ATLAS-FL: Active Timing-Adversary-Resilient Secure Aggregation for Gateway-Assisted IoT, IIoT, and IoMT Federated Intrusion Detection

Federated learning (FL) enables distributed intrusion detection without centralizing raw Internet of Things (IoT), Industrial IoT (IIoT), or Internet of Medical Things (IoMT) traffic. Secure aggregation protects update contents, but it does not authenticate the temporal context in which a protected contribution is admitted. An active network adversary may delay, suppress, replay, or slot-shift otherwise valid submissions, thereby shaping the accepted cohort, inflating survivor weights, and exposing participation through release traces. This study presents ATLAS-FL, an authenticated temporal-integrity layer for masking-based secure aggregation. The protocol binds client identity, round, slot, timing window, fresh nonce, and ciphertext digest through the Hash-based Message Authentication Code using SHA-256 (HMAC-SHA256); performs replay-cache and slot-consistency checks before Bonawitz-style mask recovery; fixes aggregation weights before arrivals are observed; and releases a fixed-length envelope at a committed time. A formal game-based analysis reduces temporal-binding forgery and cross-round replay to HMAC unforgeability and hash collision resistance, while proving no post-hoc survivor-weight inflation under the fixed-weight rule. The evaluation replicates the same protocol across Edge-IIoTset, N-BaIoT, CICIoMT2024, and WUSTL-EHMS-2020 and introduces FedBuff and FedBuff-SecAgg to separate benign straggler tolerance from adversarial timing integrity. Under the twenty-run profile, ATLAS-FL retains attacked macro-F1 of 93.1 ± 0.4% on Edge-IIoTset, 95.8 ± 0.3% on N-BaIoT, 94.9 ± 0.4% on CICIoMT2024, and 94.2 ± 0.5% on WUSTL-EHMS-2020. Accepted manipulated events remain at or below 6.8%, participation-inference area under the receiver operating characteristic curve (AUC) falls to 0.53 ± 0.02, and weight inflation falls from 0.310 to 0.018 with 5.9% round-latency and 2.8% communication overhead at the evaluated cohort size.

@article{Nassar2026,
  title     = {ATLAS-FL: Active Timing-Adversary-Resilient Secure Aggregation for Gateway-Assisted IoT, IIoT, and IoMT Federated Intrusion Detection},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {17},
  number    = {9},
  year      = {2026},
  publisher = {The Science and Information Organization},
  author    = {Mohammad Othman Nassar},
  doi       = {10.14569/IJACSA.2026.0170961},
  url       = {https://doi.org/10.14569/IJACSA.2026.0170961}
}