# Federated Learning for Cybersecurity: A Privacy-Preserving Approach
## 4 Experimental Setup and Evaluation
### Case Study: Federated Intrusion Detection in a Smart Healthcare IoT Network  
To validate the SecFL-IoT framework in a real-world context, we conducted a simulation within a smart healthcare infrastructure where distributed IoT devices are essential for monitoring patients and ensuring operational continuity. The case study emulates a hospital network with virtual departments containing smart devices, such as ECG monitors, infusion pumps, temperature sensors, and wearable health trackers. These devices generate sensitive telemetry data that is governed by GDPR and HIPAA [13; 14], which makes centralized data transfer legally and ethically infeasible.  
The simulated deployment adheres to the architectural design shown in Figure 1. Each IoT node represents a medical endpoint running the local FL client. The training process involves the following:  
1. Local Real-Time Threat Detection: Devices analyze incoming data streams to identify anomalies based on previously trained models. These threat signatures include port scans, unauthorized API calls, and malformed packet payloads.
2. Encrypted Model Updates: After local training, models are updated and encrypted using Dilithium-based post-quantum cryptography. This ensures secure transmission under adversarial threat models.
3. Secure Aggregation Server: The fog-layer aggregation server combines encrypted updates from clients using SMPC protocols. These updates are validated for authenticity using blockchain logs.
4. Auditability and Integrity: Hyperledger Fabric's permissioned blockchain logs every model update with metadata, including timestamp, hash, and origin ID. This ensures traceability and prevents rollback or poisoning attempts.  
Figure 9 illustrates the process, depicting the sequential data flow from client-side detection to global model synchronization.  
The experimental environment was deployed using Docker containers for edge nodes and fog servers. All the containers were connected via a Tailscale VPN to simulate encrypted communication over links with variable latency. The datasets were partitioned according to medical unit (e.g., ICU, ER, recovery room), mimicking the realistic segregation of data within departments. TON_IoT telemetry streams were aligned with device-specific profiles. CICIDS2017 provided network intrusion scenarios for injecting malicious behavior.  
To make a comparison with state-of-the-art alternatives, we benchmarked our case study setup against centralized models that were trained under identical conditions. Our federated architecture outperformed centralized baselines in F1 score (+3.1%), maintained privacy loss below 5%, and reduced communication overhead by 23%.  
While other studies, such as refs. [1; 24; 36], propose cryptographic isolation or localized learning in healthcare FL, they often lack integrated blockchain validation or post-quantum resilience. Our framework natively combines these features, making it suitable for smart hospitals, remote patient monitoring, and cross-clinic AI collaboration under strict compliance regimes.  
In conclusion, this case study demonstrates the operational feasibility of our integrated FL stack (SecFL-IoT) and shows how it simultaneously addresses privacy, efficiency, and resilience in a safety-critical, real-time environment.