Dual-Layer Defense: Blockchain-Secured Federated Learning Architecture for Trustworthy Anomaly Detection in IoT-Enabled Smart Grids

Integrating the Industrial Internet of Things (IIoT) into smart grids improves their operational efficiency but expands their attack surface. Federated learning (FL) enables privacy-preserving collaborative anomaly detection, but exchanged model updates remain exposed to tampering, impersonation, and replay. This paper proposes a dual-layer architecture in which FL performs distributed anomaly detection at edge nodes without sharing raw data, while a blockchain layer secures the exchanged parameters. Each local update is encrypted using ephemeral elliptic-curve Diffie–Hellman key agreement, a hash-based message authentication code-based key-derivation function, and Advanced Encryption Standard in Galois/Counter Mode; committed through a Merkle root and a digital signature; and recorded by an Ethereum smart contract that enforces node registration and round consistency. Evaluated with nine non-independent and identically distributed clients on the UNSW-NB15 and Edge-IIoTset datasets, the architecture achieves accuracies of 81.41% and 94.76% and F1 scores of 85.55% and 94.81%, respectively. Because the parameters are recovered exactly, detection performance is unaffected. Securing one update requires 0.394 ms at the edge node and 0.518 ms at the global node for the UNSW-NB15, and 1.884 ms at the edge node and 2.229 ms at the global node for the Edge-IIoTset dataset. Functional security testing demonstrates that all tampering, replay, impersonation, and unauthorized-submission attempts were detected. Parameter-level integrity protection can therefore be added to FL-based anomaly detection at low cost.