Resilient unsupervised anomaly detection in contaminated IoT/IIoT edge environments: A federated approach

Internet of Things (IoT) and Industrial Internet of Things (IIoT) edge environments pose a major challenge for intrusion detection, as local traffic is often unlabelled, statistically heterogeneous, and already contaminated with hidden attacks. Under these conditions, many unsupervised and federated anomaly detection methods implicitly rely on benign local training data, which leads to unstable collaboration and severe performance degradation. This work introduces a resilient unsupervised federated anomaly detection architecture designed to operate under contaminated and non-independent and non-identically distributed (non-IID) edge conditions. At the client side, a sanitise-before-federate memory-augmented autoencoder (MemAE) pipeline applies warm-up reconstruction profiling and lower-tail thresholding to derive a clean mask before local refinement. At the server side, one-shot clustering over normalised bottleneck update signatures groups statistically related clients, enabling cluster-specific aggregation that mitigates negative transfer. Extensive experiments on RT-IoT2022, CICIoT2023, and NF-ToN-IoT-v2, including a comparison with six representative baselines, show that the proposed approach consistently preserves detection capability as contamination increases. From the clean setting to 30% contamination, it retains 91.0% of its initial recall on average across the three datasets, whereas the best competing method remains at 26.5%. Threshold-independent evaluation confirms the same trend, with 94.3% retention in the area under the receiver operating characteristic curve (AUC-ROC) and 98.4% retention in the area under the precision–recall curve (AUC-PR) in the most adverse setting. These gains are achieved with only moderate computational and communication overhead, suggesting the feasibility of the proposed framework for resilient federated intrusion detection in IoT/IIoT edge deployments.