Lightweight Federated Intrusion Detection with Secure Aggregation for Healthcare IoT

Healthcare IoT environments, including wearables, bedside monitors, and medical sensors, generate sensitive and diverse data streams that are highly vulnerable to cyberattacks. Centralized intrusion detection methods increase privacy risks and cause significant communication overhead, making them unsuitable for resource-limited medical systems. This work introduces a Lightweight Federated Intrusion Detection System (LF-IDS) that combines Convolutional Neural Networks (CNN) for feature extraction with an Isolation Forest for anomaly detection. Hospitals train models locally and only share encrypted updates, which are then aggregated using secure protocols to protect patient privacy. Experiments on the CICIoT2023 dataset show that LF-IDS achieves 96.2% accuracy with a 36% reduction in communication costs, while remaining effective under non-IID conditions, making it a practical and privacy-preserving solution for healthcare IoT security.