Communication-Efficient Federated Class-Incremental Intrusion Detection for Edge IoT Networks

The rapid proliferation of Internet-of-Things (IoT) devices at the network edge has expanded the attack surface available to adversaries while simultaneously constraining the computational and communication resources available for defense. Federated learning (FL) offers a privacy-preserving paradigm for training intrusion detection systems (IDS) across distributed edge gateways without centralizing raw traffic, but two obstacles limit its practical deployment: (i) the communication overhead of repeated model exchange over bandwidth-constrained IoT links, and (ii) the non-stationary nature of the threat landscape, in which new attack classes emerge continually and naive retraining induces catastrophic forgetting of previously learned attack signatures. This paper proposes FedCIL-IDS, a communication-efficient federated class-incremental learning framework for intrusion detection in edge IoT networks. FedCIL-IDS integrates (۱) a local incremental-learning module that combines cross-entropy training with knowledge distillation and Fisher-weighted parameter regularization to retain knowledge of previously seen attack classes without storing raw exemplars, (۲) a privacy-preserving prototype memory that summarizes class-conditional feature statistics under additive noise for federated replay, (۳) an error-compensated top-k sparsification and stochastic quantization pipeline that reduces per-round uplink communication, and (۴) a drift-aware aggregation rule that reweights client contributions according to their class-distribution divergence from the federation-wide average, mitigating the compounded effect of statistical heterogeneity and incremental class skew. We formalize the federated class-incremental intrusion detection problem, derive the associated loss and communication-cost expressions, and present an evaluation protocol built on four public IoT/IIoT intrusion detection corpora (CICIDS۲۰۱۷, BoT-IoT, TON_IoT, and Edge-IIoTset) partitioned into class-incremental tasks under non-IID client sampling. Illustrative trends consistent with the reviewed literature indicate that the compression pipeline can substantially reduce uplink communication relative to uncompressed FedAvg, while the incremental-learning components curb backward-transfer forgetting relative to naive fine-tuning baselines. We close with a discussion of the privacy, robustness, and deployment implications of the framework and outline directions for validating it on physical edge hardware.

کلیدواژه ها:

Federated Learning ، Class-Incremental Learning ، Intrusion Detection Systems ، Internet of Things ، Edge Computing ، Communication Efficiency ، Catastrophic Forgetting ، Gradient Compression ، Knowledge Distillation ، Non-IID Data