FlowerSec: An AI-Enhanced Security Framework for Clustered Wireless Sensor Networks

Existing clustered wireless sensor network (WSN) security schemes treat intrusion detection as an add-on and rely on supervised models that fail against unseen attacks. We propose FlowerSec, an intrusion detection framework that uses the clustering topology itself as the security primitive for clustered WSNs. Sensors are organized into "flowers" comprising a seed (cluster head) and up to four leaves within a trust boundary. Each seed runs a dual-engine intrusion detection system: a SHAP-optimized LightGBM for known attacks and an unsupervised AutoEncoder for zero-day threats, connected by a confidence-gated escalation protocol. On the WSN-DS benchmark, the lightweight engine achieves a Macro F1-score of 0.9494 using eight features at 0.0066 ms and 1.74 microjoules per packet. The unsupervised engine detects 96.4% of unseen flooding attacks, whereas the supervised engine achieves 0.8% recall. Tiered activation of the two engines extends network lifetime by 121 days over flat architectures.