A threat-aware self-healing federated intrusion detection framework for secure IIoT supply-chain networks

Industrial Internet of Things (IIoT) is an application of IoT, which generates high volume, high velocity, and heterogeneous telemetry streams from geographically distributed edge devices in supply-chain networks. Federated learning (FL) has the advantage of not sending sensitive operational data to a central server to achieve privacy-preserving intrusion detection, but the performance of FL is sensitive to non-independent and identically distributed traffic, significant class imbalance, communication limitations, and malicious updates from clients. This study aims to provide a threat-aware self-healing federated intrusion detection system (TSHF-IDS) for secure and scalable IIoT supply-chain networks. The framework combines Independent Component Analysis (ICA) for feature reduction with a light-weight contrastive representation learning module to perform rapid screening of anomalies at the edge. The suspicious traffic is then directed to a Capsule Temporal Threat Detection Network (CTTD-Net) for temporal attack dependency and hierarchical behaviour patterns. This study uses a trust-weighted byzantine-resilient aggregation method, based on trimmed mean aggregation, which assesses the client’s update based on the gradient deviation, historical consistency, behavioral similarity, and anomaly likelihood. A self-healing adaptation layer automatically diminishes the impact of suspicious clients, quarantines malicious updates and recovers validated global checkpoints if the performance degradation due to poisoning is above a certain limit. Model updates are encrypted using AES-GCM authenticated encryption, thus ensuring confidentiality and integrity. Different ratio of malicious clients is used for targeted and untargeted poisoning attacks. The framework is trained on BoT-IoT, and tested on the TON_IoT, Edge-IIoTset and CIC-IoT2023 datasets with stratified and non-IID client partitions. Experimental results on BoT-IoT, TON_IoT, Edge-IIoTset, and CIC-IoT2023 demonstrate that TSHF-IDS achieves an average accuracy of 98.97%, Macro-F1 score of 0.988, ROC-AUC of 0.996, and PR-AUC of 0.995, while maintaining a low false-positive rate of 1.38%. Under extreme non-IID federated settings, the framework preserves 97.72% accuracy, and under poisoning attacks with up to 50% malicious clients, it maintains 94.8% accuracy and 93.9% post-recovery accuracy. The contribution of each of the following feature reduction, contrastive learning, temporal defense modeling, robust aggregation, and self-healing recovery are measured in ablation experiments.