Hybrid Transformer and XGBoost Model for Federated IoT Intrusion Detection

The rapid expansion of Internet of Things (IoT) devices has increased both the scale and complexity of network traffic, making intrusion detection a critical but challenging task. Although Federated Learning (FL) provides privacy-preserving distributed training, existing FL-based intrusion detection systems typically rely on either deep learning or tabular models alone, leading to suboptimal performance on heterogeneous IoT network flows. Furthermore, high class imbalance, non-IID client distributions, and excessive communication overhead limit their real-world applicability. This paper proposes a hybrid FL architecture integrating a Transformer backbone enhanced with Low-Rank Adaptation (LoRA) adapters, an XGBoost tabular specialist, and a learnable fusion head. The system incorporates stratified data partitioning, class-weighted cross-entropy, and balanced oversampling to address dataset imbalance. Only LoRA adapter updates are exchanged with the server, significantly reducing communication costs while preserving privacy. Experiments on the CICIoT2023 dataset demonstrate that the fusion model achieves improved performance on minority attack classes and exhibits faster convergence compared to single-model FL baselines.