Adaptive Trust-Weighted Federated Threat Learning for Secure and Privacy-Preserving Intrusion Detection in Mobile Ad Hoc Networks

Abstract

Mobile Ad Hoc Networks (MANETs) provide decentralized and infrastructure-less communication for applications such as military communication, disaster management, emergency response, intelligent transportation, healthcare monitoring, and Internet of Things environments. However, their dynamic topology, limited resources, and absence of centralized administration make them vulnerable to attacks such as blackhole, wormhole, Sybil, flooding, grayhole, and denial-of-service attacks. Conventional centralized intrusion detection approaches require the transfer of sensitive traffic data to a central server, resulting in privacy, communication, and scalability challenges. Federated Learning (FL) addresses these limitations by allowing distributed nodes to train local models without sharing raw traffic data. However, conventional federated aggregation methods such as FedAvg generally assign equal importance to participating clients and may therefore be vulnerable to unreliable or malicious model updates.

To address these limitations, this paper proposes an Adaptive Trust-Weighted Federated Threat Learning (ATFTL) framework for privacy-preserving intrusion detection in MANETs. The proposed approach introduces a Dynamic Trust Weight (DTW) mechanism that jointly considers the Node Reliability Index (NRI), Residual Energy Score (RES), Communication Stability Factor (CSF), and Historical Detection Accuracy (HDA) of participating nodes. An adaptive malicious-update filtering mechanism further evaluates local model deviation and reduces the contribution of suspicious updates before federated aggregation. The accepted updates are subsequently combined using trust-weighted federated aggregation to generate an optimized global threat intelligence model. The framework was implemented using the CICIDS2017 dataset with distributed local training using a CNN–LSTM model. The simulation evaluates network sizes ranging from 50 to 250 nodes and compares ATFTL with FedAvg and FedMADE using Average DTW, Malicious Update Detection Rate, False Rejection Rate, Trusted Node Ratio, and Communication Overhead. The final threat-detection simulation reports 99.18% accuracy, 96.02% precision, 98.96% recall, 98.99% F1-score, and 0.998 AUC. The comparative results demonstrate that ATFTL improves trust-aware participant selection, malicious-update detection, and reliable federated aggregation while maintaining comparatively lower communication overhead.