CFMD-i: Communication-Efficient Clustered Federated Multidomain Learning for Robust Network Intrusion Anomaly Detection

This paper proposes CFMD-i, a communication-efficient clustered federated multi-domain learning framework for intrusion anomaly detection in heterogeneous Internet-of-Things (IoT) environments. In such settings, multi-source data are typically non-independent and identically distributed (Non-IID), highly imbalanced, and distributed across resource-constrained edge devices, which poses challenges to both model robustness and training efficiency. CFMD-i addresses these issues from both modeling and system perspectives. First, a federated multi-domain optimization objective is formulated to enhance cross-domain robustness through shared representation learning and adversarial domain weighting. Second, a dynamic hierarchical clustered mechanism is introduced to group clients according to model discrepancy, measured by cosine similarity, output divergence, and intra-cluster compactness, enabling a balance between global knowledge sharing and domain-aware personalization. Third, a communication-efficient optimization scheme is developed by integrating parameter-difference transmission, adaptive leapfrog communication, and quantized error-feedback updates, thereby reducing redundant communication under heterogeneous conditions. Experiments on five intrusion detection datasets demonstrate that CFMD-i consistently outperforms representative federated baselines, including Fedavg, Dis-DAGMM, DIOT, and ZeKoC. The proposed framework consistently improves F1 score across multiple attack domains while reducing communication volume by over 95%, and remains operational under packet loss rates of up to 12%, although performance degradation becomes evident under severe communication impairment.