Adaptive Federated Learning Defense Against Byzantine Attacks and Concept Drift in IIoT

Federated Learning (FL) enables collaborative intrusion detection in Industrial Internet of Things (IIoT) environments without compromising data privacy. However, FL systems face critical challenges from Byzantine attacks, where malicious clients send poisoned model updates, and concept drift, where data distributions evolve over time. Existing defenses typically force a trade-off between security and efficiency, employing either computationally expensive robust aggregation methods or fast but vulnerable approaches. This paper proposes an adaptive defense framework that dynamically responds to the threat landscape using lightweight statistical detection mechanisms. The system defaults to efficient Federated Averaging (FedAvg) aggregation and switches to robust methods only when attacks or drift are detected. We validated the framework through experiments on the Edge-IIoTset dataset and real-world deployment on five Raspberry Pi 3B devices. Results show the adaptive approach maintains F1=0.828 under 40% malicious clients and remains robust up to the 50% threshold.