Privacy-preserving intrusion detection in mobile edge networks via federated adaptive probabilistic stacking with clan–flock optimisation and explainable AI

Abstract

Mobile edge networks require intrusion detection systems (IDS) that are private, accurate and interpretable. We present FedAPS–CFO, a federated IDS coupling four mechanisms: prediction-level federated averaging (FedAvg), so raw traffic never leaves the edge; an Adaptive Probabilistic Stacking (APS) ensemble fusing a stacking meta-learner, Bayesian model averaging and a feature-conditioned ensemble; Clan–Flock Optimisation (CFO), a hybrid metaheuristic that tunes the fusion weights and decision threshold on inner validation splits; and SHapley Additive exPlanations (SHAP) with Local Interpretable Model-agnostic Explanations (LIME), validated quantitatively for stability, fidelity and faithfulness. Under stratified 10-fold cross-validation, FedAPS–CFO attains F1-scores of 0.997 on NSL-KDD, 0.951 on UNSW-NB15, 0.979 on CICIDS2017 and 0.998 on CIC-IoT2023, matching the strongest constituent ensemble on every dataset and significantly surpassing the remaining components (Wilcoxon signed-rank, Holm-corrected). In federations of up to 100 clients with Dirichlet label skew, FedAPS–CFO sustains detection within 1.2 F1 points of its ideal operating point — up to 46 points above its federated base learners — showing that the trained fusion absorbs client heterogeneity. Under matched budgets, CFO is the most reliable optimiser for the tuning task. Adaptive posterior fusion thus offers a practical route to accurate, interpretable, privacy-preserving intrusion detection at the network edge.