[Paper Review] TemporalFED: Detecting Cyberattacks in Industrial Time-Series Data Using Decentralized Federated Learning

Ángel Luis Perales Gómez, Enrique Tomás Martínez Beltrán+2 more|arXiv (Cornell University)|Aug 7, 2023

Network Security and Intrusion DetectionComputer Science3 citations

TL;DR

This paper proposes TemporalFED, a decentralized federated learning framework for detecting cyberattacks in industrial time-series data by integrating time-series conversion, feature engineering via DFT and autocorrelation, and stationarity transformation. It achieves a 0.9406 F1-score using Semi-Decentralized FL with a fully connected topology, outperforming centralized and other decentralized configurations while minimizing resource usage when feature engineering is omitted.

ABSTRACT

Industry 4.0 has brought numerous advantages, such as increasing productivity through automation. However, it also presents major cybersecurity issues such as cyberattacks affecting industrial processes. Federated Learning (FL) combined with time-series analysis is a promising cyberattack detection mechanism proposed in the literature. However, the fact of having a single point of failure and network bottleneck are critical challenges that need to be tackled. Thus, this article explores the benefits of the Decentralized Federated Learning (DFL) in terms of cyberattack detection and resource consumption. The work presents TemporalFED, a software module for detecting anomalies in industrial environments using FL paradigms and time series. TemporalFED incorporates three components: Time Series Conversion, Feature Engineering, and Time Series Stationary Conversion. To evaluate TemporalFED, it was deployed on Fedstellar, a DFL framework. Then, a pool of experiments measured the detection performance and resource consumption in a chemical gas industrial environment with different time-series configurations, FL paradigms, and topologies. The results showcase the superiority of the configuration utilizing DFL and Semi-Decentralized Federated Learning (SDFL) paradigms, along with a fully connected topology, which achieved the best performance in anomaly detection. Regarding resource consumption, the configuration without feature engineering employed less bandwidth, CPU, and RAM than other configurations.

Motivation & Objective

• To address the single point of failure and network bottleneck in centralized federated learning (CFL) for industrial cyberattack detection.
• To enable effective anomaly detection in industrial time-series data using decentralized federated learning (DFL) while preserving data privacy.
• To evaluate the performance and resource consumption trade-offs of different FL paradigms (DFL, SDFL, CFL), topologies, and time-series processing configurations.
• To develop and validate a modular time-series processing pipeline—TemporalFED—specifically tailored for industrial anomaly detection in DFL settings.
• To provide empirical insights into the optimal configuration for high-accuracy, low-overhead cyberattack detection in industrial IoT environments.

Proposed method

• TemporalFED processes tabular industrial data by converting it into time-series format suitable for deep learning models.
• It applies Discrete Fourier Transform (DFT) and autocorrelation (AC) to extract discriminative temporal features from time-series data.
• It enforces time-series stationarity by removing trends and seasonal components to improve model generalization and training stability.
• The framework is integrated into Fedstellar, a decentralized FL platform, enabling training without a central parameter server.
• Experiments are conducted using the Tennessee Eastman industrial process simulator to emulate geographically distributed, realistic industrial scenarios.
• Performance is evaluated across 20 configurations varying FL paradigm (DFL, SDFL, CFL), topology (fully connected, ring, star), and component usage (time-series conversion, feature engineering, stationarity conversion).

Experimental results

Research questions

• RQ1 Which FL paradigm—centralized, decentralized, or semi-decentralized—yields the highest anomaly detection performance in industrial time-series data?
• RQ2 How do different network topologies (fully connected, ring, star) affect detection accuracy and resource consumption in decentralized FL settings?
• RQ3 What is the impact of time-series preprocessing components (conversion, feature engineering, stationarity) on detection performance and system resource usage?
• RQ4 How does the inclusion of feature engineering affect bandwidth, CPU, and RAM consumption in federated training?
• RQ5 What is the optimal configuration of TemporalFED for balancing high detection accuracy and low computational overhead in industrial cyberattack detection?

Key findings

• The Semi-Decentralized Federated Learning (SDFL) paradigm with a fully connected topology achieved the highest F1-score of 0.9406, outperforming other configurations.
• The DFL paradigm with a fully connected topology achieved a F1-score of 0.9405, demonstrating strong performance close to SDFL.
• Configurations without feature engineering consumed the least bandwidth, CPU (80% consistently), and RAM (10–15%), indicating lower resource overhead.
• The DFL with ring topology and full component usage consumed up to 30% of RAM, while the CFL paradigm with feature engineering used less RAM than DFL in similar setups.
• CPU usage remained consistently high at approximately 80% across all configurations, with feature engineering components causing longer CPU utilization.
• The configuration using only feature engineering under SDFL with fully connected topology maintained stable, near-constant CPU usage throughout training.