% less communication overhead are achieved through swarm coordination.These results identify swarm intelligence as the strongest contributor to convergence and communication efficiency.
- 34% lower intra-class variance and 28% greater inter-class distance show that attention enhances anomaly separability in learned IoT-23 features.The comparison is based on the t-SNE feature visualization.
- 96% latency reduction is reported with minor CPU overhead in the comparative analysis.Table X reports this result alongside improvements in accuracy, efficiency, and scalability.