Lightweight Federated Edge AI Framework for Real-Time Intrusion Detection in Industrial IoT Ecosystems
DOI:
https://doi.org/10.66279/695vq644Keywords:
Industrial Internet of Things, Edge Artificial Intelligence, Federated Learning, Intrusion Detection, Model QuantizationAbstract
Industrial control networks connect programmable logic controllers (PLCs) to enterprise systems, which exposes closed-loop processes to flooding, scanning, spoofing, and injection attacks. Cloud-hosted intrusion detection can miss millisecond response requirements and requires the export of proprietary process data, whereas isolated edge detectors observe only local traffic. This paper presents Fed-EdgeIDS, a federated intrusion detection framework for low-power industrial gateways. Its classifier, DSA-Net, combines one-dimensional depthwise separable convolutions with four-head self-attention and has 67,831 trainable parameters, 94.6% fewer than a one-dimensional CNN baseline with 1,248,500 parameters. Each gateway clips its model update, adds Gaussian noise, and transmits the largest 30% of coordinates after unbiased 8-bit stochastic quantization with local error feedback. With four of 20 gateways sampled per round, one upload occupies 61,051 bytes, and 50 rounds require 11.6 MB of uplink payload against 952.5 MB for uncompressed federated averaging of the baseline. The server aggregates updates with a coordinate-wise trimmed mean and Nesterov momentum. Over five random seeds, Fed-EdgeIDS reaches 98.74% ± 0.12% accuracy on Edge-IIoTset and 99.02% ± 0.09% on CIC-IDS2017, with false alarm rates of 0.62% and 0.49%. The client-level privacy bound of the update perturbation is weak (ε ≈ 24.8 at δ = 10⁻⁵), so the noise acts as obfuscation and not as a formal guarantee. On a Raspberry Pi 4 and an NVIDIA Jetson Nano, mean per-window inference takes 3.74 ms and 1.18 ms, and mean detection-to-containment-dispatch latency is 4.56 ms and 1.82 ms, excluding window accumulation and enforcement time.
Downloads
References
[1] E. Sisinni, A. Saifullah, S. Han, U. Jennehag, and M. Gidlund, “Industrial internet of things: Challenges, opportunities, and directions,” IEEE Transactions on Industrial Informatics, vol. 14, no. 11, pp. 4724–4734, 2018.
[2] J. Lin, W. Yu, N. Zhang, X. Yang, H. Zhang, and W. Zhao, “A survey on internet of things: Architecture, enabling technologies, security and privacy, and applications,” IEEE Internet of Things Journal, vol. 4, no. 5, pp. 1125–1142, 2017.
[3] N. Falliere, L. O Murchu, and E. Chien, “W32.Stuxnet Dossier,” Security Response White Paper Version 1.4, Symantec Corporation, Feb. 2011.
[4] A. Cherepanov, “WIN32/INDUSTROYER: A New Threat for Industrial Control Systems,” White Paper Version 2017-06 12, ESET, June 2017.
[5] Electricity Information Sharing and Analysis Center (E-ISAC), “Analysis of the Cyber Attack on the Ukrainian Power Grid,” technical report, SANS Industrial Control Systems, Washington, DC, USA, Mar. 2016.
[6] A. Di Pinto, Y. Dragoni, and A. Carcano, “Triton: The first ics cyber attack on safety instrument systems: Understanding the malware, its communications and its ot payload,” in Proceedings of Black Hat USA, (Las Vegas, NV, USA), pp. 1–26, 2018.
[7] Y. Liu, P. Ning, and M. K. Reiter, “False data injection attacks against state estimation in electric power grids,” ACM Transactions on Information and System Security, vol. 14, no. 1, pp. 1–33, 2011.
[8] M. A. Ferrag, L. Maglaras, S. Moschoyiannis, and H. Janicke, “Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study,” Journal of Information Security and Applications, vol. 50, p. 102419, Feb. 2020.
[9] International Electrotechnical Commission (IEC), “Communication Networks and Systems for Power Utility Automation — Part 5: Communication Requirements for Functions and Device Models.” IEC 61850-5:2013, Edition 2.0, Jan. 2013. https://webstore.iec.ch/en/publication/6012.
[10] W. Shi, J. Cao, Q. Zhang, Y. Li, and L. Xu, “Edge computing: Vision and challenges,” IEEE Internet of Things Journal, vol. 3, no. 5, pp. 637–646, 2016.
[11] P. K. R. Maddikunta, Q.-V. Pham, P. B, N. Deepa, K. Dev, T. R. Gadekallu, R. Ruby, and M. Liyanage, “Industry 5.0: A survey on enabling technologies and potential applications,” Journal of Industrial Information Integration, vol. 26, p. 100257, 2022.
[12] A. A. Diro and N. Chilamkurti, “Distributed attack detection scheme using deep learning approach for internet of things,” Future Generation Computer Systems, vol. 82, pp. 761–768, 2018.
[13] Z. Zhou, X. Chen, E. Li, L. Zeng, K. Luo, and J. Zhang, “Edge intelligence: Paving the last mile of artificial intelligence with edge computing,” Proceedings of the IEEE, vol. 107, no. 8, pp. 1738–1762, 2019.
[14] X. Wang, Y. Han, V. C. M. Leung, D. Niyato, X. Yan, and X. Chen, “Convergence of edge computing and deep learning: A comprehensive survey,” IEEE Communications Surveys & Tutorials, vol. 22, no. 2, pp. 869–904, 2020.
[15] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y. Arcas, “Communication-Efficient Learning of Deep Networks from Decentralized Data,” in Proceedings of the 20th International Conference on Artificial Intelligence
and Statistics (A. Singh and J. Zhu, eds.), vol. 54 of Proceedings of Machine Learning Research, pp. 1273–1282, PMLR, 20–22 Apr 2017.
[16] T. Li, A. K. Sahu, A. Talwalkar, and V. Smith, “Federated learning: Challenges, methods, and future directions,” IEEE Signal Processing Magazine, vol. 37, no. 3, pp. 50–60, 2020.
[17] S. Han, H. Mao, and W. J. Dally, “Deep compression: Compressing deep neural networks with pruning, trained quantization and huffman coding,” in Proceedings of the 4th International Conference on Learning Representations (ICLR), (San Juan, Puerto Rico), 2016.
[18] J. Konečný, H. B. McMahan, F. X. Yu, P. Richtárik, A. T. Suresh, and D. Bacon, “Federated learning: Strategies for improving communication efficiency,” in Proceedings of the NIPS Workshop on Private Multi-Party Machine Learning, 2016.
[19] L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” in Advances in Neural Information Processing Systems (H. M. Wallach, H. Larochelle, A. Beygelzimer, F. d’Alché Buc, E. B. Fox, and R. Garnett, eds.), vol. 32, (Red Hook, NY, USA), pp. 14774–14784, Curran Associates, Inc., 2019.
[20] P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” in Advances in Neural Information Processing Systems, vol. 30, pp. 119–129, Curran Associates, Inc., 2017.
[21] M. Roesch, “Snort—lightweight intrusion detection for networks,” in Proceedings of the 13th USENIX Conference on System Administration (LISA ’99), (Seattle, WA, USA), pp. 229–238, USENIX Association, 1999.
[22] V. Paxson, “Bro: A system for detecting network intruders in real-time,” Computer Networks, vol. 31, no. 23–24, pp. 2435–2463, 1999.
[23] J. Tai, I. Alsmadi, Y. Zhang, and F. Qiao, “Machine learning methods for anomaly detection in industrial control systems,” in 2020 IEEE International Conference on Big Data (Big Data), pp. 2333–2339, 2020.
[24] I. Ahmad, M. Basheri, M. J. Iqbal, and A. Rahim, “Performance comparison of support vector machine, random forest, and extreme learning machine for intrusion detection,” IEEE Access, vol. 6, pp. 33789–33795, 2018.
[25] Y. AbdelSatar, F. E. Mohamed, S. AbdelNasser, and A. A. Mohamed, “Intelligent MITM Attack Detection Systems Using Ensemble Learning for IoT Network Security,” Engineering Systems and Intelligent Technologies (ESIT), vol. 3, no. 2, pp. 49–58, 2026.
[26] Y. LeCun, Y. Bengio, and G. Hinton, “Deep learning,” Nature, vol. 521, no. 7553, pp. 436–444, 2015.
[27] M. Z. Alom, V. Bontupalli, and T. M. Taha, “Intrusion detection using deep belief networks,” in 2015 National Aerospace and Electronics Conference (NAECON), (Dayton, OH, USA), pp. 339–344, IEEE, June 2015.
[28] S. Kiranyaz, O. Avci, O. Abdeljaber, T. Ince, M. Gabbouj, and D. J. Inman, “1d convolutional neural networks and applications: A survey,” Mechanical Systems and Signal Processing, vol. 151, p. 107398, 2021.
[29] C. Yin, Y. Zhu, J. Fei, and X. He, “A deep learning approach for intrusion detection using recurrent neural networks,” IEEE Access, vol. 5, pp. 21954–21961, 2017.
[30] S. Hochreiter and J. Schmidhuber, “Long short-term memory,” Neural Computation, vol. 9, no. 8, pp. 1735–1780, 1997.
[31] M. Al-Hawawreh, N. Moustafa, and E. Sitnikova, “Identification of malicious activities in industrial internet of things based on deep learning models,” Journal of Information Security and Applications, vol. 41, pp. 1–11, Aug. 2018.
[32] M. A. Al-Garadi, A. Mohamed, A. K. Al-Ali, X. Du, I. Ali, and M. Guizani, “A survey of machine and deep learning methods for internet of things (iot) security,” IEEE Communications Surveys & Tutorials, vol. 22, no. 3, pp. 1646–1685, 2020.
[33] A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention Is All You Need,” in Advances in Neural Information Processing Systems 30 (NIPS 2017), vol. 30, pp. 5998–6008, Curran Associates, Inc., 2017.
[34] Z. Wu, H. Zhang, P. Wang, and Z. Sun, “Rtids: A robust transformer-based approach for intrusion detection system,” IEEE Access, vol. 10, pp. 64375–64387, 2022.
[35] Q. Yang, Y. Liu, T. Chen, and Y. Tong, “Federated machine learning: Concept and applications,” ACM Transactions on Intelligent Systems and Technology, vol. 10, no. 2, pp. 12:1–12:19, 2019.
[36] V. Rey, P. M. Sánchez Sánchez, A. Huertas Celdrán, and G. Bovet, “Federated learning for malware detection in iot devices,” Computer Networks, vol. 204, p. 108693, 2022.
[37] V. Mothukuri, P. Khare, R. M. Parizi, S. Pouriyeh, A. Dehghantanha, and G. Srivastava, “Federated-learning-based anomaly detection for iot security attacks,” IEEE Internet of Things Journal, vol. 9, no. 4, pp. 2545–2554, 2022.
[38] T. Nishio and R. Yonetani, “Client selection for federated learning with heterogeneous resources in mobile edge,” in ICC 2019 - 2019 IEEE International Conference on Communications (ICC), pp. 1–7, 2019.
[39] S. Wang, T. Tuor, T. Salonidis, K. K. Leung, C. Makaya, T. He, and K. Chan, “Adaptive federated learning in resource constrained edge computing systems,” IEEE Journal on Selected Areas in Communications, vol. 37, no. 6, pp. 1205 1221, 2019.
[40] F. Chollet, “Xception: Deep learning with depthwise separable convolutions,” in 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 1800–1807, 2017.
[41] A. Gholami, S. Kim, Z. Dong, Z. Yao, M. W. Mahoney, and K. Keutzer, “A survey of quantization methods for efficient neural network inference,” in Low-Power Computer Vision: Improving the Efficiency of Artificial Intelligence (P. Molchanov, T. Ajanthan, O. Mutlu, et al., eds.), pp. 291–326, Chapman and Hall/CRC, 2022.
[42] A. Reisizadeh, A. Mokhtari, H. Hassani, A. Jadbabaie, and R. Pedarsani, “FedPAQ: A communication-efficient federated learning method with periodic averaging and quantization,” in Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics (AISTATS), vol. 108 of Proceedings of Machine Learning Research, pp. 2021–2031, PMLR, 2020.
[43] S. U. Stich, J.-B. Cordonnier, and M. Jaggi, “Sparsified SGD with memory,” in Advances in Neural Information Processing Systems (NeurIPS), vol. 31, pp. 4452–4463, Curran Associates, Inc., 2018.
[44] D. Yin, Y. Chen, R. Kannan, and P. Bartlett, “Byzantine-robust distributed learning: Towards optimal statistical rates,” in Proceedings of the 35th International Conference on Machine Learning (J. Dy and A. Krause, eds.), vol. 80 of Proceedings of Machine Learning Research, pp. 5650–5659, PMLR, 10–15 Jul 2018.
[45] S. J. Reddi, Z. Charles, M. Zaheer, Z. Garrett, K. Rush, J. Konečný, S. Kumar, and H. B. McMahan, “Adaptive federated optimization,” in Proceedings of the 9th International Conference on Learning Representations (ICLR), 2021.
[46] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS), pp. 308–318, ACM, 2016.
[47] I. Mironov, “Rényi differential privacy,” in 2017 IEEE 30th Computer Security Foundations Symposium (CSF), pp. 263–275, 2017.
[48] T. Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V. Smith, “Federated optimization in heterogeneous networks,” in Proceedings of Machine Learning and Systems 2 (MLSys 2020) (I. Dhillon, D. Papailiopoulos, and V. Sze, eds.), vol. 2, pp. 429–450, 2020.
[49] T.-Y. Lin, P. Goyal, R. Girshick, K. He, and P. Dollár, “Focal loss for dense object detection,” in 2017 IEEE International Conference on Computer Vision (ICCV), pp. 2999–3007, IEEE, 2017.
[50] D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,” in Proc. 3rd Int. Conf. Learn. Represent (ICLR), 2015.
[51] H. B. McMahan, D. Ramage, K. Talwar, and L. Zhang, “Learning differentially private recurrent language models,” in International Conference on Learning Representations (ICLR), 2018.
[52] D. Alistarh, D. Grubic, J. Li, R. Tomioka, and M. Vojnovic, “QSGD: Communication-efficient SGD via gradient quantization and encoding,” in Advances in Neural Information Processing Systems 30 (NIPS 2017), vol. 30, pp. 1709 1720, Curran Associates, Inc., 2017.
[53] I. Sutskever, J. Martens, G. E. Dahl, and G. E. Hinton, “On the importance of initialization and momentum in deep learning,” in Proceedings of the 30th International Conference on Machine Learning, vol. 28 of Proceedings of Machine Learning Research, pp. 1139–1147, PMLR, 2013.
[54] M. A. Ferrag, O. Friha, D. Hamouda, L. Maglaras, and H. Janicke, “Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning,” IEEE Access, vol. 10, pp. 40281–40306, 2022.
[55] I. Sharafaldin, A. Habibi Lashkari, and A. A. Ghorbani, “Toward generating a new intrusion detection dataset and intrusion traffic characterization,” in Proceedings of the 4th International Conference on Information Systems Security and Privacy (ICISSP), vol. 1, pp. 108–116, 2018.
Downloads
Published
Issue
Section
Categories
License
Copyright (c) 2026 The Authors
This work is licensed under a Creative Commons Attribution 4.0 International License.
Engineering Systems and Intelligent Technologies (ESIT) seeks to publish the most influential papers that will significantly advance scientific understanding. Selected articles must present new and widely significant data, syntheses, or concepts. They should merit recognition by the wider scientific community and the general public through publication in a reputable scientific journal.
Engineering Systems and Intelligent Technologies (ESIT) content is published under a Creative Commons Attribution License (CC BY). This means that content is freely available to all readers upon publication, and content is published as soon as production is complete.
SIRG Publisher
