Lightweight Federated Edge AI Framework for Real-Time Intrusion Detection in Industrial IoT Ecosystems

Industrial control networks connect programmable logic controllers (PLCs) to enterprise systems, which exposes closed-loop processes to flooding, scanning, spoofing, and injection attacks. Cloud-hosted intrusion detection can miss millisecond response requirements and requires the export of proprietary process data, whereas isolated edge detectors observe only local traffic. This paper presents Fed-EdgeIDS, a federated intrusion detection framework for low-power industrial gateways. Its classifier, DSA-Net, combines one-dimensional depthwise separable convolutions with four-head self-attention and has 67,831 trainable parameters, 94.6% fewer than a one-dimensional CNN baseline with 1,248,500 parameters. Each gateway clips its model update, adds Gaussian noise, and transmits the largest 30% of coordinates after unbiased 8-bit stochastic quantization with local error feedback. With four of 20 gateways sampled per round, one upload occupies 61,051 bytes, and 50 rounds require 11.6 MB of uplink payload against 952.5 MB for uncompressed federated averaging of the baseline. The server aggregates updates with a coordinate-wise trimmed mean and Nesterov momentum. Over five random seeds, Fed-EdgeIDS reaches 98.74% ± 0.12% accuracy on Edge-IIoTset and 99.02% ± 0.09% on CIC-IDS2017, with false alarm rates of 0.62% and 0.49%. The client-level privacy bound of the update perturbation is weak (ε ≈ 24.8 at δ = 10⁻⁵), so the noise acts as obfuscation and not as a formal guarantee. On a Raspberry Pi 4 and an NVIDIA Jetson Nano, mean per-window inference takes 3.74 ms and 1.18 ms, and mean detection-to-containment-dispatch latency is 4.56 ms and 1.82 ms, excluding window accumulation and enforcement time.