Towards decentralized cybersecurity: A novel privacy-preserving federated learning approach for botnet attack detection

The exponential proliferation of IoT devices has led to an alarming surge in botnet-based cyberattacks, necessitating advanced, privacy-preserving, and scalable detection mechanisms. Traditional centralized machine learning approaches for botnet detection face critical challenges, including data privacy risks, communication overhead, and model generalization issues. To address these concerns, this research presents a privacy-preserving Federated Learning (FL) approach for decentralized cybersecurity, using SHapley Additive exPlanations (SHAP)-based feature selection to enhance interpretability and model efficiency. The proposed method enables local models to be trained on edge devices without sharing raw data, preserving user privacy while maintaining robust detection capabilities. Using the MedBiot dataset, we evaluate the effectiveness of FL under both non-Independent and Identically Distributed (non-IID) and IID settings, where botnet attack types (e.g., Bashlite, Mirai, and Torii) are distributed across multiple federated clients. The experimental results indicate that the non-IID federated models achieved exceptional detection recall (99.98%), with high precision, accuracy, and F1-score across all clients, demonstrating resilience even in highly heterogeneous environments. The IID setting, where data were randomly distributed among clients, also maintained high classification accuracy (≈99.98%), highlighting the significance of localized attack patterns in federated cybersecurity. Additionally, SHAP-based feature selection optimizes performance by identifying the most critical features, reducing computational overhead while preserving explainability. The findings underscore the efficacy of FL for real-world IoT botnet detection, offering a scalable, secure, and interpretable solution to modern cybersecurity challenges.