Mohammad Hossein Gholamrezazadeh, Ahmadreza Montazerolghaem · 2025 · 2025 11th International Conference on Signal Processing and Intelligent Systems (ICSPIS)
Find papers from 2023-2026 on federated learning intrusion detection (IoT/IIoT) that use SHAP or other feature attributions to screen, weight, or detect malicious or untrustworthy clients. For each paper give: title, authors, venue, year, DOI, the dataset(s), the attacks evaluated, how attributions are used (screening / weighting / explanation only), and whether an adaptive attacker that knows the defense is evaluated. Include Zero-Trust Agentic Federated Learning for Secure IIoT Defense Systems (arXiv 2512.23809) and XAI FL-IDS (arXiv 2605.19448) if they appear.
Papers matching the client-attribution criterion
I searched academic records dated 2023–2026 in Semantic Scholar, OpenAlex, and PubMed. From the retrieved abstracts, I found two direct IoT/IIoT matches where feature attribution is explicitly used to weight client updates or identify malicious clients, plus one adjacent Internet-of-Vehicles (IoV) paper. The available evidence is abstract-level only; the table distinguishes an attack experiment from a test of an attacker who knows and adapts to the defense.
| Paper | Authors; venue; year; DOI | Dataset(s) | Attacks evaluated (as stated in abstract) | Attribution function | Adaptive, defense-aware attacker evaluated? |
|---|---|---|---|---|---|
| Federated Learning for Distributed IoT Security: A Privacy-Preserving Approach to Intrusion Detection | Gutti Chandu, Karthik Thumula, Balbudhe Parag; IEEE Access; 2025; 10.1109/ACCESS.2025.3592481 | CIC-BCCC-NRC TabularIoTAttack-2024; Edge-IIoTset; 100 simulated ARM-class devices. | FGSM and PGD-10 perturbations, plus label-flip attacks. The abstract reports 66–73% accuracy under these attacks, but does not specify a defense-aware adaptive adversary. | Weighting. HADA weights client updates according to SHAP-based feature stability and each client’s differential-privacy budget; this is directly used in aggregation to down-weight noisy/low-privacy updates and is described as hardening against poisoning. (Gutti, 2025) | Not reported in the retrieved abstract. Adversarial perturbation and label-flip tests are reported, but not an attacker explicitly adapting with knowledge of HADA. |
| Zero-Trust Agentic Federated Learning for Secure IIoT Defense Systems | Samaresh Kumar Singh, Joyjit Roy, Martin So; arXiv preprint; 2025; DOI not listed in the retrieved record (arXiv:2512.23809). | Edge-IIoTset; CIC-IDS2017; UNSW-NB15. | Byzantine poisoning, including a reported test with 30% Byzantine clients; the abstract also reports adversarial robustness but does not name those attack types. | Screening/detection and weighting. SHAP-weighted aggregation is presented as explainable Byzantine detection under non-IID conditions. (Singh, 2025) | Not reported in the retrieved abstract. A 30%-Byzantine evaluation is not, by itself, evidence that the adversary knew or adapted to the defense. |
| Explainable AI for Federated Learning-Based Intrusion Detection Systems in Connected Vehicles (adjacent IoV evidence, not strictly IoT/IIoT) | Ramin Taheri, Raheleh Jafari, Alexander Gegov, Farzad Arabikhan, Alexandar Ichtev; Electronics; 2025; 10.3390/electronics14224508. | CICEVSE2024; CICIoV2024. | The abstract describes anomalies from malicious or corrupted clients and reports stronger resilience, but does not name the attack implementations. | Client-maliciousness detection (claimed), plus explanation. The abstract says SHAP-based feature analysis assists in recognizing anomalies arising from malicious/corrupted clients; it does not provide enough method detail to tell exactly how attribution triggers a decision or update penalty. (Taheri, 2025) | Not reported in the retrieved abstract. No defense-aware adaptive-attack protocol is described. |
The Zero-Trust row is the arXiv:2512.23809 item specified in the request.
Requested XAI FL-IDS item
I could not confirm arXiv:2605.19448 in the permitted academic records: the exact ID lookup returned no citable match. Since arXiv is not among the selected sources, I cannot verify that preprint’s title, authors, venue, DOI, datasets, attacks, attribution role, or adaptive-attacker evaluation. The arXiv source was not searched; enabling the relevant source under Settings > Sources would allow that check.
A separate, indexed 2025 conference paper has a very similar title—XAI FL-IDS: A Federated Learning and SHAP-Based Explainable Framework for Distributed Intrusion Detection Systems (Mohammad Hossein Gholamrezazadeh and Ahmadreza Montazerolghaem; ICSPIS 2025; DOI 10.1109/ICSPIS68676.2025.11551742). Its abstract describes SHAP as inspecting detections for feature-level explanation, not screening, weighting, or detecting untrustworthy clients; it uses Edge-IIoTset with 10 clients and reports >99% accuracy. The abstract does not name attack scenarios or describe an adaptive attacker, so this is explanation-only and not a qualifying client-defense match. (Gholamrezazadeh, 2025)
Scope and caveats
These are the matches supportable from the retrieved abstracts, not a claim that no other papers exist. The search selected up to 100 records per academic search, but all selected passages were abstract/excerpt-only; the optional lexical-planning lane failed while semantic retrieval continued. Client-Shapley scoring that measures client contribution (rather than feature attribution) was not counted as an attribution-based malicious-client defense.
Find papers on federated conformal prediction where some clients are malicious or Byzantine, or on poisoning of conformal calibration data. For each give: title, authors, venue, year, DOI, whether coverage is marginal or class/group-conditional, whether the threat model targets the calibration scores, and the datasets. Include Rob-FCP (Kang et al., ICML 2024), PRISM-FCP (Lari et al., IEEE TSP 2026), and group-conditional federated conformal prediction (Wen, Simeone, Xing, 2026). List anything on intrusion detection or network security separately.
What the retrieved papers establish
I checked the requested dataset names against the dataset descriptions or papers that use them. None of the retrieved abstracts confirms that the downloadable table has one event timestamp per flow. I therefore cannot certify any of these as ready for a chronological forward-time split. “Not stated” below means unavailable in the retrieved abstract, not that the dataset lacks timestamps. The current source scope is academic records in abstract-only mode; I could not inspect dataset readmes, schemas, or live download pages, so sizes and login requirements are not independently verified.
-
Edge-IIoTset — Dataset paper (2022): Edge-IIoTset: A New Comprehensive Realistic Cyber Security Dataset of IoT and IIoT Applications for Centralized and Federated Learning; DOI 10.1109/ACCESS.2022.3165809. The abstract points to
http://ieee-dataport.org/8939as a public-access location; whether it currently works or requires sign-in is unverified. Size: not stated in the abstract. Attacks: 14 attack scenarios in five threat families (DoS/DDoS, information gathering, man-in-the-middle, injection, malware); exported label count is not specified. Timestamp granularity (per flow vs per file): not specified; forward-time suitability unconfirmed. The source describes the attacks and access link. (Ferrag, 2022) -
ToN_IoT network dataset — Dataset paper (2021): A New Distributed Architecture for Evaluating AI-Based Security Systems at the Edge: Network TON_IoT Datasets; DOI 10.1016/j.scs.2021.102994. The abstract says the datasets are publicly accessible from ADFA (2020), but does not provide the direct dataset URL or say whether login is needed. Size and number of network-traffic attack classes: not stated. Timestamp granularity: not stated; per-flow timestamps and chronological-split suitability are unconfirmed. (Moustafa, 2021)
-
NF-ToN-IoT-v2 — I did not confirm a dataset-origin paper. A 2026 paper using it is Intrusion Detection in Industrial IoT Networks using NetFlow and Machine Learning Techniques on the NF-ToN-IoT-v2 Dataset; DOI 10.56714/bjrs.52.1.9. Its abstract identifies it as a NetFlow dataset and says the evaluated version has roughly 1% attack samples, but gives neither total size nor class count. It gives no dataset download URL or login information. Timestamp field/granularity is not stated; chronological suitability is unconfirmed. (Almusawy, 2026)
-
NF-ToN-IoT-v3 — I did not confirm a dataset-origin paper. A 2026 use paper is FedDMGL: Privacy-Preserving Intrusion Detection in IoT Networks via Federated Dynamic Markov Graph Learning; DOI 10.2139/ssrn.6294406. Size, attack-class count, download URL, and login requirement were not given in the retrieved abstract. Timestamp granularity is not specified in the available abstract, so per-flow timestamp and forward-time suitability remain unverified.
Evidence: the abstract reports experiments on NF-ToN-IoT-v3 (and NF-BoT-IoT-v3). (Driss, 2026)
-
CICIoT2023 — Dataset paper (2023): CICIoT2023: A Real-Time Dataset and Benchmark for Large-Scale Attacks in IoT Environment; DOI 10.3390/s23135941. The abstract says it is available on the CIC Dataset website but does not give a direct download URL or login requirement. Size is not stated in the abstract. It reports 33 attacks grouped into seven categories: DDoS, DoS, reconnaissance, web-based, brute force, spoofing, and Mirai. Timestamp granularity (per flow vs per file) is not stated; chronological suitability is unconfirmed. (Neto, 2023)
-
X-IIoTID — Dataset paper (2021): X-IIoTID: A Connectivity-Agnostic and Device-Agnostic Intrusion Data Set for Industrial Internet of Things; DOI 10.1109/JIOT.2021.3102056. The abstract describes network-traffic, host-resource, log, and alert views and an attack taxonomy, but does not give a direct download URL, login requirement, size, or attack-class count. It also does not establish whether timestamps are per flow or per file; chronological suitability is unconfirmed. (Al-Hawawreh, 2021)
-
WUSTL-IIoT-2021 — I did not confirm a dataset-origin paper. A 2024 paper that uses WUSTL-IIOT is A Stability-Enhanced Dynamic Backdoor Defense in Federated Learning for IIoT; DOI 10.1109/TII.2024.3410319. It evaluates a backdoor-defense method on WUSTL-IIOT, but does not document the dataset release, size, attack-label count, download URL, login requirement, or timestamp schema. A 2025 study also names WUSTL-IIoT-2021 as an evaluation dataset without supplying those schema details in its abstract. (Ma, 2024) (Salehiyan, 2025)
Bottom line
Only Edge-IIoTset and CICIoT2023 have attack-scenario totals and category groupings in the retrieved dataset-paper abstracts. For all requested datasets, the key criterion—timestamp per flow rather than per file or capture—remains unverified in the available source text. The table is therefore a screening list, not a confirmation that these datasets meet the chronological-split requirement. Checking the current download pages and row-level schema is necessary before using one for forward-time evaluation.
Follow-up
Citation Lists
Samaresh Kumar Singh, Joyjit Roy, Martin So · 2025-12-29T19:07:11Z · arXiv
Ramin Taheri, Raheleh Jafari, Alexander E. Gegov, Farzad Arabikhan, A. Ichtev · 2025 · Electronics
Suggested next steps
Run a sensitivity analysis
Turn this into a report
Analyze an uploaded PDF
Edit the draft
Export the extraction tableTRY:
Loading sources…