Explainable Edge–cloud Federated Intrusion Detection System for Electric Vehicles Using GRUs, DRL Selection, and Integrated Gradients

Electric Vehicle (EV) communication in Internet of Electric Vehicles (IoEV) ecosystems is highly dynamic, distributed, and privacy-sensitive, which makes scalable real-time intrusion detection and secure collaborative model training particularly challenging. Existing approaches often do not adequately address energy constraints, context heterogeneity, and explainability requirements, especially in federated environments involving On-Board Units (OBUs), roadside infrastructure, and vehicular cloud services. To address these challenges, we propose HAMID (Hierarchical Aggregation for Mobility-aware Intrusion Detection), a hierarchical federated Intrusion Detection System (IDS) for IoEV systems. It combines lightweight Gated Recurrent Unit (GRU)-based detectors, Deep Reinforcement Learning (DRL)-based participant selection, and privacy-preserving federated learning across a three-tier IoEV infrastructure. HAMID runs in a loop where each Charging-Hub Edge (CHE) node smartly picks energy-efficient and high-quality EVs for training based on real-time data, such as signal quality, CPU capacity, state-of-charge, and charging phase. Some cars locally preprocess telemetry data, break it up into 1-second windows, and use a GRU intrusion detection model that changes as new Vehicle-to-Everything (V2X) threats, like spoofing or message manipulation, arise. Model changes are quantized and sent to CHEs, who then combine them into better global weights that are sent to all nodes. This improves privacy because no raw data leaves EVs. To make decisions clearer, HAMID uses Integrated Gradients (IG) to describe things on the device. HAMID achieves 99.2