FMLTC-IDS: A Federated Meta-Learning and Adaptive Time Clustering-based IoT Intrusion Detection System

With the rapid proliferation of IoT devices, network security threats have intensified. Federated Learning FL has been applied to anomaly-based Network Intrusion Detection Systems NIDS to identify malicious traffic and mitigate risks. However, traditional FL struggles to handle Non-IID data, and while Personalized FL PFL improves adaptability, it remains insufficient in addressing the dynamic nature of time-series data. To address these issues, this paper proposed an IoT Intrusion Detection System based on Federated Meta-Learning and Adaptive Temporal Clustering FMLTC-IDS . The method combines Model-Agnostic Meta-Learning MAML to optimize the initialization of the global model, enhancing personalized adaptation. It also introduces adaptive batch adjustment and gradient-weighted sampling strategies to improve local training efficiency. Additionally, Principal Component Analysis PCA is used for dimensionality reduction, and a time-series-based dynamic weighted DBA-K-Means clustering method is employed to optimize model clustering quality, enhancing the system's ability to handle spatiotemporal non-IID data. Experimental results show that FMLTC-IDS achieves excellent performance on CICIDS2017, BoT-IoT, and real IoT traffic datasets, outperforming existing methods e.g., Fed-ANIDS, SSFL by more accurately adapting to data heterogeneity, improving Accuracy, Recall, and F1-score, and accelerating model convergence. Furthermore, ablation experiments validate the effectiveness of dynamic batch adjustment, PCA dimensionality reduction, and time-series clustering strategies, demonstrating significant advantages in enhancing personalized detection capabilities and overall detection accuracy for FMLTC-IDS.