Prototype-guided collaborative transformer learning for decentralized edge–cloud intrusion detection

The increasing complexity of decentralized edge–cloud infrastructures introduces significant challenges for reliable and scalable intrusion detection, particularly under heterogeneous traffic conditions and communication constraints. To address these issues, this paper proposes a collaborative transformer-driven intrusion detection framework that integrates context-aware behavioural representation learning with prototype-guided federated coordination. The proposed approach employs a lightweight transformer encoder at each monitoring node to capture temporal dependencies in network traffic, while a prototype-based communication mechanism enables efficient knowledge sharing without exchanging raw data or full model parameters. This design maintains data locality and significantly reduces communication overhead while promoting semantic alignment across distributed models. The framework is evaluated on multiple benchmark datasets, including CIC-IDS2017, CSE-CIC-IDS2018, UNSW-NB15, CIC-IoT-IDS2023, CIC-DDoS2019, and CIC-IoT-DIAD2024, under both homogeneous and heterogeneous deployment scenarios. Experimental results demonstrate that the proposed method achieves improved performance relative to conventional centralized, deep learning, and federated baselines, achieving up to 96–97% F1-score and approximately 0.98–0.99 ROC–AUC. In addition, the model exhibits improved scalability, faster convergence, reduced false positive rates, and reliable performance under high-intensity attack conditions. The proposed framework provides an effective and communication-efficient approach for decentralized intrusion detection and demonstrates its potential to support reliable cyber defence in next-generation edge–cloud environments, although formal privacy and adversarial robustness evaluations remain subjects for future investigation.