A Threat-Aware Self-Healing Federated Intrusion Detection Framework for Secure IIoT Supply-Chain Networks

Industrial Internet of Things (IIoT) is an application of IoT, which generates high volume, high velocity, and heterogeneous telemetry streams from geographically distributed edge devices in supply-chain networks. Federated learning (FL) has the advantage of not sending sensitive operational data to a central server to achieve privacy-preserving intrusion detection, but the performance of FL is sensitive to non-independent and identically distributed traffic, significant class imbalance, communication limitations, and malicious updates from clients. This study aims to provide a threat-aware self-healing federated intrusion detection system (TSHF-IDS) for secure and scalable IIoT supply-chain networks. The framework combines Independent Component Analysis (ICA) for feature reduction with a light-weight contrastive representation learning module to perform rapid screening of anomalies at the edge. The suspicious traffic is then directed to a Capsule Temporal Threat Detection Network (CTTD-Net) for temporal attack dependency and hierarchical behaviour patterns. This study uses a trust-weighted byzantine-resilient aggregation method, based on trimmed mean aggregation, which assesses the client’s update based on the gradient deviation, historical consistency, behavioral similarity, and anomaly likelihood. A self-healing adaptation layer automatically diminishes the impact of suspicious clients, quarantines malicious updates and recovers validated global checkpoints if the performance degradation due to poisoning is above a certain limit. Model updates are encrypted using AES-GCM authenticated encryption, thus ensuring confidentiality and integrity. Different ratio of malicious clients is used for targeted and untargeted poisoning attacks. The framework is trained on BoT-IoT, and tested on the TON_IoT, Edge-IIoTset and CIC-IoT2023 datasets with stratified and non-IID client partitions. Experimental results on BoT-IoT, TON_IoT, Edge-IIoTset, and CIC-IoT2023 demonstrate that TSHF-IDS achieves an average accuracy of 98.97