Resource-aware client selection for hierarchical federated learning in industrial control systems cyber-attack detection

Industrial Control Systems (ICS) that support power-grid operation increasingly rely on IP-based connectivity and remote access, which expands the cyber-attack surface while also limiting the feasibility of centralized learning due to privacy, regulation, and bandwidth constraints. Federated learning (FL) mitigates direct data sharing, but practical ICS deployments remain challenged by heterogeneous device resources, such as, compute, memory, energy, thermal state, etc. and by non-IID measurements that make uniform or fixed client-participation strategies inefficient and potentially biased. This paper studies device-aware client selection for hierarchical federated learning (HFL) in a three-tier client-edge-cloud architecture for ICS cyber-attack detection. We evaluate three selection strategies: (i) Energy-Aware Hyperparameter-Based Client Selection (EHCS), a lightweight scoring approach that balances contribution signals (federated influence on accuracy and loss) against energy consumption with periodic parameter tuning; (ii) Fine-Grained Client Q-Learning (FGCQ), a Deep-Q selector that learns client utility from state features; and (iii) Joint Client Q-Learning (JCQ), an RL selector that targets the combined effect of client subsets during aggregation. Experiments over 300 global rounds show that the proposed methods achieve accuracy and entropic-loss performance comparable to baseline strategies while substantially improving efficiency. FGCQ reaches the best peak among the proposed methods (96.8%), followed by EHCS (96.2%) and JCQ (96.0%). FGCQ also achieves the lowest loss (0.12). Crucially, the proposed methods reduce cumulative simulation time by approximately 3 times while lowering energy usage by nearly 4 times relative to other algorithms used for comparison. These results indicate that resource-aware selective participation can preserve detection quality while significantly improving scalability and sustainability in heterogeneous ICS edge environments.