Abstract The rapid growth of the Internet of Things (IoT) has significantly increased the complexity of device interactions, making IoT networks more vulnerable to sophisticated cyber threats. Effective intrusion detection is therefore crucial to ensuring the security and resilience of these systems. This paper presents federated learning with feature reduction (Fed-FeRe), a novel approach that enhances decentralized intrusion detection by integrating $$\chi ^{2}$$ χ 2 -based feature selection with a gated recurrent unit model. Fed-FeRe introduces an adaptive initialization of the performance threshold $$\alpha $$ α and a data-driven estimation of key hyperparameters ( $$\theta _{0}$$ θ 0 , $$\eta $$ η ), enabling robust performance across diverse IoT conditions. By dynamically optimizing feature selection, the framework reduces computational overhead and communication costs, achieving approximately 2% lower transmission costs than FedAvg and 17.6% lower GPU utilization than MOON (Model-Contrastive Federated Learning), while improving detection precision by 3.06%. Fed-FeRe further demonstrates scalability to varying client sizes and adaptability to distinct IoT application domains such as smart cities, healthcare, and industrial networks. These results highlight Fed-FeRe as a scalable, efficient, and privacy-preserving solution for real-world IoT security, advancing the state of federated learning-based intrusion detection.

Abstract The Internet of Things (IoT) has been rapidly evolving towards making a greater impact on everyday life to large industrial systems. Unfortunately, this has attracted the attention of cybercriminals who made IoT a target of malicious activities, opening the door to a possible attack on the end nodes. To this end, Numerous IoT intrusion detection Systems (IDS) have been proposed in the literature to tackle attacks on the IoT ecosystem, which can be broadly classified based on detection technique, validation strategy, and deployment strategy. This survey paper presents a comprehensive review of contemporary IoT IDS and an overview of techniques, deployment Strategy, validation strategy and datasets that are commonly applied for building IDS. We also review how existing IoT IDS detect intrusive attacks and secure communications on the IoT. It also presents the classification of IoT attacks and discusses future research challenges to counter such IoT attacks to make IoT more secure. These purposes help IoT security researchers by uniting, contrasting, and compiling scattered research efforts. Consequently, we provide a unique IoT IDS taxonomy, which sheds light on IoT IDS techniques, their advantages and disadvantages, IoT attacks that exploit IoT communication systems, corresponding advanced IDS and detection capabilities to detect IoT attacks.

Purpose – The purpose of this paper is to mitigate vulnerabilities in web applications, security detection and prevention are the most important mechanisms for security. However, most existing research focuses on how to prevent an attack at the web application layer, with less work dedicated to setting up a response action if a possible attack happened. Design/methodology/approach – A combination of a Signature-based Intrusion Detection System (SIDS) and an Anomaly-based Intrusion Detection System (AIDS), namely, the Intelligent Intrusion Detection and Prevention System (IIDPS). Findings – After evaluating the new system, a better result was generated in line with detection efficiency and the false alarm rate. This demonstrates the value of direct response action in an intrusion detection system. Research limitations/implications – Data limitation. Originality/value – The contributions of this paper are to first address the problem of web application vulnerabilities. Second, to propose a combination of an SIDS and an AIDS, namely, the IIDPS. Third, this paper presents a novel approach by connecting the IIDPS with a response action using fuzzy logic. Fourth, use the risk assessment to determine an appropriate response action against each attack event. Combining the system provides a better performance for the Intrusion Detection System, and makes the detection and prevention more effective.

The continuously rising Internet attacks pose severe challenges to develop an effective Intrusion Detection System (IDS) to detect known and unknown malicious attack. In order to address the problem of detecting known, unknown attacks and identify an attack grouped, the authors provide a new multi stage rules for detecting anomalies in multi-stage rules. The authors used the RIPPER for rule generation, which is capable to create rule sets more quickly and can determine the attack types with smaller numbers of rules. These rules would be efficient to apply for Signature Intrusion Detection System (SIDS) and Anomaly Intrusion Detection System (AIDS).