###### Abstract  
The rapid convergence of 5G networks and Internet of Things (IoT) technologies has unlocked unprecedented connectivity and responsiveness across smart environments--but has also amplified cybersecurity risks due to device heterogeneity, data privacy concerns, and distributed attack surfaces. To address these challenges, we propose Edge-FLGuard, a federated learning and edge AI-based anomaly detection framework tailored for real-time protection in 5G-enabled IoT ecosystems. The framework integrates lightweight deep learning models--specifically autoencoders and LSTM networks--for on-device inference, combined with a privacy-preserving federated training pipeline to enable scalable, decentralized threat detection without raw data sharing. We evaluate Edge-FLGuard using both public (CICIDS2017, TON_IoT) and synthetic datasets under diverse attack scenarios including spoofing, DDoS, and unauthorized access. Experimental results demonstrate high detection accuracy (F1-score \(\geq\) 0.91, AUC-ROC up to 0.96), low inference latency (<20 ms), and robustness against data heterogeneity and adversarial conditions. By aligning edge intelligence with secure, collaborative learning, Edge-FLGuard offers a practical and scalable cybersecurity solution for next-generation IoT deployments.  
federated learning; edge AI; IoT security; 5G networks; anomaly detection; privacy-preserving machine learning +
Footnote †: 2020: _Applied Sciences_  
systems can learn behavioral patterns and detect threats with reduced dependency on central cloud resources [8]. However, many AI-driven systems still require centralized training on large volumes of sensitive data, which may not be feasible or desirable in privacy-sensitive applications [9]. In large-scale IIoT networks, such architectures also face scalability and adaptability issues [10].  
Federated learning (FL), a distributed machine learning paradigm, addresses this limitation by enabling collaborative model training across edge devices without transferring raw data [11]. FL has been increasingly explored in the context of IoT security for applications such as distributed anomaly detection [12], but challenges remain in ensuring scalability, resilience to heterogeneous data distributions, and defense against model poisoning or adversarial attacks [6; 13]. Notably, several studies have revealed the susceptibility of FL systems to backdoors and malicious gradient manipulation [11; 13].  
This paper proposes Edge-FLGuard, a federated learning and edge AI-based security framework for real-time anomaly detection in 5G-enabled IoT networks, to address the key research question: Can federated edge intelligence enable privacy-preserving, real-time anomaly detection across highly distributed and heterogeneous IoT networks? The framework combines lightweight deep learning models (autoencoders and LSTMs) with privacy-preserving FL protocols to detect unauthorized behavior at the edge while ensuring minimal latency and communication overhead. The system is evaluated using public and synthetic datasets simulating DDoS, spoofing, and access control violations, with results showing F1-scores exceeding 0.91 and AUC-ROC values up to 0.96, along with significant improvements in scalability and latency compared to centralized baselines. Edge-FLGuard builds on prior FL+Edge approaches by integrating adversarial robustness mechanisms, differential privacy metrics, and support for non-IID personalization [12].  
The remainder of this paper is organized as follows: Section 2 reviews the related literature on AI-based IoT security and federated approaches. Section 3 details the proposed architecture and system components. Section 4 states experimental setup, while Section 5 presents the methodology. Section 6 presents the experimental setup and configuration, Section 7 states the results, and Section 8 states conclusion and future.