Hierarchical Federated Class-Incremental Learning with Client-Local Replay for Industrial IoT Intrusion Detection

Abstract

Industrial Internet of Things (IIoT) environments face continuously evolving cyber threats, creating a need for network intrusion detection systems (NIDS) that can adapt to emerging attack classes. Hierarchical Federated Learning (HFL) is well suited to IIoT intrusion detection because it enables collaborative training across multiple network layers without sharing raw traffic data. However, most existing HFL-based intrusion detection approaches assume a fixed set of attack classes during training, limiting their applicability to evolving environments. In this paper, Hierarchical Federated Class-Incremental Learning (HFCIL) is investigated for IIoT intrusion detection under heterogeneous client data distributions. A multi-layer client–domain–cloud architecture is considered, where client-local replay memory and knowledge distillation (KD) are incorporated to mitigate catastrophic forgetting during incremental updates. Experiments on the NF-ToN-IoT-v2 dataset under two incremental settings show that replay-based variants achieve consistently higher Macro-F1 scores and lower false negative rates (FNR) than configurations without replay memory. The results further indicate that replay-based methods reduce missed attacks at the cost of increased false positives, highlighting an important deployment trade-off in practical IIoT intrusion detection systems (IDS). These findings demonstrate the feasibility of class-incremental intrusion detection without raw data sharing in hierarchical federated IIoT environments.