Communication-Efficient Federated Class-Incremental Intrusion Detection for Edge IoT Networks

The continuous emergence of new attack classes challenges intrusion detection in edge Internet of Things (IoT) networks. Although federated learning enables distributed devices to collaboratively train a shared detector without exchanging raw traffic data, most federated intrusion detection systems assume a fixed label space. Retraining with all historical data incurs substantial storage and computation costs, whereas updating only with newly collected samples can cause catastrophic forgetting. The detector must mitigate catastrophic forgetting of previously observed attack classes while preserving sufficient new-class plasticity to learn emerging attacks under highly non-IID device data, intermittent client availability, constrained local memory, and repeated communication over bandwidth-limited and intermittently connected links. To address these challenges, this paper proposes EdgeFedCIL, a communication-efficient federated class-incremental intrusion detection framework. EdgeFedCIL preserves historical knowledge through client-local replay and knowledge distillation while reducing repeated model transmission through adaptive low-rank compression, quantization, and error feedback. A classifier-head protection strategy further limits compression-induced degradation of class discrimination. Experiments on public intrusion-detection datasets show that EdgeFedCIL achieves competitive or superior detection and historical-knowledge retention performance, particularly under highly heterogeneous client distributions, while reducing cumulative client-to-server model transmission by up to approximately 10.54 times relative to full-precision transmission. These results demonstrate the effectiveness of EdgeFedCIL for continual and communication-efficient intrusion detection in resource-constrained edge IoT networks.