Split-Parameter Federated Learning Detects Cyber Threats Across Incompatible Network Infrastructures

Modern organizational cybersecurity faces an intensifying structural barrier as enterprise IT systems, industrial operational technology, and consumer Internet of Things hardware converge into interconnected operational environments. While coordinated cyber campaigns frequently navigate across these boundaries—originating within enterprise corporate networks before pivoting to compromise operational controllers or weaponize smart devices—defenders have historically lacked mechanisms to correlate attack signals without consolidating raw telemetry into centralized repositories. This operational limitation stems from fundamental architectural incompatibility: enterprise networks record volumetric flow statistics and packet headers across dozens of metrics, industrial control systems capture physical sensor values such as fluid pressures and valve positions, and device ecosystems log high-frequency temporal traffic intervals. Because no direct mathematical correspondence exists between these disparate feature schemas, conventional collaborative machine learning frameworks cannot process the pooled data, leaving defenders blind to cross-infrastructure attack trajectories.

To overcome this limitation without compromising sensitive operational telemetry, researchers Sunil Kumar Yadav, Vivek Kumar Verma, and Vivek Bhardwaj have introduced a split-parameter federated learning architecture that enables cross-domain intrusion detection across heterogeneous security infrastructures. Reported in Discover Internet of Things, the approach resolves schema incompatibility by strictly bifurcating the underlying neural network models into domain-specific encoders and a single shared classification head. Rather than forcing diverse input streams into a compromised universal format or transmitting intermediate activations that could expose proprietary operational records, participating institutions keep their schema-specific feature extractors entirely on local hardware. The decentralized clients collectively synchronize only a compact, lightweight classification module across training rounds, allowing collaborative pattern discovery across enterprise IT, critical industrial infrastructure, and connected device fleets while maintaining strict data locality.

The engineering architecture addresses a mathematical constraint that has long defeated standard federated algorithms like Federated Averaging, which mandate that all participating nodes evaluate identical model dimensions and shared feature schemas. In the researchers’ design, each distinct security domain trains a dedicated multi-layer perceptron encoder tasked with projecting its native feature space into a fixed sixty-four-dimensional latent representation space. An enterprise IT deployment with forty-two network parameters, an industrial control system monitoring sixty-one sensor metrics, and an Internet of Things environment evaluating one hundred and fifteen statistical features each utilize bespoke input dimensions. These local encoder configurations, comprising between 7,168 and 11,840 parameters depending on input width, remain strictly confidential to their respective domains and are never transmitted across the network, completely preventing cross-domain schema leakage.

Collaboration occurs entirely at the boundary of the classification head, an auxiliary multi-layer perceptron configured with 4,418 parameters that accepts sixty-four-dimensional inputs and produces binary benign-or-attack predictions. During each training round, participating domains execute two local training epochs across their resident datasets to simultaneously update their private encoders and local copies of the classification head. The clients then upload only their modified 4,418 classification parameters to a central aggregation server, which calculates a sample-weighted average based on domain volume before broadcasting the updated head back to participants. This partitioned transmission profile requires just 17.7 kilobytes per client per round, reducing communicated parameters by 89.1 percent compared to a theoretical full-model federation reference and by 49.3 percent against standard feature-projection baselines while consuming merely twenty megabytes of memory on consumer-grade graphics processing hardware.

The experimental evaluation tested the split-parameter framework across three benchmark datasets representing the spectrum of contemporary digital infrastructure: the UNSW-NB15 enterprise network dataset containing 257,000 samples across forty-two features, the HAI industrial control system dataset comprising 1.4 million sensor records across sixty-one physical parameters, and the N-BaIoT botnet dataset spanning seven million samples across one hundred and fifteen device traffic statistics. Over twenty federation rounds evaluated across five deterministic random seeds, the collaborative system achieved an overall sample-weighted F1 score of 0.9738, supported by a 95 percent confidence interval spanning 0.9736 to 0.9739. The architecture attained a global threat detection rate of 93.5 percent and constrained the global false alarm rate to 3.1 percent, outperforming every isolated single-domain binary classifier evaluated under identical conditions.

A critical analytical contribution of the study lies in demonstrating how aggregated, sample-weighted performance metrics can obscure acute performance disparities among participating sectors. Because the massive N-BaIoT dataset accounts for eighty-one percent of all evaluated records, global calculations heavily reflect its individual performance characteristics. To provide an unvarnished assessment of operational utility, the researchers examined unweighted macro metrics, revealing a macro-averaged F1 score of 0.846 and a macro detection rate of 84.57 percent. When evaluated under controlled binary baseline comparisons, cross-domain federation substantially improved the industrial control system’s threat capture, lifting the HAI detection rate from 58.0 percent in isolated training to 80.0 percent within the federated framework, while concurrently suppressing enterprise network false alarms from 34.3 percent down to 7.28 percent.

Despite these demonstrable diagnostic improvements, the empirical trajectories exposed substantial operational volatility during collaborative optimization, particularly within the industrial control domain. While the Internet of Things classifier converged almost instantaneously and maintained stability across nineteen of twenty rounds, the industrial system exhibited extreme performance oscillations, toggling between near-perfect detection exceeding ninety-nine percent and severe collapse below two percent across eleven of the twenty training iterations. Enterprise IT performance exhibited correlated fluctuations, alternating between 23.5 percent and 93.8 percent accuracy across the timeline. This turbulence demonstrated that cross-domain parameter averaging can destabilize minority or specialized participants even as global diagnostic summaries project seamless operational stability.

Through quantitative tracking of gradient update norms and inter-domain cosine similarity, the researchers diagnosed the mechanical etiology of this instability as acute gradient conflict occurring within the shared classification head. Gradient cosine similarity measurements between enterprise network and industrial control updates fluctuated between positive 0.31 and negative 0.36 across rounds, confirming that semantically divergent feature spaces routinely generated directly opposing optimization vectors. Furthermore, update norms from the enterprise IT domain averaged 23.7, completely overwhelming the subtle 0.48 update magnitudes produced by the industrial control system. Although client drift remained negligible below 0.1 percent, the dominant enterprise updates repeatedly erased the delicate boundary adjustments established by industrial controllers, causing severe recurring detection failures until representations gradually stabilized in later rounds.

To resolve these destabilizing dynamics, the authors evaluated targeted mitigation strategies, including domain-specific gradient scaling and global learning rate dampening. Dampening the base optimizer learning rate by a factor of 0.3 successfully eliminated collapse episodes entirely across validation trajectories, establishing an uninterrupted 99.49 percent mean validation accuracy with a standard deviation of just 0.09 percent. Alternatively, scaling the shared-head gradient updates from dominant domains by a factor of 0.5 abolished oscillatory collapse while securing an improved industrial detection rate of 60.9 percent and an F1 score of 0.704. These findings demonstrate that inter-domain gradient competition can be managed through simple parameter adjustments, providing concrete implementation safeguards for production deployments connecting sensitive infrastructure.

To investigate how a single classification head reconciles incompatible inputs, the team conducted representation alignment analyses using Centered Kernel Alignment and Canonical Correlation Analysis across latent feature spaces. The empirical measurements uncovered uniformly low alignment scores, with kernel alignment remaining below 0.002 across all domain pairings and canonical correlation hovering between 0.0 and 0.035. Rather than forcing divergent telemetry into an identical geometrical manifold, the sixty-four-dimensional bottleneck forces domain encoders to isolate minimal sufficient statistics representing systemic deviations from operational normality. The superior diagnostic calibration achieved by the federated system therefore originates from gradient diversity across disparate operational perspectives rather than direct representation alignment, confirming that multi-view gradient regularization prevents models from overfitting to domain-specific telemetry quirks.

The authors contextualize their architectural findings within distinct operational boundaries, noting that their experimental validation utilized static testbed datasets rather than live production traffic, leaving challenges such as real-time concept drift and extreme natural class imbalances unexamined. Furthermore, while partitioned parameters prevent raw feature reconstruction and protect local encoder weights, the design does not incorporate formal cryptographic guarantees like differential privacy or Byzantine-fault-tolerant aggregation protocols to thwart adversarial poisoning. Nevertheless, by demonstrating that parameter splitting permits effective collaborative threat detection across irreconcilable data formats without telemetry migration, the research establishes a viable structural blueprint for unified cyber defense across critical national infrastructure, smart industrial manufacturing, and distributed computing ecosystems.

Subject of Research: Cross-domain federated intrusion detection across heterogeneous security telemetry

Article Title: Split-parameter federated learning for threat detection across heterogeneous security infrastructures

Article References: Yadav, S. K., Verma, V. K., & Bhardwaj, V. (2026). Split-parameter federated learning for threat detection across heterogeneous security infrastructures. Discover Internet of Things, 6(1), Article 274. https://doi.org/10.1007/s43926-026-00520-6

Image Credits: AI Generated

DOI: 10.1007/s43926-026-00520-6

Keywords: federated learning, intrusion detection systems, network security, operational technology, industrial control systems, Internet of Things, split learning, UNSW-NB15, HAI dataset, N-BaIoT, gradient conflict, data locality, communication efficiency, cybersecurity telemetry, cross-domain threat detection, information bottleneck, representation alignment