A Federated Multi-Agent Communication Framework for Autonomous Cyber Defense in Edge–Cloud IoT Environments

With increasing system complexity and attack sophistication, autonomous cyber defense has become essential in edge–cloud Internet of Things (IoT) ecosystems, requiring intelligent, secure, and scalable agent communication frameworks. This paper proposes FMAD (Federated Multi-Agent Defense), a conceptual federated multi-agent framework that enables intelligent agent communication for autonomous cyber defense through collaborative sensing and federated learning, with a design emphasis on security and privacy preservation. The proposed framework defines a set of specialized intelligent agents responsible for distributed traffic sensing, threat intelligence analysis, federated model optimization, secure agent-to-agent communication, and adaptive mitigation. As an initial proof of concept, the Threat Intelligence Agent (TIA) was implemented using an xLSTM-based temporal intrusion detection model developed in this study and trained on the CIC-IoT-2023 dataset, achieving a detection accuracy of 99.89% while efficiently identifying temporal traffic anomalies at edge nodes. The FMAD framework integrates multiple collaborative agents for secure communication, federated learning, and coordinated cyber defense in edge–cloud IoT environments. The experimental evaluation focuses on the xLSTM-based Threat Intelligence Agent (TIA) for DDoS detection, while the remaining components are assessed at the design level. However, empirical validation in the current study is limited solely to the TIA. To support trustworthy collaboration among distributed agents, the framework further proposes a secure communication architecture based on Elliptic Curve Cryptography (ECC) key agreement, ChaCha20-Poly1305 authenticated encryption, and a permissioned blockchain ledger, which are designed to provide secure interaction management and traceability within the stated security assumptions. This federated multi-agent approach provides a promising foundation for intelligent agent communication and scalable autonomous cyber defense in real-world edge–cloud IoT environments.