Towards Ever-Evolution Network Threats: A Hierarchical Federated Class-Incremental Learning Approach for Network Intrusion Detection in IIoT

The rise of collaborative manufacturing, driven by the rapid proliferation of Industrial Internet of Things (IIoT) technologies, has markedly enhanced agility and productivity in industrial environments. However, this advancement has also significantly broadened the attack surface and uncovered unique vulnerabilities intrinsic to these interconnected systems. This paper introduces a novel Hierarchical Federated Incremental Learning Network Intrusion Detection (HFIN) approach. To our knowledge, this is the first attempt to address the ever-evolution network intrusion detection (NID) challenges in IIoT landscapes from the continuous attack-defense perspective. Our proposed HFIN capitalizes on decentralized model training across multifarious IIoT devices, ensuring data privacy and empowering continuous learning capabilities. It utilizes distributed data sources for secure experience sharing, collaboratively enhancing the continuous detection performance of the global model. Furthermore, regarding the inherent resource constraints of IIoT devices, we proposed a novel edge-client Weighted Transmission Optimization strategy (WTO). This strategy adeptly balances effective intrusion detection with the operational constraints of IIoT devices. By holistically considering detection capabilities and data volume across different attack types, it prioritizes the transmission of more critical and scarce attack data for training within bandwidth constraints. This maintains the comprehensive detection capability of the global model against various network attacks. To validate the effectiveness of HFIN, we conduct extensive experiments using the NF-UQ-NIDS-v2 and NF-ToN-IoT-v2 datasets. Experimental results demonstrate that our method outperforms baselines by approximately 10% in terms of accuracy and F1-score, highlighting the applicability and effectiveness of HFIN in enhancing security against sophisticated industrial environments and ever-evolving cyber threats.