Lifelong-IDS

Abstract

Federated Learning (FL) enables collaborative intrusion detection across distributed Internet of Things (IoT) edge devices without centralizing private network telemetry. However, existing frameworks assume static data distributions and fail under non-stationary conditions: emerging zero-day attack families cause severe catastrophic forgetting, while unregularized federated fine-tuning overwrites historical detection capabilities. This paper proposes \textbf{Lifelong-IDS}, an autonomous, continual federated learning architecture that integrates LLM-conditioned generative replay, temporal split-personalization, unsupervised task-free drift detection, and closed-loop mitigation. Rather than caching raw network records, Lifelong-IDS projects statistical feature profiles of novel threats through a frozen language model to condition a conditional GAN, synthesizing past distributions to protect historical knowledge during local retraining. A dual-mode monitor combining linear-time embedding-space Maximum Mean Discrepancy ($\text{MMD}^2$) and error-rate ADWIN triggers replay protection autonomously without oracle task boundaries. Split-personalization isolates localized sensor drift via Polyak-anchored classification heads while preserving the shared representation backbone. Furthermore, flow attributions from permutation feature importance condition a constrained tabular Q-learning agent to synthesize targeted network mitigation directives in real time. Benchmarked across class-incremental and phased chronological partitions of CIC-IoT-2023 and Edge-IIoTset over 10 randomized seeds, Lifelong-IDS limits backward forgetting ($\text{BWT} = -0.1961$) relative to standard FL ($\text{BWT} = -0.5867$), achieves $98.3\%$ to $100\%$ drift boundary recall, and attains $100\%$ mitigation policy agreement. Finally, this work presents a systematic five-way tradeoff study mapping the operational boundaries between stability, Byzantine robustness, plasticity, fairness, and differential privacy within a single decentralized system.