Communication-Efficient Federated Class-Incremental Intrusion Detection for Edge IoT Networks

Area of Science:

• Cybersecurity
• Machine Learning
• Internet of Things (IoT)

Background:

• Edge IoT networks face continuous new attack classes, challenging traditional intrusion detection systems.
• Existing federated learning intrusion detection systems struggle with fixed label spaces and catastrophic forgetting.
• Resource constraints in edge IoT (non-IID data, limited memory, intermittent connectivity) complicate federated learning.

Purpose of the Study:

• To propose EdgeFedCIL, a communication-efficient federated class-incremental intrusion detection framework for edge IoT.
• To address catastrophic forgetting and enable learning of emerging attacks in resource-constrained environments.
• To reduce communication overhead in federated intrusion detection.

Main Methods:

• Client-local replay and knowledge distillation to preserve historical knowledge.
• Adaptive low-rank compression, quantization, and error feedback to reduce model transmission.
• Classifier-head protection strategy to mitigate compression-induced degradation.

Main Results:

• EdgeFedCIL achieves competitive or superior detection and knowledge retention performance.
• Demonstrates effectiveness under highly heterogeneous client distributions.
• Reduces cumulative client-to-server model transmission by up to approximately 10.54 times.

Conclusions:

• EdgeFedCIL is effective for continual and communication-efficient intrusion detection in edge IoT.
• The framework successfully mitigates catastrophic forgetting while learning new attack classes.
• Significant reduction in communication overhead makes it suitable for resource-constrained environments.