Federated Learning–Based Semi-Supervised IDS for Medical IoT

The rapid adoption of Internet of Things (IoT) technologies in the medical field has introduced new challenges in securing sensitive data against increasingly sophisticated cyber threats. To address the limitations of intrusion detection systems (IDS) that rely on centralized machine learning models, federated learning has emerged as a more privacy-conscious alternative, allowing distributed devices to collaboratively train models without sharing raw data. In this work, we propose a federated, semi-supervised intrusion detection system that couples unsupervised client-side representation learning using a variational autoencoder (VAE); specifically a β-VAE, with server-side classification learning using a small portion of labeled data. Beyond representation learning, we also use a VAE to generate synthetic data and oversample rare attacks. We evaluate across two IoT intrusion detection datasets: the BoT-IoT dataset and the WUSTL-EHMS-2020 Medical IoT dataset, and release simulation code to enable reproducible evaluation and fair comparisons. To explain performance gains, we compare the client-side latent space to that of a standard autoencoder (AE). On the BoT-IoT, the latent space is better structured, showing higher silhouette scores and clearer 3D cluster separations, which yields stronger detection. This improved representation supports stronger detection performance on both datasets while preserving privacy on connected medical devices.