Scaling Intrusion Detection for Heterogeneous IoT Networks: A Federated Active Learning Approach

 The increasing growth of the Internet of Things (IoT) has outpaced traditional security measures, leaving resource-constrained devices vulnerable to increasingly sophisticated attacks. This study proposes the Distributed Immune Security Architecture (DISA), a novel bio-inspired framework that integrates modular components across Cloud, Fog, and Edge tiers for robust traffic monitoring and anomaly detection. Central to DISA is the ``Fed-Active'' model, a distributed intrusion detection strategy that synergistically combines Federated Learning (FL) with Active Learning (AL) to minimize data labeling costs and communication overhead. Experimental evaluations demonstrate that Fed-Active achieves a detection accuracy of 96.01\%, nearly matching centralized approaches (96.92\%) while reducing bandwidth consumption by over 90\%. These results indicate that Fed-Active provides a scalable, privacy-preserving, and communication-efficient solution for securing heterogeneous IoT environments.