Operational Sustainability of Federated Edge Intrusion Detection for Smart-City IoT: Re-Training Policies, Energy, Traffic and Provenance Cost on a Chronological Stream

The sustainability literature accounts for training a model, not for keeping a deployed smart-city intrusion detector useful for years. How often the detector is re-trained decides whether it detects anything; within the system boundary modelled, the energy that cadence costs is small beside its detection effect. We replay the five-day CIC-IDS2017 capture (40 flow-count windows, five synthetic districts) under six protocols and twelve re-training policies, charging each re-training its measured CPU time, bytes and ledger transactions, converted under swept assumptions into use-phase energy, carbon, traffic and storage per gateway-year. Never re-trained, the detector scores stream F1 ≤ 0.005; re-training every window brings it to 0.798–0.856 for the edge and federated-averaging learners, and for the edge tree on this replay a label-free feature-drift trigger comes close with 37.5 % of the re-training events; low-rate attacks are largely missed under every policy. At the default assumptions and the replay's thinned traffic (32,000 flows per gateway-day; the share scales with traffic) the estimated upkeep stays below 1 % of a gateway's idle electricity, so the gateway hardware dominates the footprint; raw-traffic export (5.4× edge learning) and ledger storage growth (cut 83 % by Merkle anchoring) are conditional levers. On the ten-day CSE-CIC-IDS2018 capture the cost ordering holds, but the trigger misses attacks that imitate benign traffic and a daily clock fallback recovers only part of the loss.