Calibrated Federated Intrusion Detection for Drone Swarms under Non-IID Feature Skew

For the protection of critical infrastructure with
drone swarms, an intrusion detection system must be able
to detect intrusion without concentrating sensitive telemetry.
Evaluation leakage, which has been commonly used in prior
federated learning (FL) based intrusion detection approaches, has
been shown to lead to high discrimination scores, but these prior
works have overlooked the probability calibration aspect and
have resulted in overconfident alerts under non-IID feature skew.
We propose an uncertainty-aware intrusion detection system
that is trained using federated learning and tested under a
leakage-safe protocol, comprised of chronological holdout splits,
cross-split duplicate hashing, and feature hardening. With the
ISOT Drone Intrusion dataset, we create a setting of ten clients
with a feature-skew distribution, and compare four aggregation
strategies (FedAvg, FedProx, FedNova, FedDyn) using operating
points found through Youden’s J statistic. Accuracy and Macro
F1 are used to measure the predictive quality, while Expected
Calibration Error (ECE) after post-hoc temperature scaling is
used to measure the reliability, and SHAP is employed as a
behavioral inspection tool. The upper bound is given by a
centralized Random Forest with Macro F1 = 0.9896. When the
skew is severe, FedAvg achieves 98.60% accuracy and Macro
F1 = 0.9844 and temperature scaling makes the ECE 0.0027
thus allowing selective alerting to reduce false alarms. The
federated model is also better at withstanding skew, as shown in
explainability analysis, in that it is more agile than centralized
models with respect to spatial identifiers. These results apply to
the particular dataset and construction of the non-IID system
and may not represent all shifts in deployments; however, they
suggest that an FL system can provide near-centralized UAV
intrusion detection with reliable human-in-the-loop deferral.