PRIVACY-UTILITY TRADE-OFFS IN FEDERATED THREAT DETECTION FOR DISTRIBUTED IIOT AND SCADA SECURITY OPERATIONS

Abstract

Industrial Internet of Things and supervisory control and data acquisition environments generate sensitive telemetry across sites that cannot always be centralised. This study evaluated federated learning as a privacy-preserving basis for collaborative threat detection and AI-assisted security operations. A reproducible Monte Carlo benchmark represented six industrial sites in Germany, the Netherlands, Finland, the United Kingdom and Canada. Six learning strategies were evaluated across 432 matched runs. Additional experiments included 360 differential-privacy runs and 1,440 stress-test runs. Outcomes covered macro-F1, receiver operating characteristic area under the curve, zero-day recall, false-positive rate, membership-inference exposure, latency, communication volume, energy demand and compliance readiness. The centralised model produced the highest macro-F1 of 0.958. FedProx reached 0.944. Secure aggregation reduced membership-inference AUC to 0.566. The differential privacy and secure aggregation configuration achieved macro-F1 of 0.933 and membership-inference AUC of 0.518. Its detection score did not differ from FedAvg after Holm adjustment. It also reached 95% compliance readiness in the study rubric. Repeated-measures analysis showed a strong strategy effect on macro-F1, F (5, 355) = 7614.26, p < .001, partial eta squared = .991. The results of the privacy sweep show that larger values of epsilon increase utility but also increase privacy risk. In terms of the poisoning attack, even the protected setting maintained a macro-F1 score of more than 0.92. Such results suggest that federated learning could be considered for industrial security in a distributed setting using privacy mechanisms such as secure aggregation, differential privacy and client authentication.

Keywords:

Federated learning; industrial Internet of Things; SCADA; intrusion detection; differential privacy; secure aggregation; security operations; compliance.