Secure federated multi-vector DDoS detection with explainable SDN-IoT framework: fortified OTA updates

The exponential development of Internet of Things (IoT) devices has significantly improved exposure to cyber threats, which threaten both network stability and the security of Over-the-Air updates (OTA) firmware updates. Existing security mechanisms often struggle with limited scalability, privacy concerns, and insufficient real-time detection capabilities across heterogeneous IoT environments. To overcome these challenges, the present studyproposes a novel software-defined networking security framework integrating federated deep learning for collaborative attack classification and OTA protection. The Multi-expertdual stream heterogeneous Federated learning-based Convolutional Transformer (MFCT) model achieves accurate classification while preserving data privacy at edge gateways. Encrypted model aggregation and secure cloud storage are implemented using Homomorphic Adaptive Elliptic Curve Cryptography (HA-ECC), allowing computations on encrypted data and safeguarding sensitive information. Furthermore, feature selection is optimized via the Adaptive Projection-iTerative-Methods-based Optimizer (APTMO), enhancing model efficiency. To improve transparency and trust, Local Interpretable Model-Agnostic Explanations (LIME) are employed, providing human-understandable insights into model predictions. The proposed MFCT model demonstrates strong and reliable performance, achieving encryption and decryption times of 1.2–3.0 s and 1.2–1.8 s, respectively, OTA integrity of approximately 97.8%, a threat detection rate of around 98%, and classification accuracy of up to 98.8% across diverse IoT datasets. The MFCT framework ensures robust and real-time attack detection, secure OTA updates, and computational efficiency, while enhancing interpretability and maintaining scalability and privacy preservation for heterogeneous IoT environments.