Non-IID and aware federated intrusion detection with PBFT with secured model aggregation for multi institutional healthcare internet of things networks

Multi-institutional healthcare Internet of Things (IoT) networks face a core challenge between combined intrusion detection and patient data privacy. Raw traffic records cannot be shared across institutional boundaries, yet local models trained on institution-specific data alone generalize poorly to attack distributions that differ from those practical in real healthcare IoT deployments. Federated Learning (FL) addresses privacy constraints by storing data locally at each institution, but it introduces statistical heterogeneity across institutions. Local data at each institution are non-independent and non-identically distributed due to clinical specialization, protocol diversity, and deployment-scale asymmetry. Standard federated averaging cannot handle this non-IID condition, and detection performance lowers significantly as a result. Existing Federated Intrusion Detection Systems (FIDS) implied that all participating institutions were honest. But this hypothesis cannot hold in real multi-institutional consortia, because Byzantine participants can corrupt the global model by submitting manipulated gradient updates. In this work, a Non-IID-Aware Federated Intrusion Detection System (N-IID-AFIDS) is proposed for multi-institutional healthcare IoT networks and is designed to address both challenges simultaneously. A cluster-weighted aggregation mechanism is used in this N-IID-AFIDS, grouping institutions by distributional similarity through spectral clustering of a Wasserstein-based affinity matrix and applying gradient divergence correction to submitted updates before aggregation. Protocol-aware Deep Sparse Autoencoder (DSAE) adaptation is also part of this model, and it uses local feature normalization based on an institutional protocol mixture and a distribution alignment regularizer. This regularizer operates without raw data exchange across institutions. This work extends practical Byzantine Fault Tolerance (PBFT) consensus from event logging for detection to model update validation. Geometric median-based Byzantine filtering, together with reputation-based participation control, is also added to this model. The proposed model is evaluated on the IoT-Flock and CICIoT2023 datasets across three non-IID severity levels, based on combined skew in quantity, labels, and features. It achieved non-IID detection accuracies of 93.17% on IoT-Flock and 89.84% on CICIoT2023. And this model is the only federated method in the comparison that reports non-IID performance on both datasets simultaneously. It also retains 83.61% accuracy with four Byzantine participants and meets a 16 ms clinical real-time detection constraint, converging in 29-67 rounds, faster than other federated baselines.