Federated Reinforcement Learning–Driven Multi-Task Optimization for Robust and Ethical Edge Internet of Things Security

The NSL-KDD dataset is employed as the benchmark for evaluating the proposed framework. It is a refined version of the original KDD'99 dataset, widely recognized in the network intrusion detection community. NSL-KDD eliminates redundant and duplicate records, providing a more balanced and realistic evaluation environment. The dataset comprises 125,973 training instances and 22,544 test instances, each characterized by 41 features across three categories: basic connection features (e.g., protocol type, service, connection status), content-based features (e.g., number of failed logins, root access), and traffic statistics within time windows (e.g., count of connections, rate of same-host/service connections).The instances are labeled into four primary attack types: DoS (Denial of Service), Probe, R2L (Remote to Local), and U2R (User to Root). Among them, U2R and R2L are low-frequency yet high-risk attack types, accounting for only 0.04% and 0.99% of the test set, respectively, posing significant challenges for detection models. The dataset exhibits non-IID (non-independent and identically distributed) characteristics, making it suitable for simulating realistic federated learning scenarios with data heterogeneity across edge nodes. All categorical features are encoded using one-hot representation, and numerical features are standardized, resulting in a 122-dimensional input vector for model training and evaluation.