Adaptive context-aware hierarchical federated multi-agent reinforcement learning for scalable intrusion detection in industrial IoT

The swift expansion of Industrial Internet of Things (IIoT) applications has presented significant hurdles for intrusion detection systems (IDSs), such as scalability constraints, privacy issues, diverse data distributions, and the identification of complex multi-stage attacks. Current methodologies frequently depend on centralized processing or traditional learning techniques that encounter difficulties with dispersed non-IID data and dynamic attack patterns. This study introduces CHF-MARL, a federated reinforcement learning framework utilizing distributed edge agents for scalable and privacy-preserving Industrial Internet of Things intrusion detection. The proposed framework integrates an adaptive context-aware feature fusion module for deriving informative representations from diverse network behaviors, a hierarchical federated aggregation strategy for collaborative learning without the exchange of raw data, and a history-aware reward mechanism for identifying temporal attack dependencies. Each edge agent autonomously enhances its localized intrusion detection strategy utilizing Deep Q-Networks, while knowledge dissemination is facilitated through hierarchical parameter aggregation. Comprehensive experiments on the TON-IoT, Edge-IIoTset, and X-IIoT ID datasets under both IID and non-IID conditions reveal that CHF-MARL consistently surpasses contemporary federated learning and reinforcement learning-based IDS methodologies regarding accuracy, macro-averaged F1-score, and false-negative mitigation. Ablation studies, sensitivity analyses, and statistical evaluations further substantiate the efficacy and resilience of the proposed components. The findings demonstrate that federated reinforcement learning, coupled with adaptive representation learning, offers a robust and privacy-conscious approach to distributed IIoT security. Future research will include real-world testbed validation and sophisticated cooperative learning mechanisms for extensive industrial implementations.