Federated Gradient Boosting for IOT Intrusion Detection: A Non-IID Evaluation of LightGBM and XGBoost under Manual FedAvg on TON_IoT

IOT deployments expose distributed edge devices to a widening range of network intrusion threats, yet centralised intrusion detection systems conflict with data sovereignty constraints in such environments. Federated learning addresses this by training local models on each device while sharing only model parameters, but existing FL-based intrusion detection studies rely almost exclusively on neural network architectures and evaluate under a sin-gle data partition configuration. Gradient boosting classifiers (LightGBM and XGBoost) have not been evaluated in a federated setting, the sensitivity of detection performance to client heterogeneity is unquantified, and fewer than 13% of reviewed studies report the computational efficiency profile needed for deployment tier assignment. This paper addresses all three gaps through a federated evaluation of LightGBM and XGBoost on the TON_IoT network traffic dataset under a systematic three-level Dirichlet heterogeneity sweep (α ∈ {0.1, 0.5, 1.0}) across five clients and ten aggregation rounds; both detection performance and computational efficiency were measured. At α = 1.0, LightGBM achieved a macro-averaged F1 of 0.9430 and XGBoost 0.9427; federation costs were 0.0072 and 0.0083 respectively against their centralised baselines. At α = 0.1, XGBoost degraded to a macro-F1 of 0.6716 (federation cost 0.2794); this is attributable to level-wise tree growth without multi-class reweighting under severe class skew. AUC-ROC was above 0.99 at all levels despite macro-F1 degradation at α = 0.1, indicating a calibration gap between ranking and classification performance under non-IID conditions. All six configurations were assigned to the gateway-class deployment tier; model sizes ranged from 2,520.6 KB to 28,723.1 KB; all configurations exceeded the MCU-class ceiling. XGBoost at α = 1.0 presents the best trade-off; its latency is 296.8 µs, model size 6,111.1 KB, and federation cost 0.0083.

Keywords: federated learning; intrusion detection; Internet of Things; LightGBM; XG-Boost; non-IID data; gradient boosting; TON_IoT.