Selective Federated IDS Framework with Adaptation for Large-scale Segmented Industrial Networks

Deterministic and low-latency communication enabled by Time-Sensitive Networking (TSN) is essential for modern large-scale segmented industrial networks, which are typically divided into multiple operational domains. However, securing such multi-domain, functionally segmented TSN environments remains challenging due to resource-constrained edge devices, strict real-time requirements, and uneven availability of labeled attack data across isolated domains. To address these challenges, we propose a Selective Federated Intrusion Detection Framework with Domain Adaptation (SAFID) tailored for large-scale segmented industrial networks. The framework introduces a cluster-aware domain classification strategy that identifies data-rich (active) and data-scarce (passive) domains based on Quality-of-Service (QoS) flow density. Active domains collaboratively train TDNet, a compact neural network architecture optimized for TSN traffic, through federated learning. TDNet employs low-rank factorized dense layers to reduce computational overhead and parameter count while preserving classification accuracy. To further minimize latency and memory consumption, a post-training quantization step compresses both weights and activations. Passive domains receive the globally aggregated model and locally fine-tune it via a lightweight domain-specific adaptation mechanism to capture localized threats. A post-training quantization step further compresses TDNet for deployment in latency-critical industrial environments. Extensive evaluation of SAFID demonstrates detection accuracies of 99.75% on CICIDS2017 and 95.75% on Edge-IIoTset. The framework also achieves a 6.5 × improvement in inference throughput after quantization and exhibits robust generalization across diverse domain-specific attack patterns. Unlike prior methods treating federated intrusion detection uniformly, our framework enables selective participation and targeted adaptation, making it highly suitable for real-time, resource-constrained multi-domain TSN networks.