Adaptive Federated Edge Transformer with Multi-Level Knowledge Distillation and Hybrid GA–SQP Optimization for Privacy-Preserving Zero-Day Attack Detection in Heterogeneous IoT Network

Abstract

The increasing availability of diverse internet of things devices has made possible an increase in zero-day attacks, but at the same time, it has brought up several issues related to data privacy, overhead communications, and computation scalability for central intrusion detection systems. Federated learning provides an effective decentralized approach for cooperative cyber threat intelligence; however, its efficiency is hindered by non-independent and identically distributed data, unstable client contribution, restricted resources of edge devices, and ineffective model aggregation. In order to overcome the aforementioned problems, this paper presents an Adaptive Trust-Aware Federated Edge Transformer (AFET) with multi-level knowledge distillation (MLKD) and hybrid Genetic Algorithm–Sequential Quadratic Programming (GA–SQP) optimization for privacy-preserving zero-day attack detection in diverse IoT environments. The AFET architecture implements an adaptive trust-aware model aggregation process that adjusts the aggregation weights based on the clients’ reliability and data quality, whereas the MLKD module implements knowledge transfer from a global teacher network to edge transformers through multi-level information sharing. In addition, the hybrid GA–SQP optimizer optimizes the parameters of both the transformer and federated learning algorithms. The experimental results performed on benchmark intrusion detection datasets prove that the proposed framework attains detection accuracy of 99.18%, precision of 98.07%, recall of 97.91%, F1-score of 98.03%, and AUC of 0.998. This is an alternative tool for privacy-preserving zero-day attack detection in heterogeneous IoT networks.

1. Introduction

The explosion of the internet of things (IoT), industrial IoT (IIoT), and cyber-physical systems has completely revolutionized modern digital infrastructure, making it possible to enable intelligent communications between billions of interconnected devices through healthcare, smart cities, transport, industrial automation, and critical infrastructures [1]. It has been reported that more than 30 billion interconnected IoT devices will be present globally soon, creating huge amounts of heterogeneous data that need to be processed and transmitted securely in distributed edge environments [2]. At the same time, the rapid adoption of AI in IoT ecosystems has led to the widespread use of edge intelligence to make decisions in real time, lowering latency and bandwidth utilization [3]. However, the increased connectivity of resource-constrained IoT devices has resulted in a much larger cyberattack surface, putting decentralized IoT infrastructures at risk from advanced security threats that cannot be managed using traditional security mechanisms [4]. Zero-day attacks, in which cyberattacks exploit unknown software/hardware vulnerabilities before being fixed by security patches, are one of the most dangerous forms of cyberattacks since they bypass signature-based intrusion detection and spread through interconnected IoT infrastructures rapidly [5,6]. Thus, it is essential to design intelligent, scalable, and privacy-preserving intrusion detection systems to identify new cyber threats.

The recent developments in machine learning (ML) and deep learning (DL) have led to a major improvement in intrusion detection systems (IDSs) to detect sophisticated attacks using automatic feature extraction and nonlinear decision-making techniques [7,8]. Convolutional neural networks (CNNs), recurrent neural networks (RNNs), long short-term memory (LSTM) networks, graph neural networks (GNNs), and transformer-based models have shown tremendous success in network anomaly detection and zero-day attack classification [9,10]. Specifically, the transformers have proven themselves to be among the best DL techniques due to their ability to learn long-range dependencies and complicated correlations in sequence-based network traffic owing to the mechanism of self-attention [11]. However, most of the current DL-based intrusion detection approaches are centralized and thus require large amounts of private network traffic data to be uploaded to cloud servers for training. Such an approach results in additional communication costs, increased network latency, single points of failure, as well as serious concerns about data privacy issues [12], regulatory compliance problems, and even information leakage. These challenges are particularly important for a heterogeneous IoT environment in which edge devices produce sensitive data continuously while being subjected to strict computation and communication constraints.

Recently, federated learning (FL) has come up as an innovative and decentralized learning framework capable of optimizing models collaboratively through a collaborative environment without sharing the raw training data [13]. Rather than exposing private network traffic information, participants in FL will locally optimize their model parameters and share them with an aggregation server. This approach offers better data privacy and communication cost savings than ever before. With the advent of the Federated Averaging (FedAvg) algorithm [14], several federated optimization methods such as FedProx, SCAFFOLD, clustered federated learning, and personalized federated learning have been proposed [15,16]. Despite these developments, the deployment of federated intrusion detection systems is still difficult owing to highly non-IID data distribution, heterogeneity in terms of computational capacity of devices, unreliable participation of clients and communication efficiency challenges [17]. The existing aggregations approaches have assigned equal weights to all the participating clients irrespective of their trustworthiness, data quality, communication reliability and computational capability, which results in slower convergence speed and poor detection performance in real-life IoT environments [18]. More recently, communication efficiency, adaptive inference, trust-aware collaboration, and on-device intelligence have been identified as some of the key research problems [19].

Alongside the development of FL, the importance of techniques such as model compression and optimization has emerged since there is a need to apply advanced DL models in edge computing environments that are limited in resources [20]. There is substantial potential in knowledge distillation, which enables transferring the discriminative knowledge gained by complex and resource-consuming teacher models to simple student models applicable for performing inferences in an edge environment [21]. Currently used methods employ only response-based, feature-based, or attention-based distillation [22] but ignore valuable information in multiple feature levels. Similarly, hyperparameter optimization of transformer architectures is mostly conducted by using heuristic search or manual tuning, leading to higher computational costs, unstable convergence, and lower model performance. Hybrid optimization, which combines global evolutionary search and gradient-based refinement, still remains insufficiently researched despite its ability to improve both the efficiency and effectiveness of the process. Finally, there are hardly any studies that consider adaptive trust-aware FL, MLKD, edge lightweight transformer architectures [23], and hybrid optimization together within one privacy-preserving framework designed for detecting zero-day attacks. Overcoming these research gaps is critical for creating scalable, communication-efficient, and trustworthy decentralized intelligence that will ensure the security of the future IoT ecosystem.

In light of the previously mentioned issues, this paper presents an AFET framework combined with MLKD and a hybrid GA–SQP optimization for privacy-preserving zero-day attack detection in heterogeneous IoT systems. The AFET framework adopts an adaptive trust-aware aggregation algorithm where the aggregation weights are assigned adaptively based on the clients’ reliability, data quality, and computational ability, leading to increased robustness in heterogeneous non-IID scenarios. Moreover, an MLKD scheme is adopted to facilitate the distillation of feature-level, attention-level, and prediction-level information of a global teacher model into lightweight edge transformer models, which leads to the computationally efficient inference process in resource-limited devices. In addition, a hybrid GA–SQP optimization technique is proposed to automatically optimize both the parameters of transformer models and federated learning hyperparameters to accelerate the convergence rate, improve detection accuracy, and increase communication efficiency. The major contributions of the study are as follows:

• A novel AFET architecture is designed to address privacy-preserving zero-day attack detection within heterogeneous IoT environments. In contrast to traditional centralized intrusion detection systems, the proposed architecture allows for cooperative learning of models among distributed edge nodes without revealing private local information, which makes the learning process both privacy-protected and highly accurate.
• An MLKD scheme is developed to move hierarchical feature representations from a global federated model to the edge models. Through extracting knowledge from feature levels, attention levels, and prediction levels concurrently, the generalization ability of constrained edge nodes is substantially enhanced by the proposed architecture.
• The GA–SQP-based automatic optimization scheme for FL is proposed to find the optimal set of transformer hyperparameters (learning rate, aggregation coefficients, attention dimensions) and federated learning architecture hyperparameters (client sampling probability, number of local epochs).
• The client-adaptive aggregation mechanism is introduced in order to cope with heterogeneous networks and non-IID data problem inherent in IoT scenarios. In contrast to classical FedAvg-based aggregation procedure, the proposed technique allows different aggregation coefficients to be assigned to clients depending on their reliability, quality of the local dataset, computing power, and ability to detect anomalies. The communication-efficient collaborative learning scheme is designed in order to reduce communication overhead between edge devices and federated server by means of adaptive client selection and compression of the update parameters.
• The performance of the proposed system in terms of its effectiveness, robustness, scalability and computational efficiency is thoroughly evaluated on the basis of multiple benchmark cybersecurity datasets in a variety of FL environments. Extensive ablation study, communication overhead analysis, statistical significance test and robustness evaluation against unseen zero-day attacks demonstrate the superiority of the proposed solution over existing federated intrusion detection systems.

The rest of the article is outlined in such a way that the literature review along with the state-of-the-art contributions are narrated in Section 2. The proposed methodology along with the algorithmic detail and performance measures are presented in Section 3. Section 4 provides comprehensive simulations and a discussion of their results, while Section 5 depicts the conclusions along with the directions for future work.

2. Related Work and State of the Art

It is quite evident from the introduction that privacy preservation, communication efficiency, heterogeneous data distributions, and resource-constrained edge devices remain the principal obstacles preventing practical deployment of AI-enabled intrusion detection systems in decentralized IoT environments. To address these challenges, FL has emerged as one of the most promising decentralized intelligence paradigms for collaborative intrusion detection. Instead of transferring raw network traffic to centralized servers, FL enables distributed edge devices to locally train models while exchanging only model parameters, thereby significantly reducing privacy leakage and communication costs. Since the introduction of the Federated Averaging (FedAvg) algorithm by McMahan et al. [24], numerous aggregation strategies including FedProx, SCAFFOLD, clustered federated learning, and personalized federated learning have been developed to improve convergence under heterogeneous non-independent and identically distributed (non-IID) environments [5,9,17]. The FL approach provides an alternative decentralized way of model training while keeping the data local. Li et al. [25] proposed the FedProx optimization technique for dealing with the issue of statistical heterogeneity in the federated setting by introducing a proximal term in the local loss function. The results of experiments showed better performance of the algorithm compared to the FedAvg algorithm in the case of heterogeneous data distribution. In a similar vein, Karimireddy et al. [26] introduced SCAFFOLD, a method that utilizes control variates to minimize client drift and speed up convergence in non-IID settings. While these optimization schemes greatly enhance the process of federated convergence, they tend to address optimization stability without paying any attention to the issues of client trustworthiness, communications, heterogeneity, and detecting malicious clients. In addition, neither of these schemes were specifically developed for application in the realm of cybersecurity for handling highly dynamic zero-day attacks. This presents an important problem in critical out-of-distribution (OOD) detection since discriminative features and behaviors of attacks are not known at the time of training a model. Distributional shift, poor separability of the representation, and high false negatives arise due to these reasons. Moreover, such a problem becomes more complicated in the case of FL in edge settings because of heterogeneous clients, computing restrictions, and communication issues.

Noting the increasing relevance of decentralized intelligence, Kairouz et al. [27] published one of the most thorough surveys on FL by examining more than 80 FL methods and outlining more than 20 research problems that need to be addressed in the context of communication efficiency, personalization, privacy, fairness, client heterogeneity, and robustness of the system. The survey highlighted the importance of efficient communication optimization, adaptive aggregation, and decentralized intelligent systems research. In the field of cybersecurity, Ferrag et al. [28] conducted a review on intrusion detection based on DL and evaluated many benchmark datasets, showing the advantage of transformer and attention models over traditional ML algorithms due to the ability to learn long-range dependencies. In addition, Agrawal et al. [29] explored using FL for intrusion detection systems, finding that despite the fact that FL greatly improves the privacy protection by avoiding data transfer, federated IDS models still face communication overheads, non-IID data distribution, model poisoning attack, and inefficient model aggregation. In the same manner, Alsamiri and Alsubhi [30] surveyed federated intrusion detection systems in the context of Internet of Vehicles (IoV) applications and found that the lack of resources on edge devices, the dynamic nature of the network architecture, client mobility, and communication latency adversely affect the detection accuracy. Thus, the issue of building scalable, secure, and communication-efficient federated intrusion detection is a topic for further research. Alongside the development of federated intelligence, transformer architectures have transformed DL by introducing self-attention instead of recurrent and convolutional operations. The Vision Transformer (ViT) architecture was proposed by Dosovitskiy et al. [31], where the authors prove that purely transformer models can surpass current state-of-the-art CNN trained on large enough data volumes. The global attention allows the extraction of longer contextual features much better than CNNs do, which makes transformer models especially suitable for solving sophisticated cybersecurity problems that involve processing of network traffic. However, due to the quadratic increase in computational complexity relative to sequence length, self-attention is computationally expensive, leads to significant memory usage, and limits the possibility of training such models on low-power edge devices, typical for IoT networks. In order to overcome these drawbacks, Hinton et al. [32] suggest applying the concept of knowledge distillation, according to which a small student model learns from soft outputs of a larger teacher network and achieves the same predictive power at much lower computational costs. Later, Mirzadeh et al. [33] introduce the teacher assistant knowledge distillation approach, showing that intermediate teacher networks greatly enhance knowledge transfer from large to compact neural models. Despite these advances, existing knowledge distillation techniques primarily focus on prediction-level or feature-level knowledge transfer independently, while hierarchical multi-level knowledge distillation capable of simultaneously preserving feature representations, attention maps, and output distributions remains relatively unexplored for federated edge intelligence.

In recent studies, Ferrag et al. in 2022 [28] used the DNN algorithm and attained 94.82% accuracy, but with the centralized learning framework, there was no privacy protection capability; hence it was not suitable in the distributed cyber-physical system. Another research study, where Alkahtani et al. [34] used a Random Forest model in conjunction with the FedAvg aggregator, showed an accuracy rate of 95.43%. The limitation in this model is the inability of the static aggregation technique in enhancing flexibility in the heterogeneity of federated learning environment. Another work, where Alkahtani et al. [35] used the CNN-RNN framework within federated learning (FL), revealed an accuracy of 96.17%; however, this FL framework lacks the capacity of handling non-IID data analysis which is common in IoT. Finally, in another work, Alkahtani et al. in 2023 [36] managed to increase the accuracy up to 96.91% by incorporating Random Forest into federated learning but lacked a trust awareness aggregator. More recent works have applied more sophisticated deep learning models and federated optimization methods in order to produce better results in terms of intrusion detection. The FD-IDS technique [37] was based on the combination of knowledge distillation and federated learning algorithms, providing an accuracy of 98.47%, a precision of 98.41%, an F1-score of 98.38% and an AUC equal to 0.995, although it did not use any transformer-based feature learning technique. The CNN-BiLSTM algorithm presented by Javeed et al. [38] provided the results of 98.13% of accuracy and 97.98% of F1-score but lacked any adaptive aggregation method for the dynamic federated environment. Similarly, FFL-IDS [39] used the fog-assisted federated learning framework and attained an accuracy of 98.72% with an AUC equal to 0.996, showing the great intrusion detection capabilities yet suffering from high communication costs. In terms of centralized solutions, ABCNN-IDS [40] provided the highest accuracy score of 98.91% with the attention-based CNN framework; however, the centralized approach makes it impractical in terms of scalability and data privacy. FedNova + Transformer [41] introduced transformer-based learning into the FL framework and attained an accuracy of 98.00% with an AUC of 0.990 but did not use any optimization or knowledge distillation methods. The summary of the related state-of-the-art work on Edge-IIoTset dataset using federated and edge-based intrusion detection methods is narrated in Table 1. The research gaps observed from the comprehensive literature survey are: First, most federated intrusion detection systems currently in use employ static algorithms for aggregation, for example, FedAvg, FedProx, and FedNova, which provide static weighting of clients’ contributions regardless of their reliability, communication quality, computational power, and credibility. This results in problems associated with convergence and robustness in highly heterogenous non-IID IoT environments. The second issue is that despite the recent inclusion of knowledge distillation for federated intrusion detection, current approaches rely on one level of knowledge transfer, while hierarchical levels of features, attention, and prediction are underexplored. Likewise, transformer-based federated IDS models are still not numerous, and deployment on the edge is hard due to computational intensity. The current study is motivated by these limitations; the proposed AFET with MLKD and hybrid GA–SQP optimization introduces a unified decentralized intelligence framework that combines adaptive trust-aware aggregation, lightweight edge transformer learning, hierarchical knowledge distillation, and hybrid global–local optimization for privacy-preserving zero-day attack detection. By jointly addressing communication efficiency, client heterogeneity, computational scalability, and privacy preservation, the proposed framework aims to provide a practical and robust cyber-defense solution for next-generation heterogeneous IoT networks.

Table 1. State-of-the-art comparison of federated and edge-based intrusion detection methods on Edge-IIoTSet dataset.

Reference	Method	Learning Paradigm	Accuracy (%)	Precision (%)	F1-Score (%)	AUC	Limitations
Ferrag et al., 2022 [28]	DNN	Centralized	94.82	-	-	-	No privacy preservation
Alkahtani et al., 2021 [34]	RF + FedAvg	FL, FD-IDS	95.43	-	-	-	Static aggregation
Alkahtani et al., 2021 [35]	CNN-RNN		96.17	-	-	-	Limited non-IID analysis
Alkahtani et al., 2023 [36]	RF		96.91	-	-	-	No trust-aware aggregation
Peng et al., 2025 [37]	KD + FL		98.47	98.41	98.38	0.995	No transformer
Javeed et al., 2024 [38]	CNN-BiLSTM		98.13	98.02	97.98	NR	No adaptive aggregation
Rehman et at. 2025 [39]	Fog FL		98.72	98.54	98.58	0.996	High communication overhead
Momand et al., 2024 [40]	Attention CNN	ABCNN-IDS	98.91	98.83	98.81	NR	Centralized
Bilal et al., 2025 [41]	Transformer	FedNova	98.00	97.00	96.50	0.990	No KD and optimization
S. Sadhwani et al., 2024 [42]	XGBoost + LightGBM	Centralized	96.60	96.00	96.40	0.983	No FL

3. Materials and Methods

The proposed Adaptive Federated Edge Transformer with multi-level knowledge distillation and GA–SQP optimization (AFET–MLKD–GA–SQP) establishes an integrated privacy-preserving framework for zero-day intrusion detection in heterogeneous IoT networks. The pipeline begins with heterogeneous Edge-IIoTset traffic preprocessing and non-IID client partitioning, followed by resource-aware feature representation at distributed edge clients. Each client employs an AFET whose depth, embedding dimension, attention heads, and temporal modeling capacity are dynamically adjusted according to available computational resources, enabling efficient extraction of contextual attack patterns. Subsequently, MLKD transfers complementary representation, attention, and decision-level knowledge from a high-capacity teacher to lightweight edge students, improving detection capability while reducing model complexity. The locally optimized models are then trained through privacy-preserving FL, where clipped and noise-perturbed updates are aggregated using distribution- and resource-aware weighting to accommodate client heterogeneity and non-IID traffic distributions. Finally, the integrated framework is optimized using a hybrid GA–SQP strategy, in which GA performs global exploration of the highly coupled hyperparameter space and Sequential Quadratic Programming performs constrained local refinement with respect to detection performance, zero-day sensitivity, latency, communication overhead, energy consumption, and privacy constraints. The resulting optimized global model provides a unified edge intelligence pipeline for accurate, resource-adaptive, privacy-preserving, and robust multi-class and zero-day intrusion detection. The overall proposed framework proposed in this article is presented in Figure 1.

Figure 1. Overall proposed framework for handling zero-day intrusion detection and other attacks in an IIoT environment.

The proposed framework dynamically adjusts transformer depth, embedding dimensions, and attention heads according to client resources. However, the parameters are being aggregated straightaway only when the clients have identical tensor dimensions and parameter semantics. In the case of heterogenous settings, a global reference model or teacher, which acts as a common knowledge representation, is used along with individual student models for each client with resource-adaptive architectures. Knowledge transfer is achieved using the representation, attention and prediction targets through appropriate projections in case of dimensional mismatch. The server later updates the reference model through the distillation process. The proposed AFET–MLKD–GA–SQP is formulated as a hierarchical privacy-preserving intrusion detection framework with the IoT ecosystem containing ‘K’ heterogeneous edge clients, C = {C₁, C₂, C₃, …, C_K}, where client C_K possesses a private local dataset $D_K={\left.\left\{(x_{k,i},y_{k,i}) \right\}\right|}_{i=1}^{N_k}$ with x_k,i ∈ ℜ^{T × d} representing a temporal network-flow sequence of ‘T’ observations and ‘d’ traffic attributes, while y_k,i ∈ {1,2,3, …, M} denotes the attack class. The global training population is represented as $N={\sum }_{k=1}^K{N}_k$, but raw samples never leave their originating devices. The proposed contemporary FL and KD explicitly identify data heterogeneity, resource heterogeneity, communication overhead, and privacy leakage as coupled challenges rather than independent problems. The IoT client generates traffic with substantially different numerical scales; the raw feature matrix is transformed locally using robust normalization:

$${\tilde{\mathit{x}}}_{k,j} = {\displaystyle \frac{x_{k,j} - \mathit{median}\left(x_{k,j}\right)}{\mathit{IQR}\left(x_{k,j}\right) + \epsilon }},$$

(1)

where IQR(x) = Q_0.75(x) − Q_0.25(x), ε > 0 prevents numerical instability. Categorical device features are represented using an embedding function e_k,j = E_cj[x_k,j], while continuous features are projected through ${\mathit{z}}_{k,j}={\mathit{W}}_x{\tilde{\mathit{x}}}_{k,j}+{\mathit{W}}_e{e}_{k,j}+{\mathit{b}}_x$. Consequently, z_k = [z_k, z_k, …, z_k] ∈ ℜ^{T × d}. The central local detector is an adaptive transformer whose architecture is dynamically adjusted according to the computational state of each edge device. For client ‘k’, define its resource vector as in Equation (2), while normalized resource feasibility coefficient is given in relation (3).

$${\mathit{r}}_k={\left[{\mathit{CPU}}^k, {\mathit{RAM}}^k, {\mathit{BW}}^k, {\mathit{Energy}}^k, {\mathit{Latency}}^k\right]}^T$$

(2)

$${\rho }_k={\displaystyle \prod _{q=1}^Q}{\left({\displaystyle \frac{r_{k,q}}{r_q^{\mathit{max}}+ϵ}}\right)}^{w_q} ,{\displaystyle \sum _{q=1}^Q}{w}_q=1.$$

(3)

The model depth, hidden dimension and attention-head number can therefore be parameterized as:

$$\left\{\begin{array}{l}{\mathcal{L}}_k {=\mathcal{L}}_{\mathit{min}}+⌊{\rho }_k ({\mathcal{L}}_{\mathit{max}}-{\mathcal{L}}_{\mathit{min}})⌋,\\ d_k {=d}_{\mathit{min}}+⌊{\rho }_k (d_{\mathit{max}}-d_{\mathit{min}})⌋,\\ h_k {=h}_{\mathit{min}}+⌊{\rho }_k (h_{\mathit{max}}-h_{\mathit{min}})⌋.\end{array}\right.$$

(4)

Thus, computationally constrained nodes receive lightweight models, while more capable edge nodes can execute deeper representations. This resource-adaptive design is consistent with heterogeneous-FL, where model architecture is adapted to device conditions rather than forcing every client to execute an identical mode. Relative temporal encoding is performed based on network observations and adaptive temporal Kernal whose representation is provided in Equation (5).

$$\left\{\begin{array}{c}{H}_k^{\left(0\right)}={\mathit{z}}_k+{\mathit{P}}_k,\\ {\mathit{P}}_k={\left[\mathit{sin}\left({\displaystyle \frac{t}{{10000}^{2j/d_k}}}\right), \mathit{cos}\left({\displaystyle \frac{t}{{10000}^{2j/d_k}}}\right)\right]}_{j=0}^{{\displaystyle \frac{d_k}{2}}-1},\\ {\mathsf{\Gamma }}_{\mathit{ij}}=e^{\left(-{\displaystyle \frac{\left|i-j\right|}{{\tau }_k+ϵ}}\right)}.\end{array}\right.$$

(5)

where τ_k is the learnable client-specific temporal scale. For transformer layer ‘l’, the query, key and value matrices, along with attention head ‘h’, its output ‘Ou’, multi-head aggregation ‘MHSA’ and residual value at layer ‘l’ for k^th client, is given in relation (6).

$$\left\{\begin{array}{c}\left\{\begin{array}{c}{\mathit{Q}}_k^{\left(l\right)}={\mathit{H}}_k^{(l-1)}{\mathit{W}}_{Q,k}^{\left(l\right)},\\ {\mathit{K}}_k^{\left(l\right)}={\mathit{H}}_k^{(l-1)}{\mathit{W}}_{K,k}^{\left(l\right)},\\ {\mathit{V}}_k^{\left(l\right)}={\mathit{H}}_k^{(l-1)}{\mathit{W}}_{V,k}^{\left(l\right)}.\end{array}\right.\\ \left\{\begin{array}{c}{\mathit{O}}_{k,h}^{\left(l\right)}={\mathit{A}}_{k,h}^{\left(l\right)}{\mathit{V}}_{k,h}^{\left(l\right)}\\ {\mathrm{MHSA}}_k^{\left(l\right)}=\mathit{Contact}\left({\mathit{O}}_{k,1}^{\left(l\right)}, {\mathit{O}}_{k,2}^{\left(l\right)},\dots {\mathit{O}}_{k,h_k}^{\left(l\right)}\right)\end{array}\right.\\ {\mathit{U}}_k^{\left(l\right)}=\mathit{LN}({\mathit{H}}_k^{(l-1)}+{\mathrm{MHSA}}_k^{\left(l\right)})\end{array}\right.$$

(6)

Instead of applying the conventional feed-forward neural network (FFNN), gated FFNN transformation is implied with the Morlet wavelet activation function $(f\left(t\right)={\displaystyle \frac{1}{2\sigma }}\exp {\left(-(\mathit{\sigma t}\right)}^2) \times \mathit{Cos}(2\pi tf)$) whose architectural transformation is presented in Equation (7), while the overall output of the layer is given in Equation (8) along with the contextual depiction.

$$\left\{\begin{array}{c}\mathit{FFNN}\left(x\right)=W_2\sigma \times \left(W_{1}x+b_1\right)+b_2,\\ {\mathit{G}}_k^{\left(l\right)}=\sigma \left({\mathit{G}}_k^{\left(l\right)}{W}_g+b_g\right),\\ {\mathit{F}}_k^{\left(l\right)}=f\left({\mathit{U}}_k^{\left(l\right)}{W}_f+b_f\right).\end{array}\right.$$

(7)

$$\left\{\begin{array}{c}{\mathit{H}}_k^{\left(l\right)}=\mathit{LN}\left[{\mathit{U}}_k^{\left(l\right)}+\left({\mathit{G}}_k^{\left(l\right)}⨀{\mathit{F}}_k^{\left(l\right)}\right)\times {\mathit{W}}_{\mathit{o}}\right]\\ {\mathit{h}}_k=\mathrm{Pool}\left({\mathit{H}}_k^{\left(K_k\right)}\right)\end{array}\right.$$

(8)

A major contribution is the zero-day detection because an unseen attack can be forced into one of the known classes that are inadequate to pick through the conventional closed-set classifier principle. Therefore, the model produces both a class posterior as well as a zero-day anomaly score given in Equation (9).

$$S_{\mathit{ZD}}\left(x\right)=\alpha {\displaystyle \frac{E\left(x\right)-\mathit{\mu E}}{{\sigma }_E+ϵ}}+\mathit{\beta U}\left(x\right)+\gamma \left[1-\max \left(p_m\right(x\left)\right)\right]$$

(9)

where α + β + γ = 1, and the zero-day observation flag is triggered when S_ZD(x) is greater than a certain threshold (θ) that is selected exclusively using the validation set to avoid test-set leakage. The class posterior p_m is calculated using Equation (10), while the energy function E(x) and the normalized uncertainty measure are determined using Equation (11) and Equation (12), respectively.

$${\mathit{p}}_k=\mathit{softmax}\left({\displaystyle \frac{W_c{\mathit{h}}_k+b_c}{{\tau }_c}}\right)$$

(10)

$$E\left(\mathit{x}\right)=-{\tau }_c\log {\displaystyle \sum _{m=1}^M}\mathit{exp}\left({\displaystyle \frac{z_m\left(\mathit{x}\right)}{{\tau }_c}}\right)$$

(11)

$$U\left(\mathit{x}\right)=-{\displaystyle \frac{1}{\log \left(M\right)}}{\displaystyle \sum _{m=1}^M}{p}_m\left(\mathit{x}\right)\mathit{log}\left[p_m\left(\mathit{x}\right)+ϵ\right]$$

(12)

Another architectural-level contribution is employed by introducing multi-level knowledge transfer including representation-level KD (RLKD), attention-level KD (ALKD) and decision-level KD (DLKD). This is preferable to output-only KD because recent IDS research has demonstrated that transformer representations and selective knowledge transfer can reduce the computational burden while preserving detection capability. The representation-level KD loss relationship is given as:

$${\mathcal{L}}_{\mathit{rep}}={\displaystyle \frac{1}{L_s}}{\displaystyle \sum _{l=1}^{L_s}}{‖{\psi }_l\left({\mathit{U}}_{S,k}^{\left(l\right)}\right)-{\mathit{U}}_{T,k}^{\left(\pi \right(l\left)\right)}‖}_F^2$$

(13)

where ψ_l represents the heterogenous dimension into the representation space at layer ‘l’. The attention-level KD is calculated using the relation given in Equation (14).

$${\mathcal{L}}_{\mathit{EAtt}}={\displaystyle \frac{\sum _{\mathit{ij}}{w}_{\mathit{ij}}{(A_{T,\mathit{ij}}-A_{S,\mathit{ij}})}^2}{\sum _{\mathit{ij}}{w}_{\mathit{ij}}}}$$

(14)

where $w_{\mathit{ij}}=1+\left|A_{T,\mathit{ij}}-{\overline{A}}_T\right|$ that emphasize security-critical temporal interactions, an entropy-weighted attention discrepancy. Moreover, the DLKD is computed using temperature-scaled distributions with the comprehensive loss function given in Equation (15).

$$\begin{gathered} {\mathcal{L}}_{\mathit{MLKD}}={{\lambda }_r\mathcal{L}}_{\mathit{rep}}+{\lambda }_a{\mathcal{L}}_{\mathit{EAtt}}+{{\lambda }_d\mathcal{L}}_{\mathit{KD}} \\ {\lambda }_r+{\lambda }_a+{\lambda }_d=1 \end{gathered}$$

(15)

The privacy-preserving local function is formulated as for zero-day separation; a margin-based loss can be employed:

$$\begin{gathered} {\mathcal{L}}_k = {\mathcal{L}}_{\mathit{CE}}+{\lambda }_{\mathit{zd}}{\mathcal{L}}_{\mathit{ZD}}+{{\lambda }_{\mathit{kd}}\mathcal{L}}_{\mathit{MLKD}}+{\lambda }_{\mathit{reg}}{‖{\Theta }_k‖}_2^2 \\ {\mathcal{L}}_{\mathit{CE}}=-{\displaystyle \frac{1}{N_k}}{\displaystyle \sum _{i=1}^{N_k}}{\displaystyle \sum _{m=1}^M}{y}_{\mathit{im}}\log (p_{\mathit{im}}+ϵ) \\ \hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}{\mathcal{L}}_{\mathit{ZD}}={\displaystyle \frac{1}{N_k}}\sum _i\left[m_{\mathit{yi}}-(S_{\mathit{ZD}}\left({\mathit{x}}_i\right)-S_{\mathit{ZD}}\left({\overline{\mathit{x}}}_i\right))\right] \end{gathered}$$

(16)

In the proposed adaptive federated aggregation, parameters like data quantity, local validation quality, distribution divergence, model reliability and resource contribution perform distribution-aware aggregation rather than treating every client’s update as equally reliable as given in Equation (17).

$$\begin{gathered} {\Theta }_G^{t+1}=\sum _{k\in S_t}{\alpha }_k{\Theta }_k^{t+1} \\ {\alpha }_k={\displaystyle \frac{N_k^v{q}_k}{{\displaystyle {\sum }_{j=1}^K}{N}_j^v{q}_j+ϵ}} \end{gathered}$$

(17)

The architectural details and pipeline for AFET and MLKD are graphically presented in Figure 2.

Figure 2. Proposed AFET and MLKD architectural detail and pipeline.

Keeping in view the complexity of IoT traffic, the performance measures established for the evaluation of proposed framework are composed of accuracy, precision, recall, macro-F1 score, and ROC-AUC whose mathematical relations are well established in the literature [43,44]. Moreover, the zero-day detection rate (ZDR) is determined using relation in (18), while the Matthews correlation coefficient (MCC) for binary zero-day detection is calculated using Equation (19). The MCC is determined while keeping in view the strong class imbalance in the dataset.

$$\mathit{ZDR}={\displaystyle \frac{{\mathit{TP}}_{\mathit{ZD}}}{{\mathit{TP}}_{\mathit{ZD}}+{\mathit{FN}}_{\mathit{ZD}}}}\times 100$$

(18)

$$\mathit{MCC}={\displaystyle \frac{\left(\mathit{TP}\times \mathit{TN}\right)-\left(\mathit{FP}\times \mathit{FN}\right)}{\sqrt{(\mathit{TP}+\mathit{FP})(\mathit{TP}+\mathit{FN})(\mathit{TN}+\mathit{FP})(\mathit{TN}+\mathit{FN})}}}$$

(19)

The complete local training procedure of the proposed adaptive edge transformer for IoT intrusion detection is presented in Algorithm 1. It dynamically adjusts the transformer architecture according to the available edge resources while capturing temporal dependencies in heterogeneous network traffic through temporal-aware multi-head attention. The algorithm jointly optimizes supervised attack classification and zero-day detection, while gradient clipping and calibrated Gaussian perturbation improve training stability and privacy. Finally, the updated local model parameters are returned for subsequent federated aggregation.

Algorithm 1: Adaptive Edge Transformer for IoT Intrusion Detection

The MLKD procedure and confusion matrix generation mechanism for privacy-preserving adaptive FL are given in Algorithm 2 and Algorithm 3, respectively.

Algorithm 2: Multi-Level Knowledge Distillation

Algorithm 3: Confusion Matrix Generation Mechanism Privacy-Preserving Adaptive Federated Learning

The details regarding the hybrid optimization procedure based on GA–SQP are presented in Algorithm 4 in which the global best result of GA is provided as a start point for the SQP algorithm for fine-tuning the feature vector using different general and specific parameter values and settings tabulated in Table 2. GA searches a broad hyperparameter space while preserving feasible and high-performing solutions, whereas SQP subsequently refines the best GA solution under the defined constraints. This hybrid strategy aims to minimize the multi-objective cost function while achieving a suitable trade-off among detection performance, computational efficiency, communication/resource requirements, and model complexity, resulting in the optimized parameter vector θ*.

Algorithm 4: Hybrid Genetic–Sequential Quadratic Programming Optimization

Table 2. AFET–MLKD architecture parameters and GA–SQP algorithm values/settings used for experimental results on Edge-IIoTSet dataset.

Proposed AFET–MLKD Architecture Parameter Setting and Initial Values
Parameter	Value and Setting	Parameter	Value and Setting
Dataset	Edge-IIoTset	FL rounds	100
Input features	61	Local epochs	03
Output classes	15	Batch size	256
Client	10	Optimizer	AdamW
Training /Testing	80/20 (%)	Initial learning rate	1 × 10−04
Weight decay	1 × 10−04	Attention heads	2–8 adaptive
Dropout	0.10	KD temperature	4
Gradient clipping	1.0	KD coefficient	0.5 initially then adaptive
Transformer layer	2–6 Adaptive	FL client fraction	0.70
Embedding dimension	64–256 adaptive	DP noise multiplier	Σ ∈ [0.5–1.0]
Non-IID Dirichlet	α ∈ [1.0,0.5,0.1]	Others	Default
GA–SQP algorithm values/setting
GA		SQP
GA population	30	Start point	Best result of GA
GA generation	500	Random seed	5
Crossover probability	0.80	X-tolerance	1 × 10−10
Mutation probability	0.10	Function tolerance	1 × 10−10
Creation function	Constraint dependent	Constraint tolerance	1 × 10−12
Fitness scaling	Rank	Scaling	None
Selection process	Stochastic uniform	Perturbation bound	(0,∞)
Elite count	2.0	Hessian function	BFGS
Mutation	Adaptive feasible	Factorization process	Cholesky
Migration	Both	Approximated derivative	Central
Initial penalty	10	SQP iterations	300

4. Simulation and Results

Comprehensive results and discussion are presented by applying the proposed framework to the Edge-IIoTset dataset by considering various scenarios like centralized learning, IID federated learning, non-IID federated learning and zero-day attack detection respectively.

A. 

Experimental Dataset and Evaluation Protocol:

The proposed framework was evaluated using the Edge-IIoTset benchmark, a heterogeneous industrial IoT cybersecurity dataset designed for intrusion detection research under both centralized and distributed learning settings. The dataset comprises 61 selected traffic features derived from 1,176 extracted attributes, representing diverse communication and protocol characteristics across heterogeneous IoT/IIoT devices. It incorporates 14 attack types grouped into five major threat categories, together with normal traffic, thereby providing a challenging multi-class classification scenario with substantial behavioral diversity. The 61-feature DNN-oriented version was adopted in this study to provide a consistent and reproducible feature space for evaluating the proposed federated edge-learning framework, particularly its capability to distinguish previously observed attack patterns while assessing generalization toward zero-day threats. To ensure a rigorous and leakage-free assessment of zero-day attack detection, the unseen attack classes were completely excluded from the training and validation sets and reserved exclusively for the final zero-day evaluation. No samples from these attack classes were randomly removed after preprocessing or used during model development. This class-disjoint protocol ensures that the model encounters genuinely unseen attack behaviors during testing, thereby providing a more realistic assessment of its generalization capability against previously unobserved cyber threats. All experiments were conducted using a GPU-accelerated computing environment consisting of an NVIDIA RTX 4090, 24 GB VRAM with Intel Core i9-14900K processor, and 64 GB DDR5 memory. The software and hardware configuration was kept fixed throughout the experiments to ensure reproducibility, while the parameter values and setting for the proposed framework along the hybrid optimization algorithm are provided in Table 2.

It is worth mentioning that the performance of the proposed framework is sensitive to the GA–SQP hyperparameter settings; therefore, these parameters are selected through a systematic trial-and-error process until a suitable configuration is identified. The effects of these parameters on the fitness value (f^val), computational time (C^time), number of function evaluations (N^FEv) and convergence rate (r^conve) are tabulated in Table 3 along with various parametric options exploited to reach the final configuration as provided in Table 2.

Table 3. Sensitivity analysis of GA–SQP hyperparameters and their influence on objective-function fitness, computational time, function-evaluation cost, and convergence.

GA/SQP Setting	Values to Compare	Performance Measures
		fval	Ctime	NFEv	rconve
Population size	15	2.31 × 10−05	437.23	31,025	1.972 × 10−04
	30	4.59 × 10−07	451.57	35,128	3.761 × 10−05
	50	9.19 × 10−06	487.67	37,245	5.271 × 10−04
GA generations	200	4.36 × 10−05	437.15	32,547	7.291 × 10−04
	500	8.26 × 10−08	451.45	36,248	1.003 × 10−06
	700	7.82 × 10−06	487.59	37,985	9.261 × 10−04
Mutation probability	0.05	9.18 × 10−05	496.47	33,587	9.173 × 10−04
	0.10	3.28 × 10−05	498.37	36,254	2.826 × 10−04
	0.20	5.48 × 10−05	527.51	37,587	4.326 × 10−04
SQP stopping tolerance	10−06	2.18 × 10−05	468.91	37,254	2.374 × 10−03
	10−08	9.28 × 10−06	503.28	38,512	4.264 × 10−05
	10−10	4.27 × 10−07	514.12	38,975	7.302 × 10−06
Random seed	3	2.48 × 10−07	489.08	34,128	2.117 × 10−05
	5	1.64 × 10−08	494.67	35,216	9.264 × 10−07
	7	3.28 × 10−06	504.28	36,784	3.284 × 10−06
	10	7.84 × 10−06	514	35,987	7.584 × 10−05
	15	7.92 × 10−07	521	36,985	9.374 × 10−06

The dataset is split to produce training and testing sets for final model evaluation with two major categoric situations like normal and attack as described in Table 4.

Table 4. Normal and attack statistics in Edge-IIoTSet dataset.

IoT Traffic	Class	Records
Normal	Normal	11823840
Attack	Backdoor attack	23752
	DDoS-HTTP attack	227352
	DDoS-ICMP attack	2826494
	DDoS-TCP attack	2182650
	DDoS-UDP attack	3194636
	Fingerprinting attack	1341
	MIMT attack	1623
	Password attack	1167325
	Port-scanning attack	24214
	Ransomware attack	11273
	SQP-injection attack	50329
	Uploading attack	32941
	Vulnerability scanner attack	129843
	XSS attack	16109

Table 5 illustrates the randomly selected subsets’ data for the reported algorithms and the resulting training and testing sets after data cleaning and splitting. The zero-day attack (ZDA) categories are taken as backdoor, DDoS-ICMP and Ransomware attacks, respectively, and are entirely excluded from the model training procedure to avoid the risk of information leakage. The identities of the held-out classes and their sample counts are reported explicitly to make the evaluation reproducible. Preprocessing parameters, model selection, hyperparameter optimization, and any detection-threshold calibration are determined without access to the held-out zero-day samples or their labels. After the model configuration and decision rule have been fixed, the reserved samples are evaluated once using the predefined protocol.

Table 5. Characteristics of attacks and their statistics in training and testing.

Classes	Total	Training	Testing	ZDA Categories
Normal	24,301	19,440	4861	-
Backdoor attack	10,195	-	10,195	ZDA
DDoS-HTTP attack	10,561	8449	2112	-
DDoS-ICMP attack	14,090	-	14,090	ZDA
DDoS-TCP attack	10,247	8198	2049	-
DDoS-UDP attack	14,498	11,598	2900	-
Fingerprinting attack	1001	800	201	-
MIMT attack	1214	971	243	-
Password attack	9989	7991	1998	-
Port-scanning attack	10,071	8057	2014	-
Ransomware attack	10,925	-	10,925	ZDA
SQP-injection attack	10,311	8249	2062	-
Uploading attack	10,269	8215	2054	-
Vulnerability scanner attack	10,076	8061	2015	-
XSS attack	10,052	8042	2010	-

B. 

Experimental Scenarios and Applicability of Proposed Framework:

The proposed framework is trained using the complete training partition of Edge-IIoTset, without client partitioning, federated aggregation, differential privacy, or communication constraints. The experiments are developed based on the scenarios having centralized learning, IID federated learning and non-IID federated learning, respectively, that establishes the intrinsic classification capability of the transformer architecture and provides a reference against which the subsequent federated configurations can be evaluated. The model is trained using AdamW with an initial learning rate of 10⁻⁰⁴, batch size of 256, three local-equivalent training epochs per optimization cycle, adaptive transformer depth of 2–6 layers, embedding dimension of 64–256, and 2–8 attention heads. All experiments should be repeated using five independent random seeds, with the results reported as mean ± standard deviation. Table 6 presents the comparative intrusion detection performance of conventional centralized models and federated learning approaches under IID and non-IID data distributions. Among the centralized baselines, the transformer achieves the highest overall performance, attaining 92.31% accuracy, 92.08% precision, 93.26% recall, 94.37% macro-F1, and an MCC of 0.9136, demonstrating the advantage of attention-based temporal representation learning over RF, XGBoost, DNN, and LSTM architectures. Under IID federated learning, both FedAvg+DNN and FedAvg+Transformer improve upon the centralized baselines, with FedAvg+Transformer reaching 93.79% accuracy and 96.04% macro-F1, indicating that collaborative model training can improve the learned representation when client distributions remain relatively homogeneous. Under the more challenging non-IID setting, FedProx+Transformer further increases the accuracy and macro-F1 to 95.82% and 96.78%, respectively, while the incorporation of knowledge distillation (FL+KD) increases these values to 97.28% and 97.08%, respectively.

Table 6. Overall intrusion detection performance under IID and non-IID federated learning.

Model	Setting	Accuracy (%)	Precision (%)	Recall (%)	Macro-F1 (%)	MCC	RoC AUC
RF	Centralized	88.25 ± 0.12	89.19 ± 0.05	92.38 ± 0.16	90.35 ± 0.13	0.7845	89.35 ± 0.16
XGBoost		89.27 ± 0.16	89.93 ± 0.09	93.26 ± 0.18	89.87 ± 0.09	0.8467	90.23 ± 0.17
DNN		90.14 ± 0.09	90.25 ± 0.11	91.73 ± 0.09	90.56 ± 0.03	0.8892	92.19 ± 0.02
LSTM		91.89 ± 0.16	91.75 ± 0.06	92.27 ± 0.16	92.02 ± 0.16	0.9026	93.28 ± 0.19
Transformer		92.31 ± 0.12	92.08 ± 0.13	93.26 ± 0.09	90.12 ± 0.11	0.9136	93.78 ± 0.10
FedAvg + DNN	IID	93.53 ± 0.07	93.17 ± 0.03	94.52 ± 0.11	94.01 ± 0.09	0.9321	94.89 ± 0.13
FedAvg + Transformer		93.79 ± 0.12	93.93 ± 0.16	94.59 ± 0.07	93.79 ± 0.18	0.9462	95.17 ± 0.09
FedProx + Transformer	Non-IID	95.82 ± 0.04	95.76 ± 0.05	96.43 ± 0.12	95.39 ± 0.12	0.9562	96.87 ± 0.10
FL + KD		97.28 ± 0.12	97.97 ± 0.15	96.43 ± 0.08	96.17 ± 0.19	0.9642	96.98 ± 0.12
Proposed AFET–MLKD–GA–SQP		99.18 ± 0.04	98.07 ± 0.07	97.91 ± 0.11	98.03 ± 0.09	0.9735	99.82 ± 0.13

The proposed AFET–MLKD–GA–SQP framework achieves the highest reported values across the principal evaluation measures, with 99.18% accuracy, 98.07% precision, 97.91% recall, 98.03% macro-F1, 0.9735 MCC, and 98.82% ROC-AUC. In particular, the improvement in MCC and macro-F1 is important for the multi-class IoT intrusion detection setting because these metrics provide stronger evidence of balanced predictive performance than accuracy alone. The results therefore indicate that the combined resource-adaptive transformer, multi-level knowledge distillation, adaptive federated optimization, and GA–SQP parameter refinement can substantially mitigate the performance degradation associated with heterogeneous client distributions. Nevertheless, the reported metrics should be computed from the same class-wise predictions and evaluation partition for every method to ensure a statistically and methodologically fair comparison.

The proposed framework is also examined to see traffic predictability and its efficiency against various cyber-attacks in the form of a confusion matrix with binary as well as muti-classification, respectively. The results are drawn in Figure 3 and provide an accuracy of 99.18% in binary classification, as presented in Figure 3a, and accuracies of 99.42% and 98.26% for 6 classes and 15 classes as shown in Figure 3b and Figure 3c, respectively.

Figure 3. Confusion matrix generated by applying AFET–MLKD–GA–SQP framework for different classes: (a) 2 classes (b) 6 classes (c) 15 classes.

The normalized confusion matrix obtained using the AFET–MLKD framework optimized through GA–SQP on the Edge-IIoTset dataset demonstrates strong class-discriminative capability across the six aggregated traffic categories as presented in Figure 3b. The proposed model achieves an overall accuracy of 99.42%, with particularly strong recognition of DDoS, MITM, and normal traffic, obtaining diagonal recognition rates of 0.992, 0.978, and 0.989, respectively. The Injection class is correctly identified in 96.7% of cases, while the principal residual confusion occurs between Malware and Injection, where approximately 42% of Malware samples are predicted as Injection and 54% are correctly classified as Malware. This behavior indicates that the learned representations capture most attack-specific characteristics, while the semantically related injection/malware traffic remains comparatively difficult to separate. The Scanning category achieves a normalized true-positive rate of approximately 0.77, with 18% of Scanning samples misclassified as DDoS, representing the second major source of confusion. Conversely, the Normal class exhibits a high recognition rate of 98.9%, indicating a low false-alarm tendency against legitimate traffic. The relatively strong diagonal dominance across the matrix demonstrates that the adaptive edge transformer effectively captures discriminative traffic patterns, while MLKD transfers informative representations and attention patterns to the edge model. The subsequent GA–SQP optimization further refines the coupled model parameters under the accuracy and resource-related objectives, contributing to improved class separation. Overall, the matrix provides evidence that AFET–MLKD–GA–SQP maintains robust multi-class intrusion discrimination on Edge-IIoTset, although Malware–Injection and Scanning–DDoS confusions remain important areas for further class-specific optimization.

The normalized confusion matrix in Figure 3c demonstrates the class-discriminative capability of the proposed AFET–MLKD framework optimized using GA–SQP on the Edge-IIoTset dataset, with a pronounced diagonal dominance across the 15 traffic classes. The model achieves high class-wise recognition for Normal (0.99), Back (0.98), TCP (0.98), UDP (0.98), ICMP (0.97), MITM (0.97), Port (0.98), and Pwd (0.96), indicating that the adaptive transformer representations effectively capture both protocol-level and behavioral characteristics of heterogeneous IoT/IIoT traffic. The Fing (0.93), Rans (0.92), SQL (0.94), Upload (0.95), Scan (0.88), and XSS (0.91) classes also exhibit strong true-positive rates, although comparatively larger off-diagonal responses are observed for minority and semantically overlapping attack categories. In particular, Ransomware (Rans) shows approximately 5% confusion with Back and 1% with Fing, whereas Scan exhibits 7% confusion with HTTP, suggesting residual overlap between scanning activity and HTTP-based communication patterns. Similarly, XSS produces approximately 4% confusion with HTTP and 5% with Scan, reflecting the similarity of application-layer traffic characteristics. The SQL and Upload classes remain comparatively well separated, with only limited cross-confusion, demonstrating that the learned feature space preserves discriminative attack signatures. From an architectural perspective, the strong diagonal structure can be attributed to the joint effect of resource-adaptive edge transformer encoding, multi-level knowledge distillation, and GA–SQP-based parameter refinement: the transformer captures contextual traffic dependencies, MLKD transfers discriminative representation and decision knowledge to the edge model, while GA provides global exploration of the coupled parameter space and SQP performs constrained local refinement. Consequently, the substantially reduced off-diagonal mass indicates improved class separability under heterogeneous IoT traffic conditions, while the remaining confusion concentrated in Rans–Back, Scan–HTTP, and XSS–HTTP/Scan provides clear evidence of the challenging attack boundaries that should be considered in subsequent class-specific optimization and zero-day detection analysis.

Figure 4 illustrates the evolutionary optimization behavior of the GA stage of the proposed GA–SQP optimizer for AFET–MLKD on the 15-class Edge-IIoTset benchmark. The rapid reduction and subsequent stabilization of the best, mean, and worst objective values demonstrate progressive convergence from global exploration to a stable high-quality region of the parameter space. The concentrated score histogram and reduced population-level fitness dispersion further indicate that inferior configurations are progressively eliminated through selective reproduction. Meanwhile, the nonuniform offspring allocation confirms that high-quality chromosomes receive greater evolutionary pressure while maintaining limited diversity for continued exploration. After convergence of the GA stage, the best feasible chromosome is transferred to SQP for constrained local refinement. This two-stage optimization strategy is particularly appropriate for AFET–MLKD because the coupled search variables jointly affect classification performance, zero-day detection, computational complexity, communication overhead, latency, energy consumption, and privacy.

Figure 4. Optimization profile of GA–SQP hybrid mechanism for tuning the 15 traffic classes.

The class-wise feature-importance analysis of the proposed AFET–MLKD–GA–SQP framework on the 15-class Edge-IIoTset benchmark, which provides an interpretable view of the traffic characteristics learned by the optimized adaptive edge transformer, is presented in Figure 5. It reveals clear attack-specific feature dependencies: traffic-volume features (src_bytes, dst_bytes) dominate several malware and transfer-based attacks, TCP/UDP/ICMP characteristics are prominent for the corresponding DDoS categories, while HTTP attributes such as http.request.version, http.request.method, and http.request.uri are highly informative for application-layer attacks such as SQL injection and XSS. Features including tcp.connection.syn, tcp.flags, ttl, and dst_host_count are particularly relevant to MITM, fingerprinting, and scanning behaviors. This class-dependent importance distribution demonstrates that the adaptive transformer learns heterogeneous and discriminative traffic representations, while MLKD preserves these informative patterns in the edge model and GA–SQP optimizes the resulting parameter configuration. Overall, the figure provides interpretable evidence that the proposed framework exploits protocol-, connection-, payload-, and application-level characteristics for robust multi-class intrusion detection. Sensitivity is examined by changing the resulting ciphertext with a small perturbation in secret key.

Figure 5. Feature importance for the 15 attacker classes using the proposed AFET–MLKD optimized with GA–SQP for Edge-IIoTset dataset; the bar charts show the relative contribution of the top six most important features for each class.

Table 7 provides comparisons of the proposed AFET–MLKD with GA and GA–SQP optimization to the representative centralized, federated, fog-based, and knowledge distillation (KD) intrusion detection systems analyzed on the Edge-IIoTset dataset. The standard centralized methods indicate a steady enhancement in terms of accuracy, starting from the DNN (94.82%), RF (96.91%), progressing to CNN-RNN (96.17%), and ending with XGBoost + LightGBM (96.60%), which reflects an advantage of using increasingly powerful nonlinear feature learning. In general, federated and edge-specific approaches tend to provide superior performance, with the corresponding accuracy achieved by the KD + FL (98.47%), Fog FL (98.72%), ABCNN-IDS (98.91%), and FedNova-based transformer (98.00%) approaches, and AUC between 0.990 and 0.996. In particular, the proposed AFET–MLKD optimized with GA reaches 98.97% accuracy, 98.07% precision, 97.97% F1-score, and 0.992 AUC, while using the constrained refinement based on SQP after GA exploration yields additional improvements of these metrics up to 99.18%, 98.38%, 98.92%, and 0.998, correspondingly. Thus, the increase in accuracy, precision, F1-score, and AUC from GA to GA–SQP equals about 0.21 percentage points, 0.31 points, 0.95 points, and 0.006 points, respectively.

Table 7. State-of-the-art comparison of federated and edge-based intrusion detection methods on Edge-IIoT dataset.

Method	Learning Paradigm	Accuracy (%)	Precision (%)	Macro-F1 (%)	AUC
DNN [28]	Centralized	94.82	-	-	-
RF+FedAvg [34]	IID	95.43	-	-	-
CNN-RNN [35]		96.17	-	-	-
RF [36]		96.91	-	-	-
KD+FL [37]		98.47	98.41	98.38	0.995
CNN-BiLSTM [38]		98.13	98.02	97.98	NR
Fog FL [39]		98.72	98.54	98.58	0.996
Attention CNN [40]	ABCNN-IDS	98.91	98.83	98.81	NR
Transformer [41]	FedNova	98.00	97.00	96.50	0.990
XGBoost+LightGBM [42]	Centralized	96.60	96.00	96.40	0.983
Proposed AFET–MLKD–GA		98.97	97.07	97.97	0.992
Proposed AFET–MLKD–GA–SQP		99.18	98.07	98.03	0.998

The exceptionally high value of AUC proves excellent class separation ability among the tested traffic categories, while the increase in F1-score shows improvement in balancing the rate of false positives and false negatives. Overall, the findings confirm the efficiency of using adaptive transformer-based representation learning, multi-level knowledge distillation, global GA search, and SQP with constraints for Edge-IIoTset intrusion detection.

It is clear from Table 8 that there is an increase in performance regarding both known attacks and zero-day attacks with the addition of the proposed components. Traditional DNN and transformer networks give considerably higher recall performance for known attacks as compared to strictly unseen attack categories, where zero-day recall performance drops to 68.37% and 76.92% for the two, respectively, which depicts the nature of the distribution shift problem in traditional supervised learning. FedAvg and FedProx show some improvement in zero-day detection through collaborative training process, whereas a further increase in zero-day recall to 83.76% is made by the resource-aware AFET model through learning better contextual information of the traffic data. The addition of the MLKD technique improves the zero-day recall to 88.43%, suggesting that transfer of knowledge at the representation level, attention level, and decision level enhances the discriminative properties of the student model for the student network. The complete model of AFET–MLKD–GA–SQP provides a zero-day recall of 94.17%, 95.36% zero-day precision, and 94.17% ZDR along with 98.92% known-attack recall performance.

Table 8. State-of-the-art comparison of federated and edge-based intrusion detection methods on Edge-IIoT dataset.

Model	Known Recall (%)	Zero-Day Recall (%)	Zero-Day Precision	ZDR
DNN	91.42 ± 0.31	68.37 ± 0.52	72.84 ± 0.47	68.37 ± 0.52
Transformer	94.18 ± 0.24	76.92 ± 0.43	79.65 ± 0.38	76.92 ± 0.43
FedAvg	93.27 ± 0.29	72.64 ± 0.48	75.81 ± 0.42	72.64 ± 0.48
FedProx	94.63 ± 0.26	78.51 ± 0.39	81.73 ± 0.35	78.51 ± 0.39
AFET	96.21 ± 0.18	83.76 ± 0.34	85.92 ± 0.31	83.76 ± 0.34
AFET+MLKD	97.18 ± 0.15	88.43 ± 0.29	89.76 ± 0.26	88.43 ± 0.29
AFET–MLKD–GA–SQP	98.92 ± 0.08	94.17 ± 0.21	95.36 ± 0.18	94.17 ± 0.21

C. 

Impact Analysis on the Integration of Principle Components:

The three principal mechanisms address distinct but interconnected sources of performance variation in federated edge intrusion detection. AFET determines how local model updates contribute to the global model, thereby addressing differences in client reliability, data quality, and heterogeneous data distributions. MLKD operates at the representation, attention, and prediction levels to transfer discriminative information from the teacher model to resource-constrained student models. The hybrid GA–SQP optimizer acts at the hyperparameter-optimization level of the model for FL configurations: the GA explores the global search space, while SQP refines promising solutions under the specified constraints. Although these mechanisms are functionally distinct, their combined benefit cannot be inferred from architectural design alone; therefore the individual contributions and potential interactions are assessed through controlled ablation experiments using identical data partitions, evaluation criteria, and computational conditions, and the results are reported in Table 9. It is quite evident from the table that the analysis measures the individual and collective contributions of each component in terms of known-attack recognition, ZD-attack detection, the macro-F1 score, and the time taken for inference at the time of deployment. The base FL system provides known-attack recall, ZD-attack recall, and macro-F1 scores of 91.35%, 70.82%, and 89.40%, respectively, representing the baseline performance level in the absence of the proposed components. The use of AFET in addition to the FL scheme enhances the aforementioned metrics to 96.21%, 83.76%, and 94.12%, respectively, showing the ability of adaptive transformers to learn discriminative traffic representations and improve generalization to unseen attacks. Using MLKD separately leads to 93.14% known-attack recall, 85.27% ZD-attack recall, and macro-F1 score of 93.56%, which means that MLKD might help improve generalization of learned discriminative features in the presence of distributional variations inherent to heterogeneous IoT environments. The AFET–GA–SQP configuration obtains known-attack recall of 97.84%, ZD recall of 89.76%, and macro-F1 score of 97.23%, while MLKD–GA–SQP configuration obtains 95.63%, 90.12%, and 95.74%, respectively, which implies that configurations that utilize optimization may improve attack class discrimination when used along with either FL or MLKD transfer approaches. The full system obtains the best results, obtaining known-attack recall of 98.92%, ZD recall of 94.17%, and macro-F1 score of 98.26%, thus showing the best detection capabilities compared to all other configurations. As far as deployment efficiency is concerned, the increased inference latency goes up from 42.60 ms in the case of baseline FL to 97.40 ms in the case of the full system that can be compromised while keeping in view the detection capabilities and F1 score.

Table 9. Functional complementarity of the integrated components.

Variant	AFET	MLKD	GA–SQP	Known Attack Recall (%)	ZD Recall (%)	Macro-F1 (%)	Interface Latency (ms)
Baseline FL	No	No	No	91.35	70.82	89.40	42.60
AFET only	Yes	No	No	96.21	83.76	94.12	38.40
MLKD only	No	Yes	No	93.14	85.27	93.56	31.80
AFET + MLKD	Yes	Yes	No	97.18	88.43	96.72	57.60
AFET + GA–SQP	Yes	No	Yes	97.84	89.76	97.23	83.10
MLKD + GA–SQP	No	Yes	Yes	95.63	90.12	95.74	88.97
Complete framework	Yes	Yes	Yes	98.92	94.17	98.26	97.40

D. 

Validation of Privacy-Preserving:

Privacy-preserving is validated by investigating the trade-off between privacy protection and detection accuracy. In this regard, the detection performance graph is plotted in Figure 6 to show the effectiveness of intrusion detection in relation to the strength of differential privacy (DP) in the proposed approach.

Figure 6. Privacy–utility trade-off in detection performance across DP configurations.

The non-DP setup demonstrates the highest detection baseline with macro-F1 of 98.00% and zero-day attack recall of 94.50%. As the level of noise in DP increases, both of the measures decrease because of utility degradation due to adding noise to model updates to ensure privacy. Thus, the most extreme example of privacy setup (DP-1, ε = 0.5) provides a macro-F1 of 91.80% and zero-day recall of 82.40%, while higher privacy budgets lead to better detection performance with macro-F1 of 97.30% and zero-day recall of 93.00% at ε = 8.0. This indicates that the key point of the privacy–utility dilemma is that more privacy ensures larger amounts of perturbation that reduces discriminative ability of learned features and decreases the generalization performance to novel attack types. On the other hand, relaxing the privacy condition will help to retain more task-specific information and thus achieve better detection results but fewer lesser privacy assurances.

5. Conclusions, Limitations and Directions for Future Research

On the basis of comprehensive simulations, the following conclusions can be drawn:

• The designed AFET–MLKD–GA–SQP algorithm offers 99.18% accuracy, 98.07% precision, 97.91% recall, 98.03% macro-F1 score, 0.9735 MCC, and 98.82% ROC-AUC. High values for MCC and macro-F1 scores confirm the balanced nature of the multi-class task, whereas the high scores obtained overall show the effectiveness of using the integrated algorithms for handling heterogeneous clients.
• In general, the confusion matrices prove that AFET–MLKD–GA–SQP is able to offer very reliable discrimination for binary, six-class, and 15-class intrusion cases, reaching 99.18%, 99.42%, and 98.26% accuracies, respectively. The strong diagonal predominance indicates successful learning of different IoT traffic types, whereas the residual Malware–Injection, Scanning–DDoS, and application-layer confusions reveal problematic class borders. Thus, the obtained results confirm the efficiency of applying adaptive transformer, multi-level knowledge distillation, and GA–SQP techniques for improving multi-class intrusion discrimination.
• The comparative findings show that AFET–MLKD–GA–SQP always outperforms the representative centralized, federated, fog, and KD-enabled methods in intrusion detection using Edge-IIoTset. The changeover from GA to constrained GA–SQP optimization enhances the accuracy, precision, F1-score, and AUC, indicating the effectiveness of concurrent global search and constrained optimization. From the above findings, it is clear that the proposed approach gives a better optimization technique for heterogenous IoT intrusion detection.
• The new approach of AFET–MLKD–GA–SQP successfully combines adaptive edge transformer learning, multi-level knowledge distillation, federated learning, and GA–SQP-based optimization for better intrusion detection while ensuring privacy. This approach managed to yield 98.92% and 94.17% recall for known attacks and zero-day attacks, respectively.
• The AFET–MLKD–GA–SQP architecture is being currently tested under a certain number of IoT/IIoT attacks that do not cover the latest attacks like advanced persistent threats, botnet proliferation, supply chain attacks, insider attacks, and ML-driven adversary attacks. Research in the future will focus on resource-efficiency assessment while keeping in view the practical edge computing deployment scenarios in terms of communication overhead, edge inference latency, model size, and training convergence iterations and peak runtime memory usage. Moreover, the generalization across heterogeneous IoT environments through the proposed framework will also be investigated on the CIC-IoT2023 and CICIoMT2024 datasets.