XAI-SOH-FL: Enhancing SOH-FL with Adaptive Aggregation and Explainable AI for Intrusion Detection in Heterogeneous IoT

Adaptive systems work better than fixed settings: The paper shows that automatically adjusting the model's aggregation parameter (γ) based on changing data patterns improves performance compared to manually tuning it once, achieving 94.12% accuracy and demonstrating faster convergence in fewer communication rounds.

Explainability reveals what actually matters: Using SHAP analysis, the researchers identified that specific network features like "Flow Duration" and "Packet Length" are the key factors driving intrusion detection decisions, providing security teams with interpretable insights rather than a "black box" verdict.

Privacy and performance aren't mutually exclusive: Federated Learning allows the system to detect intrusions while keeping sensitive IoT device data private—each device trains locally without sharing raw data—while still achieving strong detection performance comparable to or better than traditional centralized approaches.

Real-world complexity requires flexible solutions: The framework addresses practical challenges in IoT environments including heterogeneous data (different types of devices generating different data patterns) and limited labeled training data, making it more applicable to actual deployment scenarios than simpler baseline approaches.

Transparency builds trust in security systems: By combining high accuracy (F1-score of 0.92) with explainable predictions, this approach enables security operators to understand why the system flagged a potential intrusion, supporting human decision-making rather than replacing it.