Federated Learning for Real-Time Anomaly Detection in Industrial IoT Data

Thesis Abstract

Industrial Internet of Things (IIoT) environments generate continuous, high-velocity data streams from heterogeneous sensors and actuators, creating significant challenges for real-time anomaly detection due to data privacy, bandwidth constraints, and evolving operational conditions. This study addresses the problem of developing a privacy-preserving, scalable, and accurate anomaly detection framework capable of operating in real time across distributed industrial edge and cloud nodes. The aim is to design and evaluate a federated learning (FL) system that jointly trains anomaly detectors without centralizing sensitive process data, while ensuring robustness to non-IID data and concept drift. The specific objectives are (1) to formulate a federated anomaly detection architecture suitable for industrial telemetry streams; (2) to implement edge-to-cloud FL pipelines with lightweight local models and secure aggregation; (3) to compare federated deep autoencoder and one-class classification approaches against centralized baselines in terms of detection accuracy, false positive rate, and latency; (4) to analyze the impact of data heterogeneity, communication constraints, and concept drift on model performance; and (5) to develop deployment guidelines and governance for industrial stakeholders. The methodology adopts a mixed-methods, quasi-experimental design grounded in the theory of distributed statistical learning and the privacy-preserving learning paradigm. The population comprises heterogeneous IIoT systems from three manufacturing plants, totaling approximately 120,000 real-time telemetry records per 15-minute window, with sensor types including vibration, temperature, pressure, and electrical current. A stratified random sampling approach yields a representative subset of 40 edge devices and 6 cloud aggregators, with monthly data collections spanning six months. Data collection employs synchronized streaming logs, event-annotated fault labels from maintenance logs, and synthetic anomaly injections to augment rare fault scenarios. Local models at edge devices utilize lightweight autoencoder or isolation forest architectures, while the central server conducts secure aggregation via differential privacy and secure multiparty computation to form the global FL model. The analysis integrates quantitative methods—precision, recall, F1-score, area under the ROC curve (AUC), and inference latency—and qualitative assessment of deployment feasibility through stakeholder interviews. Model evaluation follows a replicated, cross-plant holdout design, with statistical comparisons against centralized training and non-FL baselines using repeated measures ANOVA and pairwise post hoc tests to detect performance differences under varying heterogeneity and drift conditions. Robustness to non-IID data is examined through a permutation-based significance test and a drift-aware adaptation mechanism, incorporating change-point detection with Bayesian online update rules. Expected findings indicate that federated models achieve comparable detection performance to centralized models while markedly reducing raw data exposure, with average AUC improvements of 3–6 percentage points over non-FL baselines and latency within 150–350 milliseconds per inference on edge devices. It is anticipated that edge-local models will exhibit higher sensitivity to device-specific patterns, while the federated aggregation will stabilize performance across plants, particularly under non-IID distributions. The study further expects that incorporating drift-aware online updates will mitigate accuracy degradation over time, sustaining F1-scores above 0.85 in most settings and maintaining false positive rates below 0.05. Theoretical interpretation will leverage the principles of distributed statistical learning and privacy-preserving computation, drawing on relevant theories such as Federated Learning theory and the bias-variance trade-off under data heterogeneity. The study contributes to knowledge by demonstrating the viability of privacy-preserving FL for real-time anomaly detection in diverse IIoT contexts, providing empirical benchmarks, and offering a deployable framework that balances detection performance, communication efficiency, and data governance. Practical implications include actionable guidelines for selecting model architectures, topology of edge-cloud collaboration, secure aggregation parameters, and drift management strategies. The recommendations inform industrial stakeholders on scalable deployment, governance compliance, and operational risk mitigation, while suggesting avenues for future work such as extending to multimodal data fusion, adaptive resource allocation, and automated incident response mechanisms. The main conclusion posits that federated learning can deliver near-equivalent anomaly detection performance to centralized approaches while preserving data privacy and reducing network bandwidth requirements, provided that attention is given to heterogeneity handling, secure aggregation, and timely drift adaptation.