A Zero-Trust Micro-Segmentation Framework with Federated Anomaly Detection for Heterogeneous Smart Home Ecosystems

Today, with the emergence of the Internet of Things (IoT) in smart home technology, new security issues have arisen, including device diversity, data privacy concerns, and susceptibility to advanced, complex attacks. Traditional Intrusion Detection Systems (IDS) face critical challenges, including single points of failure, high communication overhead, and inherent privacy violations, which the proposed decentralised approach addresses. In this paper, a novel Federated Anomaly Detection for Heterogeneous Smart Home Environment-based Zero-Trust Micro-Segmentation (CloudShield-IoT) framework is introduced. The proposed architecture introduces three key innovations: (i) the dynamic micro-segmentation engine to enforce zero-trust policies by periodically authenticating devices and monitoring their behaviour, (ii) the privacy-preserving federated learning module for collaborative intrusion classification across distributed smart home nodes without exchanging raw data. Note that the core detection module performs supervised intrusion classification using labelled attack categories; the term “anomaly detection” in this paper refers to the broader system-level behavioural-deviation monitoring achieved through the hierarchical trust-scoring mechanism. Moreover, (iii) the hierarchical trust-scoring module adaptively isolates compromised devices in real time. The framework is extensively tested on publicly available benchmark datasets, including N-BaIoT and IoT-23, and compared against 10 state-of-the-art baselines. CloudShield-IoT achieves 98.8% detection accuracy, an F1-score of 0.982, and an AUC of 0.993 without differential privacy, with an inference latency of only 12.4 ms. With practically meaningful (ε = 5.0, δ = 1 × 10−5) differential privacy via a moments accountant, the framework obtains an accuracy of 97.6%, an F1-score of 0.975, and an AUC of 0.989. The framework demonstrates strong resilience against Byzantine adversarial attacks. It maintains excellent scalability for deployments of up to 500 nodes, supporting heterogeneous device configurations ranging from 10 identical-type devices to 100 mixed-type devices per node.