HED-ID: a federated expert system for interpretable and resource-adaptive intrusion detection on edge devices

Abstract

The proliferation of edge computing in industrial and IoT networks necessitates expert systems that support accurate, interpretable, and resource-efficient intrusion detection under strict privacy and computational constraints. This paper presents HED-ID, a fully integrated federated expert system designed for real-time, edge-oriented anomaly detection. The system combines: (i) a stacked bidirectional GRU (BiGRU) architecture with hybrid temporal–spatial attention for sequential and feature-level anomaly modeling, (ii) a resource-adaptive Grey Wolf Optimizer (A-GWO) that modulates exploration–exploitation behavior based on real-time CPU utilization and Bayesian epistemic uncertainty, with formal convergence proof under bounded resource shifts (Appendix A), (iii) federated SHAP, which aggregates local explanations using weighted averaging to produce consistent global attributions without sharing raw data, (iv) a multi-objective fitness function that simultaneously considers accuracy, model complexity, and predictive uncertainty, and (v) SHAP-guided iterative pruning for reducing computational overhead while preserving model fidelity. Empirical evaluation on CICIDS-2017, UNSW-NB15, ToN-IoT, and a noisy-edge variant of ToN-IoT (10–20% controlled packet loss and jitter) demonstrates 95.6% accuracy in cloud-like conditions and 93.8% on Raspberry Pi 4 (4 GB RAM) before pruning, with inference latency maintained within 18–22 ms. Post-pruning, memory usage decreases from 92 to 115 MB to 78–96 MB, with ≤ 1.1% accuracy degradation. To support deployment, Docker orchestration templates, pruning threshold configurations, and Grafana-based monitoring are provided—reducing retraining interventions from 11 to 4 per year in a simulated 50-device edge environment.