  The vast increase of Internet of Things (IoT) technologies and the
ever-evolving attack vectors have increased cyber-security risks dramatically.
A common approach to implementing AI-based Intrusion Detection systems (IDSs)
in distributed IoT systems is in a centralised manner. However, this approach
may violate data privacy and prohibit IDS scalability. Therefore, intrusion
detection solutions in IoT ecosystems need to move towards a decentralised
direction. Federated Learning (FL) has attracted significant interest in recent
years due to its ability to perform collaborative learning while preserving
data confidentiality and locality. Nevertheless, most FL-based IDS for IoT
systems are designed under unrealistic data distribution conditions. To that
end, we design an experiment representative of the real world and evaluate the
performance of an FL-based IDS. For our experiments, we rely on TON-IoT, a
realistic IoT network traffic dataset, associating each IP address with a
single FL client. Additionally, we explore pre-training and investigate various
aggregation methods to mitigate the impact of data heterogeneity. Lastly, we
benchmark our approach against a centralised solution. The comparison shows
that the heterogeneous nature of the data has a considerable negative impact on
the model's performance when trained in a distributed manner. However, in the
case of a pre-trained initial global FL model, we demonstrate a performance
improvement of over 20% (F1-score) compared to a randomly initiated global
model.
