FORT-IDS: a federated, optimized, robust and trustworthy intrusion detection system for IIoT security

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Network Security

Background:

• Intrusion Detection Systems (IDS) are crucial for network security but suffer from performance degradation in cross-domain evaluations.
• The generalization gap between in-domain and cross-domain performance limits the operational reliability and adoption of IDS models.
• Existing IDS models often fail to adapt to evolving threats and diverse network environments.

Purpose of the Study:

• To introduce FORT-IDS, a novel framework designed to unify cross-domain assessment, adversarial hardening, and explainable artificial intelligence for robust IDS.
• To address the generalization gap in IDS by developing an adaptive pipeline that enhances model reliability across different network domains.
• To improve the operational deployment of IDS in dynamic Industrial IoT (IIoT) and enterprise environments.

Main Methods:

• FORT-IDS employs a five-stage pipeline: feature space alignment, unstable feature identification using SHAP/LIME, adversarial augmentation for retraining, adaptive attention-weighted federated learning for client updates, and continual replay for knowledge retention.
• Lightweight mapping and normalization techniques are used to reduce drift by aligning heterogeneous feature spaces.
• Federated learning with adaptive attention weighting prioritizes higher-quality client contributions while preserving data privacy.

Main Results:

• Evaluations on UNSW-NB15 and DDoS Botnet IoT datasets demonstrated FORT-IDS's effectiveness in improving cross-domain transfer learning.
• Advanced models integrated with FORT-IDS, such as Graph Neural Networks, achieved superior performance compared to baselines and traditional models like CNN and LSTM.
• The framework successfully narrowed the performance gap between lab results and real-world deployment scenarios, enhancing IDS robustness.

Conclusions:

• FORT-IDS provides a unified approach to enhance IDS generalization and robustness by integrating explainable AI with adversarial hardening and federated learning.
• The framework effectively addresses the limitations of current IDS models, paving the way for more dependable security solutions in diverse network settings.
• By transforming explanations into actionable robustness improvements, FORT-IDS facilitates the reliable deployment of advanced IDS in dynamic IIoT and enterprise environments.