TrustFed-Honeypot: Multi-Signal Trust-Aware Federated IntrusionDetection

fidelity, concept drift, and honeypot capture quality and not only when updates are malicious.Conventional federated averaging and parameter-robust aggregators (FedProx, coordinate-wise median, Krum) reweighs or filter client gradients yet cannot remove semantically corrupted training rows from the server’s effective learning distribution. This paper presents TrustFed-Honeypot, a reliability-aware hybrid federated-retraining framework for honeypot-based IDS. Each round, clients train locally; the server retrains a global logistic model on trust-weighted samples of preprocessed feature vectors, governed by a multi-signal behavioral trust model (performance, stability, update drift, uncertainty)with sub-linear trust compression (????=0.8). On real honeypot telemetry over ????=12 independent seeds, TrustFed achieves 81.79% ± 10.02% F1 and 84.91% ± 18.17% recall versus 37.55% ± 18.41% F1 for FedAvg under an identical server-retraining protocol (paired Wilcoxon, ????<0.01). Trust-weighted parameter averaging without trust-gated retraining yields only 3.64% ± 11.00% F1, showing that gains arise from reshaping the retraining distribution rather than from reweighted gradients alone. Under the same adaptive corruption schedule, FedProx, median, and Krum exhibit near-zero attack recall in this protocol, without claiming general ineffectiveness against Byzantine gradient attacks. A CTU-13 stress evaluation further documents prevalence-shift failure when global F1 collapses while trust tiersremain diagnostically useful. The primary protocol exchanges preprocessed features and does not claim end-to-end cryptographic privacy; a gradient-only Strong v1 extension reports a separate utility-privacy trade-off. These findings position telemetry-quality governance as a complementary design axis to parameter-space robustness for federated honeypot IDS.