HomeGuard : Community-Driven Hierarchical Federated Learning for Robust Smart-Home Intrusion Detection

Abstract

Federated Learning (FL) has emerged as a promising approach to build collaborative Intrusion Detection Systems (IDSs) in the IoT, e.g., in smart homes. FL allows models to be shared without exposing sensitive training data, thus protecting the privacy of IoT users. However, existing FL-based IDSs rely on assumptions that rarely hold in practice, namely homogeneous devices, synchronous participation, and benign contributors. We argue that, in real-world smart homes, IoT devices are highly heterogeneous, resource-constrained, and attractive targets for adversaries, which makes conventional FL less effective or vulnerable to poisoning attacks. We present HOMEGUARD, a collaborative IDS specifically designed for the constraints and threat model of practical smart home IoT infrastructures. In our approach, we rethink FL deployment by (1) offloading model training to gateways to manage computational heterogeneity of IoT devices and (2) organizing anomaly detection models into device-specific communities based on privacy-preserving traffic fingerprints which do not expose sensitive data. Within communities and across smart homes, HOMEGUARD implements an asynchronous, hierarchical FL architecture that tolerates device churn, uneven data availability, and Byzantine participants. Further, HOMEGUARD applies Byzantine-robust aggregation at two levels: within local communities, and globally in the cloud to limit the impact of compromised devices. Experimental evaluation shows that HOMEGUARD achieves an average true positive rate of 97.86% locally and 97.53% globally with a 0% false positive rate, while maintaining robustness against both targeted and untargeted poisoning attacks.