Federated ConvNeXt-swin temporal fusion network for malware and botnet detection in IoT systems

The rapid expansion of Internet of Things (IoT) infrastructures has significantly increased the exposure of edge devices to malware and botnet attacks. Conventional intrusion detection systems are largely centralized and struggle to operate effectively in decentralized, heterogeneous, and privacy-sensitive IoT environments, thereby limiting scalability and robustness. To address these challenges, this study proposes the Federated ConvNeXt–Swin Temporal Fusion Network (F-CSTFNet), a federated deep learning framework designed for distributed IoT malware and botnet detection. The proposed architecture integrates ConvNeXt-based convolutional feature extraction with Swin Transformer temporal attention to capture both local traffic patterns and long-range behavioral dependencies within network flows. This hybrid convolution–attention design enables the detection of short-term anomalies as well as evolving attack dynamics directly from network telemetry. In addition, a channel-adaptive feature recalibration mechanism enhances robustness when learning from heterogeneous and noisy client data. The model is trained using a federated learning paradigm that enables multiple IoT clients to collaboratively learn a global model without sharing raw data, thereby preserving data privacy and locality. Extensive experiments conducted on the IoT-23 and N-BaIoT datasets demonstrate that F-CSTFNet outperforms several state-of-the-art centralized and federated baselines in terms of detection accuracy, convergence stability, and client-level fairness. The framework also achieves low performance variance across clients, a high Jain’s Fairness Index (JFI), and reduced inequality during distributed training. These results demonstrate the effectiveness of the proposed architecture as a scalable, privacy-preserving, and resilient intrusion detection framework for next-generation IoT security systems.