Iranian Society of Cryptology The ISC International Journal of Information Security 2008-2045 18 3 2026 07 01 A Federated framework for unsupervised intrusion detection on the Modbus protocol in cyber-physical systems 167 178 242101 10.22042/isecure.2026.242101 EN Hamid Reza Dashtabadi Information Systems and Security Lab (ISSL), Department of Electrical Engineering, Sharif University of Technology, Tehran, Iran Siavash Ahmadi Electronics Research Institute, Sharif University of Technology, Tehran, Iran 0000-0002-8801-337X Journal Article 2025 10 01 The increasing integration of modern network infrastructure into industrial control systems elevates the need for robust cyber intrusion detection for industrial protocols. Unsupervised anomaly detection is particularly effective for this task, as it identifies novel attacks by modeling normal behaviour rather than relying on limited attack data. While techniques like autoencoders, which use reconstruction error to flag deviations, can be effective, their application is often hindered by practical challenges, such as regulatory constraints and the large volumes of data that prohibit the centralised collection required for training. Federated learning offers a solution by distributing the training process to local clients and aggregating only the resulting model parameters, thus preserving data privacy and locality. This paper proposes an anomaly-based intrusion detection framework built on federated learning. Using the CIC-Modbus2023 dataset, which comprises raw Modbus traffic from a smart grid, we systematically extract and label network flows based on attack logs. We then train and evaluate several autoencoder variants—including standard, variational, and adversarial autoencoders—within this federated setting. Our results demonstrate strong performance in detecting malicious behaviour, highlighting the framework’s potential as a promising approach for mitigating threats against the Modbus protocol without centralised data access. The code is available at https://github.com/hamid-rd/FLBased-ICS-NIDS. https://www.isecure-journal.com/article_242101_b950217e5291d89385502147536c5775.pdf