Fed-CT-IDS: A Hybrid CNN–Transformer Federated Intrusion Detection Framework for Heterogeneous IoT Networks

IoT installations rarely look alike. A smart home, a factory floor, and a hospital ward each generate traffic with its own statistical fingerprint, and none of their owners is eager to ship raw packet captures to a central server. We built Fed-CT-IDS with both of these realities in mind. In our framework, every device trains a local detector — a small convolutional network that picks up short-range packet structure, feeding a two-layer transformer that ties together events spread far apart in time — and shares nothing but encrypted parameter updates. At the server, we replace plain federated averaging with a weighting rule that also accounts for each client’s data quality and training stability, and we introduce an index that puts a number on how non-IID the federation actually is. We evaluated the system on CICIoT2023 and TON_IoT, split across ten clients with Dirichlet partitioning and repeated over three seeds. Fed-CT-IDS reached 99.12% accuracy at a 1.42% false alarm rate, ahead of every classical, deep, and federated baseline we tested, and it lost under two accuracy points when trained on one dataset and tested on the other.