Communication-Efficient Federated Class-Incremental Intrusion Detection for Edge IoT Networks

Area of Science:

• Cybersecurity
• Machine Learning
• Internet of Things (IoT)

Background:

• Emerging attack classes continuously challenge intrusion detection in edge IoT networks.
• Federated learning (FL) offers distributed training but often assumes fixed label spaces, leading to catastrophic forgetting or high costs.
• Existing FL intrusion detection systems struggle with non-IID data, intermittent connectivity, and limited resources.

Purpose of the Study:

• To propose EdgeFedCIL, a communication-efficient federated class-incremental intrusion detection framework for edge IoT.
• To address catastrophic forgetting and enable learning of new attack classes in a continual learning setting.
• To reduce communication overhead in federated intrusion detection systems.

Main Methods:

• Client-local replay and knowledge distillation to preserve historical knowledge.
• Adaptive low-rank compression, quantization, and error feedback for communication efficiency.
• Classifier-head protection strategy to mitigate compression-induced degradation.

Main Results:

• EdgeFedCIL achieves competitive or superior intrusion detection and knowledge retention performance.
• Demonstrates effectiveness under highly heterogeneous client data distributions.
• Reduces cumulative client-to-server model transmission by up to approximately 10.54 times compared to full-precision transmission.

Conclusions:

• EdgeFedCIL is effective for continual and communication-efficient intrusion detection in resource-constrained edge IoT networks.
• The framework successfully mitigates catastrophic forgetting while learning new attack classes.
• Significant reductions in communication overhead are achieved, making FL more practical for edge IoT security.