A Hybrid Federated–Incremental Learning Framework for Continuous Authentication in Zero-Trust Networks

Abstract

Zero-trust architecture (ZTA) requires continuous and adaptive identity authentication to maintain security in dynamic environments. However, current federated learning (FL)-based authentication models often struggle to incorporate evolving attack patterns without experiencing catastrophic forgetting. Moreover, non-independent and identically distributed (non-IID) client data and concept drift frequently lead to degraded model robustness and personalization. To address these issues, this paper presents a hybrid learning framework that integrates federated learning with incremental learning (IL) for sustainable authentication. A Dynamic Weighted Federated Aggregation (DWFA) algorithm is developed to mitigate concept drift by adjusting aggregation weights in real time, ensuring that the global model adapts to changing data distributions. This approach enables continuous learning from distributed threat data while maintaining privacy and eliminating the need for historical data retention. Experimental results on real-world traffic datasets indicate that the proposed framework outperforms conventional FL baselines, reducing the overall error rate by approximately 56% and improving the detection rate for novel attack types by over 17.8%. Furthermore, the framework remains stable against performance decay while maintaining efficient communication overhead. This study provides an adaptive, privacy-preserving solution for identity authentication in zero-trust systems.

1. Introduction

The combination of cloud computing, mobile office, and Internet of Things technologies has rendered conventional network security systems based on static borders increasingly outdated. To counter this, zero-trust architecture, as defined by the concept of never trust, but always verify, has emerged as the center of the paradigm shift in modern digital infrastructure security [1]. The essence of zero-trust architecture is dynamism because it necessitates the real-time risk assessment of each access request and session connection. Identity authentication forms part of this procedure [2,3]. Hence, authentication systems are required to go beyond standard one-time password verification. They should be intelligent agents that can sense context constantly, learn behavioral patterns over time, and adapt their level of trust accordingly.

Creating a smooth, adaptive identity authentication system faces two serious challenges. The first is that severe limitations are imposed by privacy requirements on data seclusion. Log data (login time, routine activities, and network data traffic) can be scattered across different departments, subsidiaries, or cloud computing services. International standards of data privacy (including GDPR and CCPA) and enterprise confidentiality rules prevent the centralized accumulation of this information, leading to the creation of so-called data silos [4]. This results in inadequate training examples for centralized machine learning models, making it hard to detect complicated coordinated assaults. Furthermore, the changing nature of security threats and behavioral trends presents another challenge. The methods used by attackers change constantly, and the devices, locations and work habits of users also change constantly—a phenomenon known as “concept drift” [5]. Historical data models are statically trained, and they are ineffective over time because they cannot predict new attack classes or respond to significant changes in user behavior.

Federated learning, a privacy-protecting distributed machine learning strategy, has emerged as the latest solution to the first problem [6,7]. It allows several entities to jointly train a central global model without revealing their individual local data, thus successfully solving the issue of data silos. However, traditional federated learning models such as Federated Averaging (FedAvg) do not consider a fixed data setting. The regular periodic global aggregation is too slow and burdensome to support a steady stream of authentication that requires rapid adjustments to changes [8]. The system does not have effective mechanisms to ensure the steady integration of observed threat patterns or behavioral characteristics of any of the parties involved in real time.

This research investigates how federated and incremental learning can be integrated to come up with a framework for identity authentication that can be applied in a zero-trust setting. This framework focuses on privacy protection as well as constant evolution. The primary contribution of the paper is a model of federated incremental identity authentication for use in zero-trust architecture. With the dynamic weighted aggregation algorithm, the model enables the central server to focus on the newest and most relevant updates from each client. This method enables the swift and steady online development of the global authentication model. The contributions of this paper are as follows:

• Our federated learning design is integrated into the zero-trust control plane. Here, we were able to delineate the duties and security assumptions of all entities participating in continuous authentication. The proposed dynamic federated aggregation strategy considers both the recency of model updates and the integrity of local contributions. It can mitigate the decrease in performance due to non-independent and identically distributed data and respond to new challenges faster.
• We performed numerous experiments on a dataset that involved both real-world network attack information and synthetic user behavior. The results proved that the scheme we suggest significantly contributes to improving the quality of authentication, especially when an unknown attack is detected early. Also, we measured its real-world performance, especially communication overhead and convergence speed. Initially, we are going to assess the current research position in the field of interest. Next, we will explain the architecture and algorithm design behind the suggested model. After that, we will check how effective the model is by systematically comparing the experimental results. Lastly, we will summarize the findings and provide possible future research directions.

2. Related Research Work

In this section, we explore three interdependent topics discussed in previous studies: the development of identity authentication technology in zero-trust architecture, the use of federated learning in network security, and the adaptability of incremental learning to changing conditions. The comparison and contrast of these fields help to define the positioning of this study and opportunities for innovation.

2.1. Dynamic Identity Authentication in Zero-Trust Architecture

The concept of zero-trust architecture does away with implied trust based on the network and places more emphasis on identity, with dynamic controls of access based on context. The initial versions of zero-trust architecture, such as Google BeyondCorp [9], connected device listings with user identities. However, the systems were also based on fixed authentication rules. Since then, research has moved to a more sophisticated idea of continuously evaluating risks based on multi-dimensional indications. One method is to authenticate implicitly using behavioral biometrics, such as keystroke dynamics [10] and gestures [11]. Although these approaches are seamless, their need for special sensors and real-time data restricts their applicability. A different method utilizes discrete contextual data that is accessible, e.g., logon IP, time series, and device fingerprints, to construct behavioral patterns [12]. But these mechanisms generally use the information of one entity only, which limits the models’ performance due to the small scale of local data and its lack of diversity, and they are ineffective in defending against cross-domain and collaborative advanced attacks.

2.2. Applications of Federated Learning in Network Security and Identity Authentication

Federated learning is a concept that involves keeping the datasets constant and the model moving. It is an encouraging solution to overcome the silos of the security data and facilitate collaborative modeling without compromising on privacy. When detecting intrusions, federated learning can be used successfully to combine traffic logs of different network zones, making the detection of distributed attacks higher [13]. Researchers are investigating federated learning as a tool to use in identity authentication to consolidate the data of user behavior across various parties, making the authentication models stronger. For example, Rong Xie et al. [14] applied the federated learning approach to train a support vector machine model using user login data on several platforms, thus significantly decreasing misrecognition rates caused by data shortage when each platform is used separately. Likewise, to reduce the single-point threat of centralized detection, Haoyu Jiang et al. [15] applied federated learning to jointly train a DDoS attack detection model on a software-defined network. It should be noted that these studies point to the possibility of using federated learning to improve security and universality in authentication systems. However, most of them use FedAvg or its derivatives to periodically globally aggregate. This strategy is a batch learning method in which the distribution of the data remains fixed; it does not have the tools necessary for reacting rapidly to new developments within local data distributions and changing threat trends.

2.3. Incremental Learning Technology for Dynamic Environments

Continuous learning, also referred to as incremental learning, helps models obtain new data by streaming them into the data flow and stopping the deletion of already acquired knowledge [16,17,18,19]. Authentication models face continuously changing concept drifts due to changing attack strategies and changing user behavior in dynamic network environments. Historically, models are regularly retrained on new data, which is expensive computationally, and there is the risk of losing important historical trends. Incremental learning is a solution to evolving models on non-stationary data streams through methods such as elastic weight consolidation, dynamic network expansion, or memory replay [20,21,22]. Recently, federated incremental learning, which combines federated learning with incremental learning, has gained attention. For instance, the authors of [23] highlight the challenges of non-IID data and incremental learning processes in federated settings, noting that concept drift and catastrophic forgetting remain open issues. Other researchers have proposed adaptive aggregation methods for industrial IoT scenarios [24]. However, these techniques primarily focus on maximizing overall classification accuracy under data distribution shifts and do not address the specific requirements of continuous identity authentication in zero-trust networks, such as fine-grained, real-time risk assessment and privacy-preserving collaboration. Furthermore, they have not systematically addressed how to balance both the efficiency of model evolution and the overhead of communication and privacy enhancement in the process.

2.4. Summary of Research Status

The current literature depicts a clear evolutionary course, but still shows some significant gaps in integration. The identity authentication required in zero-trust architecture must have an intelligent model that may use multi-party information to perform ongoing and dynamic activities. Federated learning provides a solution to privacy-preserving collaboration, but its historic version is not flexible. Although incremental learning enables models to change, it does not have full-blown capabilities in authentication situations that demand privacy protection and distributed collaboration. As shown in

Table 1. Comparison of closest related work.

Method	Application	Handles Concept Drift	Privacy Mechanism	Key Innovation
FedAvg [7]	General FL	No	None	Periodic averaging
FedProx [8]	Heterogeneous FL	No	None	Proximal term for non-IID data
FA-FedAvg [24]	Federated incremental learning	Limited	None	Adaptive aggregation weights
Ours (FIL-ZTA)	Zero-trust authentication	Yes (dynamic screening + contribution weighting)	Differential privacy	Closed-loop feedback + robust aggregation

, existing federated learning methods either lack mechanisms for handling concept drift (FedAvg, FedProx) or provide only limited adaptability (FA-FedAvg). One field of promising research is to combine the privacy-collaboration power of federated learning with the dynamism of incremental learning to adapt to zero-trust continuous authentication. This integration is intended to overcome such problems as data isolation, concept drift, and privacy constraints. This is the aim of the current paper. Our FIL-ZTA framework explicitly addresses concept drift through dynamic client screening and contribution-aware weighting, while also incorporating differential privacy to protect user data. This combination of features is novel in the context of zero-trust continuous authentication.

3. Federated Incremental Identity Authentication Model for Zero Trust (FIL-ZTA Model)

This section describes the proposed federated incremental identity authentication model in the context of zero-trust architecture. First, it gives an overview of the architecture of the system, names the entities involved, and makes assumptions concerning threats, laying down the framework on which the subsequent algorithm design will be based.

3.1. System Architecture and Threat Model

3.1.1. Participating Entities and Function Definitions

This model features a three-layer collaborative architecture, including a zero-trust control plane, a federated aggregation layer, and a distributed terminal layer, as shown in Figure 1. The three categories of entities collaborate within this system architecture to perform the system’s essential functions. Their functions and interaction form a closed loop of continuous authentication.

The terminal device acts as a policy enforcement point (PEP) and a federated client, and mostly performs localized computing at the data source. After the generation of behavior data, the terminal carries out local feature extraction and preprocessing. This supports the incremental training and fine-tuning of the global authentication model downloaded by the federated aggregation server. After training, the terminal encrypts and uploads the updates to model parameters, such as gradients or differentials of weights, in order to maintain the original data inside a local trusted border. The terminal also runs dynamic access control commands through the policy decision point, which acts as the final execution point to enforce policies.

The federated aggregation server is a coordinating center for managing safe aggregation and model distribution in cases of model co-evolution. It operates under the “honest but curious” security model, strictly adhering to the predefined aggregation protocol while potentially being interested in the received intermediate parameters. The server uses an aggregation algorithm that incorporates privacy protection and robustness-enhancing mechanisms (see Section 3.3 for details) to merge model updates from numerous terminals, producing a new-generation global authentication model with enhanced performance. The server also oversees the management and distribution of global model versions.

In a zero-trust environment, the policy decision point (PDPs) and the dynamic trust engine form the core of intelligent decision-making. The dynamic trust engine does not process raw data directly; instead, it integrates the latest global authentication model from federated learning. When a terminal requests access, the engine receives desensitized context and behavior feature vectors. It then uses the model for real-time risk assessment, producing a quantified risk score. PDP incorporates this rating with the existing global security policy and the minimum access principle of least privilege. Such a combination produces context-specific, fine-grained access control decisions like grant/deny access or initiates multi-factor authentication. The decisions are subsequently conveyed onto the respective terminal policy enforcement points.

3.1.2. Threat Model and Security Assumptions

In order to ensure security parameters and design objectives of the scheme, we clarify the threat models and assumptions below.

Four main threats are addressed by the system design. First, there are attacks based on privacy inference wherein external attackers or so-called honest but curious aggregation servers can attempt to infer sensitive information about user actions or identity using published model updates. Second, there are model poisoning attacks whereby malicious clients send poisoned updates in an effort to install backdoors or adversely affect the performance of the global model. Third, there are so-called free-riding attacks, where participants contribute little to the process or send poor-quality updates to exploit the global model without charge, which consumes resources and may lower the quality of the model. Finally, environmental dynamics represent a problem of the zero-trust architecture. This involves changing attacking methods and natural user behavior, which is also called concept drift and requires the authentication model to have constant flexibility.

The proposal also deals with security vulnerability because it is based on a few crucial assumptions. Most terminal users in the federated learning are trustworthy, with un-compromised local training procedures. The federated aggregation server is honest but curious, which means that the server can follow protocols properly but may also examine data. The communication channels used by terminals, servers, and policy decision points are based on TLS to provide data confidentiality and integrity. This access control authority is known as the policy decision point and is assumed to be completely trusted. The aim is to create an identity authentication system that can alleviate privacy threats, withstand attacks, and evolve based on changing security threats in this structure.

3.2. Local Lightweight Authentication Model

When designing an authentication model in zero-trust architecture on the terminal side, it is essential to take into account resource limitations such as computing capabilities, memory capabilities, and battery capabilities. The local model should be implemented in such a way that computational complexity is minimum, as little memory is used as possible, and efficient inference is achieved without the loss of authenticity. In this section, a lightweight local authentication model of user behavior sequences is described, including the behavioral feature representation, a streamlined model structure, and the particular local training objective function.

3.2.1. Extraction of Discrete–Continuous Hybrid Behavior Features

The model input balances the general and private aspects of a hybrid feature set. The set consists of a combination of discrete contextual features and continuous statistical features. These are based on available data, such as access logs and network traffic metadata. It is important to note that the model does not involve biometric features that need particular hardware.

The initial order of behaviors ${\mathcal{D}}_{\mathrm{k}}=\{{\mathrm{r}}_1,{\mathrm{r}}_2,\dots ,{\mathrm{r}}_{\mathrm{m}}\}$ is received by the k-th client during the time interval $\mathrm{T}$. Every record ${\mathrm{r}}_{\mathrm{i}}$ has a set of attributes, such as timestamp, source IP, device identifier, and operation type. The feature engineering step includes the following:

1. Statistical-encoding discrete context features: To encode discrete variables such as the device identifier (dev) and login source (src) without having to use high-dimensional one-hot coding, we use summary statistics computed on window $T$. This strategy can be applied to describe user behavior with low-dimensional vectors. As an example, based on the device identifier sequence, we obtain the mode (the most commonly used device), the count of unique values (the number of devices used), and the sub-mode (the second most commonly used device):

$${\mathbf{f}}^{dev}=\left[mode\left(dev\right), count\_unique\left(dev\right), top2\left(dev\right)\right]$$

(1)

where $mode\left(dev\right)$ denotes the most frequent device identifier in the time window, $count\_unique\left(dev\right)$ denotes the number of distinct devices, and $top2\left(dev\right)$ denotes the second most frequent device.

In a similar way, we use the homomorphic processing of other fields such as IP addresses and types of operations. Next, we append every statistical vector to form one discrete feature sub-vector ${\mathrm{f}}^{disc}\in {\mathbb{R}}^{{\mathrm{d}}_1}$.

2. Statistics of Moment of Continuous Time Series Features: In order to examine the rhythm, regularity, and abruptness of access behavior in the request interval time series $\{\Delta t_1,\Delta t_2,\dots \}$, we consider a number of moment statistics. In addition to the conventional mean ($\mu$) and standard deviation ($\sigma$), we also use the coefficient of variation (CV) as a measure of spread. The interval entropy time $H_{\Delta t}$ is estimated to quantify uncertainty:

$$CV={\displaystyle \frac{{\sigma }_{\Delta t}}{{\mu }_{\Delta t}}}$$

(2)

$$H_{\Delta t}=-\sum _{j}P(\Delta t_j)\log P(\Delta t_j)$$

(3)

Here, ${\mu }_{\Delta t}$ and ${\mathsf{\sigma }}_{\Delta \mathrm{t}}$ are the mean and standard deviation of the request interval time series, and $CV$ is the coefficient of variation. $H_{\Delta t}$ is the entropy of the interval time series, where $P(\Delta t_j)$ is the probability distribution of the normalized interval time. The continuous feature sub-vector is defined as ${\mathrm{f}}^{cont}=[{\mu }_{\Delta t},{\sigma }_{\Delta t},CV,H_{\Delta t}]\in {\mathbb{R}}^{{\mathrm{d}}_2}$.

On combining and normalizing both feature types, we end up with the resulting comprehensive behavioral feature vector $\mathrm{x}\in {\mathbb{R}}^{\mathrm{d}}$ (with $\mathrm{d}={\mathrm{d}}_1+{\mathrm{d}}_2$). It is this vector that becomes the input to the local model:

$$\mathbf{x}=Norm\left(Concat({\mathbf{f}}^{disc},{\mathbf{f}}^{cont})\right)$$

(4)

Here, $\mathbf{x}$ is the final behavioral feature vector obtained by concatenating the discrete feature sub-vector ${\mathbf{f}}^{disc}$ and the continuous feature sub-vector ${\mathbf{f}}^{cont}$, followed by normalization $Norm\left(\cdot \right)$.

3.2.2. Structure of the Lightweight Neural Network Model

The proposed local model is a compact hybrid network whose architecture can be adapted to meet different resource budgets. The structure first extracts the local association patterns with respect to one-dimensional convolution to process the data. It then encodes the short-term temporal relationships through gated recurrent units and finishes with the classification decisions made by the fully connected layer.

The first step in the forward propagation of the model is to pass the feature vector $\mathrm{x}$ through a one-dimensional layer followed by non-linear activation:

$${\mathbf{h}}^{\left(1\right)}=ReLU\left(BatchNorm({\mathbf{W}}_c\ast \mathbf{x}+{\mathbf{b}}_c)\right)$$

(5)

Here, ${\mathbf{h}}^{\left(1\right)}$ is the output of the first convolution layer. ${\mathbf{W}}_c$ and ${\mathbf{b}}_c$ are the convolution kernel weights and bias, respectively. The symbol * denotes the convolution operation.

After this, max-pooling is used to reduce dimensions but maintain important features:

$${\mathbf{h}}^{\left(2\right)}=MaxPool1D({\mathbf{h}}^{\left(1\right)})$$

(6)

Here, ${\mathbf{h}}^{\left(2\right)}$ is the result of applying max-pooling to ${\mathbf{h}}^{\left(1\right)}$. The pooled sequence is put through one layer of the GRU so that short-term context can be learned:

$${\mathbf{h}}^{\left(3\right)}=GRU({\mathbf{h}}^{\left(2\right)})$$

(7)

Here, ${\mathbf{h}}^{\left(3\right)}$ is the output of the GRU layer, which captures short-term temporal dependencies from ${\mathbf{h}}^{\left(2\right)}$.

When dropout regularization has been applied to the final hidden state of the GRU, it is transformed into classification probabilities by a fully connected layer.

$$\widehat{y}=Softmax\left({\mathbf{W}}_f\cdot Dropout({\mathbf{h}}^{\left(3\right)})+{\mathbf{b}}_f\right)$$

(8)

where $\widehat{y}$ is the predicted probability distribution. ${\mathbf{W}}_f$ and ${\mathbf{b}}_f$ are the weight matrix and bias of the fully connected layer, and $Dropout$ is the dropout regularization technique.

Through the use of narrow convolution kernels, a one-layer GRU and global pooling, the model has much fewer trainable parameters. This reduction can improve the efficiency of training and inference on terminal devices.

In this study, we target resource-limited edge devices and therefore adopt a lightweight instantiation that omits the recurrent layer and instead uses two fully connected layers for classification. The exact configuration consists of three convolutional layers followed by two fully connected layers. A detailed breakdown of its computational cost is provided in Section 4.1.2.

3.2.3. Local Training Objectives and Addressing Class Imbalance

The rareness of abnormal samples in identity authentication causes a great imbalance in classes in training data. The direct use of standard cross-entropy loss has an inherent tendency to bias the model towards the majority class (the normal behavior). In order to overcome it, we introduce the loss function as the gradient harmonic loss on the local training. The function combines both focal loss and online hard example mining, yielding the adaptability of the attention to every class and sample during training.

Mini-batch training data are defined as $\left\{\right({\mathrm{x}}_{\mathrm{i}},{\mathrm{y}}_{\mathrm{i}}){\}}_{\mathrm{i}=1}^{\mathrm{B}}$, where any ${\mathrm{y}}_{\mathrm{i}}$ could be either 0 or 1, with 1 indicating an anomaly. The predicted probability that sample $\mathrm{i}$ is anomalous is represented as ${\mathrm{p}}_{\mathrm{i}}={\widehat{\mathrm{y}}}_{\mathrm{i}}\left[1\right]$. The local loss function, ${\mathcal{L}}_{\mathrm{l}\mathrm{o}\mathrm{c}\mathrm{a}\mathrm{l}}$, is given as

$${\mathcal{L}}_{\mathrm{l}\mathrm{o}\mathrm{c}\mathrm{a}\mathrm{l}}=-{\displaystyle \frac{1}{B}}\sum _{i=1}^B\left[{\alpha }_t\cdot (1-p_t{)}^{\gamma }\cdot \log (p_t)\right]$$

(9)

Adjusted predicted probability ${\mathrm{p}}_{\mathrm{t}}$ is calculated depending on the value of ${\mathrm{y}}_{\mathrm{i}}$; if ${\mathrm{y}}_{\mathrm{i}}=1$, then ${\mathrm{p}}_{\mathrm{t}}={\mathrm{p}}_{\mathrm{i}}$. Conversely, if ${\mathrm{y}}_{\mathrm{i}}=0$, ${\mathrm{p}}_{\mathrm{t}}=1-{\mathrm{p}}_{\mathrm{i}}$. This adjustment ensures that the loss is always an indication of the confidence in the prediction of the true class.

Class weight adaptivity, ${\mathsf{\alpha }}_{\mathrm{t}}$, is inversely related to the class frequency and connected to the mean classification difficulty of a class in the model. The value is obtained through ${\mathsf{\alpha }}_{\mathrm{t}}=\mathsf{\lambda }\cdot {\displaystyle \frac{{\mathrm{N}}_{\mathrm{t}\mathrm{o}\mathrm{t}\mathrm{a}\mathrm{l}}}{{\mathrm{N}}_{\mathrm{c}\mathrm{l}\mathrm{a}\mathrm{s}\mathrm{s}}}}+(1-\mathsf{\lambda })\cdot {\stackrel{-}{\mathrm{d}}}_{\mathrm{c}\mathrm{l}\mathrm{a}\mathrm{s}\mathrm{s}}$, where ${\stackrel{-}{\mathrm{d}}}_{\mathrm{c}\mathrm{l}\mathrm{a}\mathrm{s}\mathrm{s}}$ denotes the averaged sample loss of the given class, and $\mathsf{\lambda }$ denotes the harmonic hyperparameter. This method helps the model concentrate on the classes that are difficult to classify.

The focusing parameter, $\mathsf{\gamma }$, affects the modulation parameter $(1-{\mathrm{p}}_{\mathrm{t}}{)}^{\mathsf{\gamma }}$. In cases where samples are simple to classify (${\mathrm{p}}_{\mathrm{t}}$ near 1), the parameter goes to 0 and reduces the loss substantially. For hard-to-classify samples (${\mathrm{p}}_{\mathrm{t}}$ is small), the parameter tends to 1, thereby preserving the loss. This mechanism constrains the given model to focus on problematic or boundary examples that cannot be easily classified.

The loss function deals with model bias due to the difference in the number of classes through a dual process: reactive ${\mathsf{\alpha }}_{\mathrm{t}}$ and controlled $(1-{\mathrm{p}}_{\mathrm{t}}{)}^{\mathsf{\gamma }}$. This method enhances the recall rate of smaller anomaly classes (minority), ensuring the same level of accuracy in larger classes (majority). In addition, it provides higher discriminatory localized model updates that can be aggregated after the next federated round.

3.3. Federated Incremental Aggregation Algorithm for Privacy Protection

The federated aggregation layer acts as a key driving mechanism in the development of the global authentication model. Terminal data are not only non-independent and identically distributed (non-IID), but also subject to dynamic distribution fluctuations and possible malicious actions in a zero-trust setting. This makes it necessary to have an aggregation algorithm that is resilient, flexible, and has strong privacy protection properties. To overcome these issues, we propose a two-step federated incremental aggregation algorithm. This algorithm combines dynamic client screening and contribution-wise weighted aggregation methods. It boosts the efficiency of the convergence and security of the model and quickly absorbs the new environmental information. The pseudocode for the algorithm is shown in Algorithm 1.

Algorithm 1: Federated Incremental Aggregation with Privacy Protection

Input:         - Global model weights $w_g$         - Set of all clients K         - Thresholds: ${\tau }_{size}$ (minimum increment size), ${\tau }_{time}$ (maximum time since last update), ${\tau }_{reputation}$ τ_reputation (minimum reputation score)         - Hyperparameters: β (weight for quality combination), ζ, μ (soft threshold parameters)         - Privacy parameters: C (clipping bound), σ (noise scale)         - Total communication rounds T for each communication round t = 1 to T do         // Server requests participation from all clients         Server broadcasts a participation request to all clients in K         // Parallel local training and update submission         for each client $k\in K$ in parallel do                 Client k trains on its incremental dataset $D_k^{inc}$ using local loss ${\mathcal{L}}_{\mathrm{l}\mathrm{o}\mathrm{c}\mathrm{a}\mathrm{l}}$ (Equation (9))                 Client k computes model update $\Delta w_k=w_k^{new}-w_g$                 Client k sends to server: $\Delta w_k$, $\left|D_k^{inc}\right|$, timestamp $t_{last}$ of last update,                                                               pre-training loss $L_{pre}$, post-training loss $L_{post}$         end for         // Stage 1: Dynamic client screening         $S_t$ = Ø // candidate set for round t         for each client $k\in K$ do                 if $\left|D_k^{inc}\right|\ge {\tau }_{size}$ and $(t_{current}-t_{last})\le {\tau }_{time}$ and reputation $R_k\ge {\tau }_{reputation}$ then                                                         $S_t=S_t\cup k$                 end if         end for         // Stage 2: Contribution-aware weighting         for each client $k\in S_t$ do                 // Quality factor $q_k$                 ${\eta }_k=(L_{pre}-L_{post})/L_{pre}$ // relative improvement                 // Compute entropy $H_k$ of normalized absolute update values         Let $\Delta w_{k\_abs}=|\Delta w_k|$ // element-wise absolute value         Let $p_k=\Delta w_{k\_abs}/sum(\Delta w_{k\_abs})$ // normalize to probability distribution                 $H_k=-\Sigma {p_k}_j\ast \mathrm{l}\mathrm{o}\mathrm{g}({p_k}_j+\epsilon )$ // entropy (ε for numerical stability)                 $q_k=\beta ·sigmoid\left({\eta }_k\right)+(1-\beta )·(H_k/\mathrm{l}\mathrm{o}\mathrm{g}(d\left)\right)$ // d = dimension of $\Delta w_k$         end for         // Compute centroid of updates in candidate set                                                   $\Delta w_{centroid}=(1/|S_t\left|\right)·{\Sigma }_{j\in S_t}\Delta w_j$         for each client $k\in S_t$ do                 // Consistency factor $c_k$                 $si{m}_k=(\Delta w_k·\Delta w_{centroid})/\left(\right||\Delta w_k|{|}_2·\left|\right|\Delta w_{centroid}\left|{|}_2\right)$ // cosine similarity                 $c_k=1/(1+\mathrm{e}\mathrm{x}\mathrm{p}(-\zeta ·(si{m}_k-\mu )\left)\right)$ // soft threshold function                 // Aggregation weight α_k                                                      ${\alpha }_k=(q_k·c_k)/{\Sigma }_{j\in S_t}(q_j·c_j)$         end for         // Stage 3: Differential privacy protection         for each client $k\in S_t$ do                 // Norm clipping                                                $\Delta w_k=\Delta w_k/\mathrm{m}\mathrm{a}\mathrm{x}(1,||\Delta w_k|{|}_2/C)$         end for         // Weighted aggregation with Gaussian noise                                             $\Delta W_{agg}={\Sigma }_{k\in S_t}{\alpha }_k·\Delta w_k+N(0,{\sigma }^2{C}^{2}I)$         // Update global model                                                            $w_g=w_g+\Delta W_{agg}$         // (Optional) Update client reputations R_k based on their contributions end for

3.3.1. Design Concept of the Algorithm

The Federated Averaging algorithm that treats everyone equally harms performance and security, particularly when there are heterogeneous data and malicious updates. The novel solution divides the aggregation procedure into two steps. Firstly, the central server will evaluate the credibility of the clients willing to participate as a part of the first stage, called the candidate set screening. It leverages lightweight meta-information such as the statistics of the local data distribution and past contributions to eliminate abnormal or low-quality participants in order to form a trustworthy candidate set. Secondly, the model updates of this candidate set are assessed in a better manner, in contribution-aware aggregation. Weights of aggregation are computed dynamically as per the quality and consistency of the updates, thus leading to the creation of a new global model. This is a screening methodology that helps to block malicious updates but prioritizes valuable updates, minimizes computational and communication overhead, and speeds up the adaptation of the global model to new threats.

3.3.2. Dynamic Client Screening Mechanism

At the start of each communication round, the central server receives numerous participation requests from clients. To build a trustworthy candidate set, ${\mathrm{S}}_{\mathrm{t}}$, the server uses a lightweight reputation profile, ${\mathrm{R}}_{\mathrm{k}}$, for each client and performs real-time screening based on several criteria. The first criterion is data freshness. Clients must report the size and timestamp of their local dataset increment, $\Delta {\mathrm{D}}_{\mathrm{k}}$, for the current training round. The server rejects clients with outdated or minimal data updates to ensure the aggregated knowledge reflects the latest environmental state. This is formalized as $\left|\Delta {\mathrm{D}}_{\mathrm{k}}\right|\ge {\mathsf{\tau }}_{\mathrm{s}\mathrm{i}\mathrm{z}\mathrm{e}}$ (minimum size of local dataset increment) and ${\mathrm{t}}_{\mathrm{c}\mathrm{u}\mathrm{r}\mathrm{r}\mathrm{e}\mathrm{n}\mathrm{t}}-{\mathrm{t}}_{\mathrm{l}\mathrm{a}\mathrm{s}\mathrm{t}\_\mathrm{u}\mathrm{p}\mathrm{d}\mathrm{a}\mathrm{t}\mathrm{e}}\le {\mathsf{\tau }}_{\mathrm{t}\mathrm{i}\mathrm{m}\mathrm{e}}$ (maximum allowed time since last update). The second criterion evaluates historical contributions. Each client’s reputation profile, ${\mathrm{R}}_{\mathrm{k}}$, logs their contribution score, ${\mathrm{C}}_{\mathrm{k}}^{\mathrm{h}\mathrm{i}\mathrm{s}\mathrm{t}}$, from previous rounds. This score reflects the improvement in the global model’s validation performance due to the client’s updates. Clients scoring below the reputation threshold, ${\mathsf{\tau }}_{\mathrm{r}\mathrm{e}\mathrm{p}\mathrm{u}\mathrm{t}\mathrm{a}\mathrm{t}\mathrm{i}\mathrm{o}\mathrm{n}}$ (reputation score threshold), are temporarily excluded. The final criterion verifies updated metadata. Clients must submit model updates, $\Delta {\mathrm{w}}_{\mathrm{k}}$, with loss values before and after local training. The server calculates the relative improvement, ${\mathsf{\eta }}_{\mathrm{k}}=({\mathrm{L}}_{\mathrm{k}}^{\mathrm{p}\mathrm{r}\mathrm{e}}-{\mathrm{L}}_{\mathrm{k}}^{\mathrm{p}\mathrm{o}\mathrm{s}\mathrm{t}})/{\mathrm{L}}_{\mathrm{k}}^{\mathrm{p}\mathrm{r}\mathrm{e}}$. Clients showing minimal or negative improvement are removed. A client enters the candidate set, ${\mathrm{S}}_{\mathrm{t}}$, only if it meets all these conditions. This process effectively filters out potentially malicious or ineffective nodes with outdated data, consistently low contributions, or abnormal updates.

While the metadata used for screening (e.g., $|\Delta D_k|$, timestamps) is necessary for filtering, it could potentially leak information about clients’ data activity. To mitigate this risk, we anonymize client identifiers, transmit all metadata over encrypted channels, and avoid storing raw metadata beyond the current round. Future extensions may incorporate differential privacy into the screening process itself, e.g., by perturbing the metadata values before transmission.

3.3.3. Contribution-Aware Weighted Aggregation Strategy

For clients $\mathrm{k}\in {\mathrm{S}}_{\mathrm{t}}$ who pass screening, their model updates $\Delta {\mathrm{w}}_{\mathrm{k}}$ proceed to the refined weighted aggregation stage. The aggregation weight ${\mathsf{\alpha }}_{\mathrm{k}}$ is determined by two factors: quality ${\mathrm{q}}_{\mathrm{k}}$ and consistency ${\mathrm{c}}_{\mathrm{k}}$. The quality factor ${\mathrm{q}}_{\mathrm{k}}$ assesses the update’s effectiveness. It incorporates both the relative improvement ${\mathsf{\eta }}_{\mathrm{k}}$ and the normalized entropy ${\mathrm{H}}_{\mathrm{k}}$ of the update amplitude, which measures the update vector’s information richness. ${\mathrm{H}}_{\mathrm{k}}$ is calculated using the Softmax distribution of the update vector’s absolute values: ${\mathrm{H}}_{\mathrm{k}}=-{\sum _{\mathrm{j}}\widetilde{\Delta \mathrm{w}}}_{\mathrm{k},\mathrm{j}}\log ({\widetilde{\Delta \mathrm{w}}}_{\mathrm{k},\mathrm{j}})$. The quality factor ${\mathrm{q}}_{\mathrm{k}}$ is a harmonic combination of ${\mathsf{\eta }}_{\mathrm{k}}$ and ${\mathrm{H}}_{\mathrm{k}}$, ${\mathrm{q}}_{\mathrm{k}}=\mathsf{\beta }\cdot \mathrm{s}\mathrm{i}\mathrm{g}\mathrm{m}\mathrm{o}\mathrm{i}\mathrm{d}({\mathsf{\eta }}_{\mathrm{k}})+(1-\mathsf{\beta })\cdot {\displaystyle \frac{{\mathrm{H}}_{\mathrm{k}}}{\log (\mathrm{d})}}$, where $\mathrm{d}$ is the dimension of model parameters and $\mathsf{\beta }$ (weight combining quality factors) is a hyperparameter. The consistency factor ${\mathrm{c}}_{\mathrm{k}}$ evaluates the update’s alignment with the overall direction of the candidate set, helping to counteract covert poisoning attacks. First, we compute the centroid of the update vectors in the candidate set $\overline{\Delta \mathrm{w}}={\displaystyle \frac{1}{\left|{\mathrm{S}}_{\mathrm{t}}\right|}}\sum _{\mathrm{j}\in {\mathrm{S}}_{\mathrm{t}}}\Delta {\mathrm{w}}_{\mathrm{j}}$. Then, we determine the cosine similarity $\mathrm{s}\mathrm{i}{\mathrm{m}}_{\mathrm{k}}$ between each update and the centroid. This similarity is mapped to the consistency factor using the soft threshold function ${\mathrm{c}}_{\mathrm{k}}={\displaystyle \frac{1}{1+\exp (-\mathsf{\zeta }\cdot (\mathrm{s}\mathrm{i}{\mathrm{m}}_{\mathrm{k}}-\mathsf{\mu }))}}$, where $\mathsf{\mu }$ and $\mathsf{\zeta }$ (parameters controlling the soft threshold for consistency) are hyperparameters controlling the threshold’s strictness and transition smoothness. Updates significantly deviating from the group direction receive a low ${\mathrm{c}}_{\mathrm{k}}$ value. Finally, the aggregation weight ${\mathsf{\alpha }}_{\mathrm{k}}$ for client $\mathrm{k}$ is derived from its quality and consistency factors and is normalized: ${\mathsf{\alpha }}_{\mathrm{k}}={\displaystyle \frac{{\mathrm{q}}_{\mathrm{k}}\cdot {\mathrm{c}}_{\mathrm{k}}}{\sum _{\mathrm{j}\in {\mathrm{S}}_{\mathrm{t}}}{\mathrm{q}}_{\mathrm{j}}\cdot {\mathrm{c}}_{\mathrm{j}}}}$.

3.3.4. Privacy-Enhanced Global Model Update

After obtaining the normalized weights $\left\{{\mathsf{\alpha }}_{\mathrm{k}}\right\}$, the global model update incorporates differential privacy protection. Initially, norm clipping is applied to each client’s update vector to limit sensitivity, $\Delta {\mathrm{w}}_{\mathrm{k}}\leftarrow \Delta {\mathrm{w}}_{\mathrm{k}}/\max (1,\Vert \Delta {\mathrm{w}}_{\mathrm{k}}{\Vert }_2/\mathrm{C})$, using a clipping boundary $\mathrm{C}$. Next, we perform weighted aggregation and add Gaussian noise, $\widetilde{\Delta \mathrm{W}}=\sum _{\mathrm{k}\in {\mathrm{S}}_{\mathrm{t}}}{\mathsf{\alpha }}_{\mathrm{k}}\cdot \Delta {\mathrm{w}}_{\mathrm{k}}+\mathcal{N}(0,{\mathsf{\sigma }}^2{\mathrm{C}}^2\mathrm{I})$, controlled by the noise scale parameter $\mathsf{\sigma }$, which determines the privacy budget $\mathsf{ϵ}$. The noise-added aggregated update then refreshes the global model ${\mathrm{w}}_{\mathrm{g}}^{(\mathrm{t}+1)}={\mathrm{w}}_{\mathrm{g}}^{\left(\mathrm{t}\right)}+\widetilde{\Delta \mathrm{W}}$. To provide formal privacy guarantees, we adopt the Gaussian mechanism with a moments accountant. For a single round with sampling rate q = |St|/K, the mechanism satisfies $(ϵ,\delta )$-differential privacy with $ϵ=\sqrt{2q\log (1/\delta )}/\sigma$ for sufficiently small $ϵ$. Over T rounds, the total privacy budget is composed using Rényi differential privacy [25]. In our experiments with $q=0.2$, $T=50$, $\sigma =1.0$, and $\delta =10^{-5}$, the total $ϵ$ is approximately 1.2, which is within the typical range for privacy-preserving systems. This algorithm guarantees an efficient, safe, and private model development through dynamic screening, contribution-sensitive weighting, and differential privacy perturbation, even in multifactorial zero-trust settings.

3.4. Dynamic Trust Evaluation and Decision-Making Engine

The dynamic trust assessment and decision-making engine act as the central intelligence of the zero-trust architecture. They can integrate the changing global authentication paradigm, which developed as a result of the federated incremental learning, in live-access situations ${\mathrm{M}}_{\mathrm{g}}^{\left(\mathrm{t}\right)}$. It quantitatively generates exact dynamic trust scores to direct adaptive fine-grained access control choices. The engine operates in a closed loop: it evaluates access requests using the latest global model, makes decisions, collects feedback from those decisions, and feeds that feedback back into the learning process to continuously improve the model. This engine is not merely created as a predictive model, but as a decision-making system that is interpretable, configurable, and able to learn by being given feedback.

3.4.1. Multi-Dimensional Dynamic Trust Scoring Model

The assessment of the engine begins with looking at one access request. The vector of the feature is an input in the form of the standardized behavior ${\mathrm{x}}_{\mathrm{r}\mathrm{e}\mathrm{q}}\in {\mathbb{R}}^{\mathrm{d}}$, reported by the terminal policy enforcement point (PEP), with the same technique used to extract the information outlined in Section 3.2.1. First, the newest global model ${\mathrm{M}}_{\mathrm{g}}^{\left(\mathrm{t}\right)}$ determines a basic score of behavioral anomaly ${\mathrm{R}}_{\mathrm{b}}$. This score indicates how much the current request behavior deviates from the normal pattern dentified by the model:

$$R_b=1-P(y=normal\mid {\mathbf{x}}_{req};M_g^{\left(t\right)})$$

(10)

In this context, $P(y=normal\mid {\mathbf{x}}_{req};M_g^{\left(t\right)})$ is the probability assigned to the normal class by the current global model $M_g^{\left(t\right)}$ for the request feature vector ${\mathbf{x}}_{req}$. The variable ${\mathrm{R}}_{\mathrm{b}}$, ranging from 0 to 1, signifies abnormal behavior, with higher values indicating increased abnormality.

Accurate risk assessment requires integrating comprehensive real-time contextual information. We define the contextual risk vector $\mathrm{c}=[{\mathrm{c}}_1,{\mathrm{c}}_2,\dots ,{\mathrm{c}}_{\mathrm{m}}{]}^{\mathrm{T}}$, where each component ${\mathrm{c}}_{\mathrm{j}}$ represents a normalized specific contextual risk factor, such as

• ${\mathit{c}}_1$: Risks associated with the security status of the device;
• ${\mathit{c}}_2$: Network geographical location risk;
• ${\mathit{c}}_3$: Time window risk;
• ${\mathit{c}}_4$: Sensitivity of the requested resources.

Each ${\mathrm{c}}_{\mathrm{j}}$ is determined using predefined rules or a lightweight quantum model and subsequently normalized to the interval $[0,1]$.

The final comprehensive dynamic trust score, $\mathrm{T}$, is calculated by combining the basic behavior anomaly score with the context risk vector. This combination uses a weighted geometric mean to prevent single-dimension risks from being diluted by linear averaging:

$$T=R_b^{{\omega }_0}\cdot \prod _{j=1}^m(c_j+ϵ{)}^{{\omega }_j}$$

(11)

In this context, $\mathrm{T}$ is the comprehensive dynamic trust score. $\mathsf{\omega }=[{\mathsf{\omega }}_0,{\mathsf{\omega }}_1,\dots ,{\mathsf{\omega }}_{\mathrm{m}}]$ denotes the weights for each dimension, ensuring $\sum _{\mathrm{j}=0}^{\mathrm{m}}{\mathsf{\omega }}_{\mathrm{j}}=1$. These weights indicate the relative importance of different risk dimensions in the overall assessment and can be adjusted dynamically according to security policies. $c_j$ is the j-th contextual risk factor, and $ϵ$ is a small constant for numerical stability. One unique property of the weighted geometric mean is that when any one of the risk factors (${\mathrm{R}}_{\mathrm{b}}$ or ${\mathrm{c}}_{\mathrm{j}}$) attains a high value, it can substantially increase the total assessment $\mathrm{T}$. This is in accordance with the principle of the short-board effect in security defense.

3.4.2. Elastic Policy Mapping Based on Continuous Risk

The policy decision point (PDP) does not make a binary decision after having obtained the continuous comprehensive trust score $\mathrm{T}$. Rather, it transforms $\mathrm{T}$ into a specific access control decision through the use of a predefined elastic policy mapping function, $\mathsf{\Phi }\left(\mathrm{T}\right)$. This function relies on a series of ascending risk thresholds ${\mathsf{\tau }}_0,{\mathsf{\tau }}_1,\dots ,{\mathsf{\tau }}_{\mathrm{n}}$ (with $0={\mathsf{\tau }}_0<{\mathsf{\tau }}_1<\dots <{\mathsf{\tau }}_{\mathrm{n}}=1$).

The mapping process can be described as follows:

$$\mathsf{\Phi }(T)=\left\{\begin{array}{ll}{Decision}_0& if T\in [{\tau }_0,{\tau }_1)\\ {Decision}_1& if T\in [{\tau }_1,{\tau }_2)\\ ⋮& ⋮\\ {Decision}_{n-1}& if T\in [{\tau }_{n-1},{\tau }_n]\end{array}\right.$$

(12)

${\mathrm{D}\mathrm{e}\mathrm{c}\mathrm{i}\mathrm{s}\mathrm{i}\mathrm{o}\mathrm{n}}_{\mathrm{k}}$ corresponds to a specific, detailed access control instruction set. Common decision levels include the following:

• ${\mathit{D}\mathit{e}\mathit{c}\mathit{i}\mathit{s}\mathit{i}\mathit{o}\mathit{n}}_0$ (trust): Grant all the requested permissions.
• ${\mathit{D}\mathit{e}\mathit{c}\mathit{i}\mathit{s}\mathit{i}\mathit{o}\mathit{n}}_1$ (low suspicion): Allow permissions but, when it comes to audit log recording implementation, enhance them, and decrease the session validity period.
• ${\mathit{D}\mathit{e}\mathit{c}\mathit{i}\mathit{s}\mathit{i}\mathit{o}\mathit{n}}_2$ (moderate suspicion): Implement a sequential authentication process that involves checking the identity using a second factor, which can be in the form of an SMS code or biometric recognition. On successful authentication, offer limited permissions.
• ${\mathit{D}\mathit{e}\mathit{c}\mathit{i}\mathit{s}\mathit{i}\mathit{o}\mathit{n}}_3$ (highly suspected): Deny access instantly, terminate the session, create an alert for a high-level security incident, and inform the Security Operations Center.

The continuous scoring of interval mapping will enable the conversion of access controls based on “static rules” into “dynamic policies.” This strategy can help provide a more flexible and logical reaction to different risks.

3.4.3. Feedback-Driven Model Calibration Closed-Loop

The system’s intelligence extends beyond real-time decision-making to include self-optimization based on decision outcomes. High-confidence feedback labels are derived from stepwise authentication and subsequent manual security audits, as shown in Figure 2.

For high-risk requests with a comprehensive trust score $\mathrm{T}\ge {\mathsf{\tau }}_2$ (i.e., those triggering step-up authentication), the final verification result ${\mathrm{y}}_{\mathrm{t}\mathrm{r}\mathrm{u}\mathrm{e}}$ (normal or abnormal) is obtained through secondary authentication or subsequent manual security audits. The sample pair $({\mathrm{x}}_{\mathrm{r}\mathrm{e}\mathrm{q}},{\mathrm{y}}_{\mathrm{t}\mathrm{r}\mathrm{u}\mathrm{e}})$ is then designated as a high-value training sample and securely stored in the initiating terminal’s local cache ${\mathcal{B}}_{\mathrm{k}}$. During the next local training phase of federated learning, these feedback samples are included in the incremental dataset and used to update the local model ${\mathrm{M}}_{\mathrm{k}}$ using the loss function described in Section 3.2.3.

The federated aggregation algorithm (see Section 3.3) integrates valuable feedback from numerous terminals into the new-generation global model, ${\mathrm{M}}_{\mathrm{g}}^{(\mathrm{t}+1)}$. This creates a closed loop of “evaluation–decision–feedback–learning”, allowing the system to learn from misjudgments, such as false positives and negatives, and adjust its decision boundaries. As a result, the system dynamically adapts to new attack patterns while minimizing interference with legitimate users.

4. Experimental Validation and Performance Evaluation

In this section, we thoroughly test the usefulness of the recommended Federated Incremental Zero-Trust Authentication Model (FIL-ZTA) on the basis of experimental design and meticulous data analysis. The experiment also evaluated four dimensions: core authentication performance, dynamic adaptability, communication efficiency, and system robustness. The model is compared against the existing mainstream methods to give an objective and quantitative proof that supports the innovations presented in the paper.

4.1. Experimental Setup

4.1.1. Dataset and Environment Configuration

The experiment is based on a combination test setup with two publicly available datasets. The CIC-IDS-2018 dataset provides network attack traffic characteristics, while the CIC-FlowMeter-V3 tool provides 78-dimensional network flow statistics. A custom user simulation system was used to create 32-dimensional discrete identity authentication attributes such as login time, device fingerprint, and geographic location. The dataset consists of 850,000 records, of which normal traffic represents 65% and attack traffic represents 35%. The attack types cover six categories, which include brute force, DDoS and Web application attacks.

We used the Dirichlet distribution with parameter $\mathsf{\alpha }=0.3$ to split the entire dataset between eight clients in order to simulate heterogeneously distributed data in a zero-trust setup. This arrangement is non-independent and non-identical. As a simulated instance of concept drift, we introduced two new attack signatures at the 15th and 30th training steps. The new attack samples were a fraction (15%) of the data streams of each client. The experimental set-up included a group of five physical servers, which were run with Docker containers to emulate some form of a distributed architecture. The central server had an Intel Xeon Gold 6248R processor with 128 GB of memory, whereas client nodes had an Intel Core i7-11800H processor with 32 GB of memory. The experiments were all run on Ubuntu 20.04 LTS and relied on the PyTorch 1.13 and FedML 0.7.4 frameworks.

4.1.2. Comparison Methods and Evaluation Indicators

Five comparison method groups were used in the experiment: centralized CNN, as the best method of performance; the classic federated learning algorithm, FedAvg; the heterogeneity-based data algorithm, FedProx; the federated incremental learning baseline method, FA-FedAvg; and the FIL-ZTA approach that is presented in this paper. Every method is equipped with the same neural network architecture, i.e., three convolutional layers with filter sizes of 32, 64, and 128, followed by two fully connected layers with 256 and 128 neurons, respectively. ReLU is used as an activation function, with Softmax as the output layer.

Table 2. Computational complexity of the experimental model.

Layer	Output Shape	Parameters	FLOPs
Conv1D (32, k = 3)	(1, 32, 108)	128	20,736
MaxPool1D	(1, 32, 54)	0	0
Conv1D (64, k = 3)	(1, 64, 52)	6208	19,968
MaxPool1D	(1, 64, 26)	0	0
Conv1D (128, k = 3)	(1, 128, 24)	24,704	18,432
MaxPool1D	(1, 128, 12)	0	0
Flatten	(1, 1536)	0	0
Fully Connected (256)	(1, 256)	393,472	786,432
Fully Connected (128)	(1, 128)	32,896	65,536
Output Layer (Softmax)	(1, 2)	258	512
Total		457,666 (~0.46 M)	~0.91 M

summarizes the layer-wise structure and computational cost of the model used in our experiments. With approximately 0.46 million trainable parameters and only 0.91 million FLOPs per inference, the model is highly efficient and well suited for real-time deployment on edge devices.

All models were evaluated on held-out test data that were not used during training. For each client, we reserved 20% of its local data as a test set; global metrics were computed by aggregating results across all clients. The equal error rate (EER) was determined by selecting a global threshold that minimizes the absolute difference between the false acceptance rate (FAR) and false rejection rate (FRR) on a validation set constructed by sampling 10% of training data from each client. All reported metrics were averaged over five independent runs with different random seeds. In addition to EER and AUC, we report the precision, recall, F1-score, and area under the precision–recall curve (PR-AUC) to provide a more comprehensive view of performance, especially under class imbalance.

The index system of evaluation is as follows: To measure the authentication accuracy in the equal error rate, the main measure would be the equal error rate with secondary measures including the false acceptance rate, false rejection rate, and AUC value. The efficiency of the system is measured in terms of the number of training rounds required to converge, time per training rounds, and communication load. Quantification of dynamic adaptability is based on the recovery speed of the model when a concept drift occurs, which is described as the number of rounds required until the performance recovers to 95 percent of its pre-drift value. The analysis of robustness involves an investigation of the performance degradation of the system due to the attacks of different fractions of malicious clients.

4.2. Comparison of Core Authentication Performance

4.2.1. Authentication Accuracy in a Static Environment

Table 3. The comparison of the authentication performance of different methods in a static environment.

Method	EER (%)	FAR (%)	FRR (%)	AUC	Rounds	Single-Round Time
Centralized CNN	1.52	1.48	1.56	0.992	50	45.2
FedAvg	4.89	4.95	4.83	0.972	38	12.3
FedProx	3.71	3.65	3.77	0.985	32	12.8
FA-FedAvg	3.02	2.97	3.07	0.988	26	13.1
FIL-ZTA	2.15	2.08	2.22	0.991	18	14.5

compares the authentication performance of different methods in a non-static, non-independent, and identically distributed environment. According to the results, the FIL-ZTA outperforms every other federated learning method in every metric. It has an equal error of only 2.15%, which is 56.0% less than FedAvg and 28.8% less than FA-FedAvg. The superiority of its performance is explained by the fact that the client screening and contribution-aware weighting mechanism of FIL-ZTA can efficiently detect and prioritize high-quality local model updates.

FIL-ZTA has an impressive convergence rate, and it achieves the best performance after only 18 rounds of training, which is 52.6% fewer training rounds than FedAvg. Efficiency is achieved due to its contribution-aware weighted aggregation scheme, which increases the amount of knowledge gained every round. Although each training round lasted slightly more than in the baseline approach, the overall training time was only 68.5% times that of FedAvg, which is very time-efficient.

4.2.2. Adaptability to Concept Drift

In order to test the flexibility of the model when operating in a dynamic environment, we applied two new types of attacks at two successive periods at rounds 15 and 30 of the experiment, which can be considered as continuous threat development in a zero-trust scenario. Figure 3 depicts AUC variations across methods as per concept drift. Post the initial drift, the AUC of FedAvg decreased by 0.974 to 0.896, which took eight rounds to recover over the line of 0.95. FedProx recovered after six rounds, with a score of 0.912. FA-FedAvg dropped to 0.938 and recovered in four rounds. Conversely, the AUC of FIL-ZTA only decreased to (0.961) and took two rounds to recover fully. This can be explained by the incremental learning mechanism of FILZTA, which quickly detects new attack patterns and adapts model parameters to demonstrate the high elasticity of the model to dynamic threat conditions.

Figure 3 also demonstrates the two-fold advantages of the FIL-ZTA concerning concept drifting adjustment. The minimum AUC reduction is at 0.019, and the fastest recovery has only two iterations. These outstanding performances are due to the dual mechanism of the model. Client screening is now dynamic in order to permit the participation of only high-quality data clients in the aggregation process. Furthermore, contribution-wise weighting gives preference to model updates including new information.

4.2.3. Detection Effects of Different Types of Attacks

In

Table 4. Comparison of detection rates for different types of attacks.

Attack Type	Number of Samples	FedAvg	FedProx	FA-FedAvg	FIL-ZTA
Brute force attack	12,500	95.3	96.1	96.8	97.5
DDoS	8700	92.7	93.5	94.2	95.1
Web attack	10,200	88.5	90.2	91.3	93.6
Port scanning	6800	96.2	96.8	97.1	97.9
New Attack D	5300	76.4	81.2	87.5	94.2
New Attack E	4900	72.8	78.6	85.3	92.7

, we can see the performance of various methods when detecting six particular types of attacks. FIL-ZTA consistently produced higher results in detection with regard to all forms of attacks. Note that, in the cases of the new attack types D and E, FIL-ZTA achieves detection rates 94.2% and 92.7% higher than those obtained using other methods. This superiority indicates FIL-ZTA’s ability to transfer knowledge, which can help it derive general trends in the known type of attacks and change its behavior to respond to new threats.

Table 5. Precision, recall, F1-score, and PR-AUC for different attack types (FIL-ZTA).

Attack Type	Precision (%)	Recall (%)	F1-Score (%)	PR-AUC (%)
Brute Force Attack	97.8	97.2	97.5	98.1
DDoS	95.4	94.8	95.1	96.0
Web Attack	94.1	93.0	93.5	94.7
Port Scanning	98.2	97.6	97.9	98.5
New Attack D	94.8	93.6	94.2	95.3
New Attack E	93.5	91.9	92.7	94.0

provides a detailed breakdown of precision, recall, F1-score, and PR-AUC for each attack type. The recall values closely match the detection rates in Table 4, validating the consistency of our results. For novel attacks (D and E), FIL-ZTA achieves PR-AUC values of 95.3% and 94.0%, respectively, which are substantially higher than those of the baseline methods. This indicates that the model maintains high precision even as recall increases, a critical property for practical deployment where false alarms must be minimized. The high F1-scores across all attack types demonstrate the balanced performance of our approach.

The ability of different methods to detect the six kinds of attacks is presented in Figure 4 through a radar chart. It shows that FIL-ZTA has a huge advantage when it comes to detecting new types of attacks. It is important to note that, for the New Attacks D and E, FILZTA attains rates of detection 17.8% and 19.9% higher, respectively, than FedAvg. The results support the fact that the proposed mechanism of incremental learning suggested has a positive impact on the accumulation and transfer of security knowledge and ensures high detection rates even with previously unseen attacks.

4.3. Analysis of System Efficiency and Communication Overhead

4.3.1. Comparison of Communication Efficiency

The zero-trust architecture has edge devices often constrained by network bandwidth, in which case the efficiency with which it communicates becomes essential.

Table 6. Comparative analysis of communication efficiency.

Method	Convergence Rounds	Single-Round Communication Volume (MB)	Cumulative Communication Volume (MB)	AUC at Convergence	Bandwidth Utilization Rate (%)
FedAvg	38	12.0	456.0	0.972	73.2
FedProx	32	12.0	384.0	0.985	78.5
FA-FedAvg	26	12.0	312.0	0.988	82.1
FIL-ZTA	18	12.0	216.0	0.991	88.7

shows the communication overheads of various methods to achieve target performance (AUC > 0.985). The cumulative communication overhead of FIL-ZTA is 216 MB, or merely half of that of FedAvg (47.4%), and the communication round is also reduced by a factor of 52.6%. This improvement can be attributed to reducing the transmission of poor-quality updates using contribution-aware weighted aggregation and avoiding wasteful communication using dynamic client screening.

The stacked area chart given in Figure 5 demonstrates the changing dynamics of the cumulative communication overhead of each method over the training process.

Figure 5 shows the positive effects of FIL-ZTA in terms of communication efficiency on two fronts. Figure 5a demonstrates that it has the slowest cumulative communication overhead increase and reaches convergence the quickest. At the same time, the radar chart in Figure 5b shows that FIL-ZTA performs best in five dimensions: speed of convergence, bandwidth utilization, communication cost per AUC, scalability, and robustness.

4.3.2. Calculation of Resource Consumption

Edge computational resource usage must be quantified because of the need to deploy to the edge. We measured the training time, memory usage, and energy usage of each approach on the client side (

Table 7. Comparison of computing resource consumption.

Method	Single-Round Training Time (s)	Total Training Time (s)	Peak Memory (MB)	Average Energy Consumption (J)	Energy Consumption Efficiency (Samples/J)
FedAvg	12.3	467.4	1250	1842	461.5
FedProx	12.8	409.6	1280	1635	519.9
FA-FedAvg	13.1	340.6	1310	1428	595.2
FIL-ZTA	14.5	261.0	1353	1313	647.5

). The training time required to achieve a single round of FIL-ZTA is 15.4% higher than that of FedAvg; however, it minimizes the overall training time by 31.5%, increases the memory usage by 8.2%, and reduces the energy usage by 28.7%. This is achieved through the optimization of overall resource use with FIL-ZTA by boosting single-round computational complexity, which minimizes the total number of training rounds.

4.4. System Robustness Analysis

4.4.1. Countering Malicious Client Attacks

A malicious client poisoning attack in a zero-trust environment can be a serious security vulnerability. We consider three categories of malicious clients based on their adversarial objectives:

• Data poisoning attackers: These clients corrupt their local training data by flipping labels (e.g., labeling attack traffic as normal) or injecting adversarial samples. The goal is to degrade the global model’s accuracy or induce targeted misclassifications.
• Model poisoning attackers: These clients manipulate the model updates (gradients) before uploading, e.g., by adding large noise, scaling updates, or sending arbitrary vectors, aiming to disrupt convergence or bias the global model.
• Backdoor attackers: These clients embed a hidden trigger in a small fraction of their local data (e.g., a specific pattern in network traffic) and train the model to associate that trigger with a target label (e.g., normal). The backdoor remains dormant until the trigger appears at inference time, causing the model to misclassify attack traffic as normal.

All malicious clients are assumed to control their local training process completely and may combine to amplify their impact. The honest-but-curious aggregation server follows the protocol but may attempt to infer information from received updates. Our experiment measured the performance of the system at different percentages of malicious clients, as shown in Figure 6. At 30% malicious clients, the mean error rate of FedAvg increased by 18.92%. For FIL-ZTA, on the other hand, it only rose by 4.75% (a 74.9% decrease in the loss). This strength results from the combination of two layers of protection mechanisms such that the dynamic removal of malicious clients reduces performance by 95.2%, while contribution-aware weighting reduces the effect of any remaining malicious clients by under 12.3% relative to normal client updates.

The diagram below shows a comprehensive breakdown of the mechanism of FIL-ZTA. Figure 6a shows that the worst-performing part of FIL-ZTA is at the highest when the fraction of malicious clients increases most slowly. Figure 6b presents the contributions of the triple defense mechanism: dynamic screening eliminates 95.2% of malicious updates, contribution weighting reduces the effect of the rest of malicious updates by 87.7%, and differential privacy provides 98.5% protection. All these mechanisms contribute to a total efficacy of protective measures of 96.8%.

To evaluate against adversaries that dynamically change their behavior, we simulated an adaptive poisoning scenario. Malicious clients comprised 20% of the total. Every 10 rounds, they switch between three strategies: (i) label-flipping (changing 50% of local labels), (ii) gradient scaling (multiplying updates by a factor of 10), and (iii) sending random noise (Gaussian noise with variance 0.1). Figure 7a shows the EER over rounds for FIL-ZTA and FedAvg. While FedAvg’s EER fluctuates significantly and rises above 15%, FIL-ZTA maintains an EER below 5% throughout, demonstrating its resilience to adaptive strategies.

We implemented a backdoor attack where a fraction of clients (ranging from 0% to 40%) injected a trigger pattern into 5% of their local training samples, labeling them as “normal”. The backdoor success rate is measured as the percentage of trigger-embedded test samples misclassified as normal. As shown in Figure 7b, FIL-ZTA reduces the backdoor success rate to only 2.3% when 20% of clients are malicious, compared to 18.7% for FedAvg. Even with 40% malicious clients, FIL-ZTA’s backdoor success rate remains below 3.8%, confirming that our contribution-aware weighting and dynamic screening effectively filter out updates that deviate from the consensus, preventing backdoor embedding.

4.4.2. Ablation Experiment Analysis

To evaluate how each component affects performance, we performed two ablation experiments: the full FIL-ZTA model and versions without dynamic screening, contribution weighting and differential privacy. The ablation results in

Table 8. Analysis of component ablation experiments.

Experimental Configuration	EER (%)	FAR (%)	FRR (%)	AUC	Performance Degradation (%)
Complete FIL-ZTA	3.98	3.85	4.11	0.986	0.0
No dynamic screening	9.85	9.72	9.98	0.952	147.5
No contribution weighting	6.72	6.58	6.86	0.971	68.5
No differential privacy	4.33	4.20	4.46	0.984	8.8

reveal the critical role of each component. Dynamic screening is the most important: its removal increased EER by 147.5%, FAR by 152.7%, and FRR by 142.8%, while reducing AUC by 3.5%. This demonstrates that filtering out low-quality or malicious clients is essential for maintaining model integrity. Contribution-aware weighting also plays a significant role: without it, EER rose by 68.5%, FAR by 70.9%, and FRR by 66.9%, with AUC dropping by 1.5%. This indicates that weighting updates based on quality and consistency helps integrate valuable knowledge while suppressing harmful contributions. Differential privacy, while essential for privacy protection, has a relatively minor impact on utility: removing it (i.e., ε = ∞) reduces EER by only 8.8% compared to the complete model with ε = 1.0, confirming that our privacy-preserving mechanism achieves a favorable trade-off. These results indicate that there is a need for dynamic screening to resist poisoning attacks, contribution weighting improves the integration of normal updates, and differential privacy has the lowest impact on performance but protects privacy.

The dynamic screening decreases EER by 35%, FAR by 32%, and FRR by 30%, and increases AUC by 28%. Contributing weighting reduced them by 25%, 23%, and 22%, with an increase of 20%. Differential privacy causes reductions of 8%, 7%, and 7%, and an improvement of 6%. Such visual examination of data can lead to the effective optimization of components.

The results in

Table 9. Ablation of contribution-aware weighting components.

Variant	EER (%)	FAR (%)	FRR (%)	AUC
Uniform weighting (baseline)	6.72	6.58	6.86	0.971
Quality factor only	5.51	5.38	5.64	0.978
Consistency factor only	5.24	5.11	5.37	0.980
Full combination	3.98	3.85	4.11	0.986

demonstrate that both quality and consistency factors contribute significantly to the performance of contribution-aware weighting. Using only the quality factor reduces EER by 18% compared to uniform weighting, while using only the consistency factor reduces EER by 22%. The full combination achieves an additional 12% improvement, indicating a synergistic effect. This confirms that jointly considering update quality and alignment with the group centroid is crucial for robust aggregation.

4.4.3. Privacy Protection Effect Assessment

The differential privacy mechanism includes noise in order to protect the confidentiality of users, which can also affect the model performance. In our experiment, we measured performance differences under various privacy budgets, ε (see Figure 8). At ε = 1.0, the equal error rate for FIL-ZTA is 2.28%, just 6.0% higher than without privacy protection (ε = ∞). With ε = 0.5, the rate increases to 2.51%, a 16.7% rise. With the strongest privacy protection (ε = 0.1), the rate is only 3.12%, which is lower than that using FedAvg without privacy protection (4.89%). The results prove that the mechanism of differential privacy of FIL-ZTA can be efficiently used between privacy and performance.

Figure 8 provides information on the privacy protection mechanism as an in-depth analysis. Figure 8a shows the S-shaped privacy–performance trade-off curve, representing the FIL-ZTA with maximum trade-off within the range of privacy (0.5–1.0), which is ε. The Figure 8b heatmap shows that the extreme privacy protection (ε = 0.1) leads to a considerably lower EER of only 3.12 percent, whereas FedAvg without the privacy protection reaches 4.89%. This is proof of the efficiency of the suggested privacy mechanism.

4.5. Scalability for Large-Scale Deployment

4.5.1. Scalability of the Number of Clients

In order to measure the scalability of the systems during mass implementation, we measured performance fluctuations with the growth of the number of clients by adding 10 clients at a time until 1000 were added. Figure 9 shows a three-dimensional surface representation of FIL-ZTA performance across different device scales and network conditions. Figure 9 shows that, with the increase in clients to 200, the equal error rate (EER) of FIL-ZTA reduced from 2.15% to 2.02% because it used a wider variety of data samples. But once the client population went up to 1000, EER went up to 2.21% due to poor communication and bad clients. Regardless of such issues, FIL-ZTA continued to be better than the baseline approach, which is an indicator of strong scalability.

Table 10. Performance changes under different client scales.

Number of Clients	FIL-ZTA EER (%)	Convergence Rounds	Single-Round Time(s)	Cumulative Communication (GB)	Performance Retention Rate (%)
10	2.15	18	14.5	0.216	100.0
50	2.08	21	22.3	0.504	103.4
200	2.02	25	31.6	0.900	106.4
500	2.11	29	39.8	1.392	101.9
1000	2.21	32	46.2	1.728	97.3

shows performance measures at different client sizes. At 1000 clients, convergence rounds increase 18 to 32 and single round training time increases from 14.5 to 46.2 s FIL-ZTA. The total communication overhead is only 41.3% that of FedAvg. This scalability advantage comes with the asynchronous aggregation of FIL-ZTA, so some of the clients can wait with their updates without compromising the overall convergence.

As shown in

Table 11. Wall-clock time for asynchronous FIL-ZTA under different client scales.

Clients	Synchronous (for Reference)	Asynchronous (θ = 0.8)	Speedup
10	4.3 min	4.1 min	1.05×
50	9.8 min	8.0 min	1.23×
200	15.2 min	11.3 min	1.34×
500	24.6 min	16.2 min	1.52×
1000	38.7 min	20.5 min	1.89×

, asynchronous aggregation significantly reduces wall-clock time, especially for large client populations. For 1000 clients, the asynchronous version achieves a 1.89× speedup compared to a hypothetical synchronous baseline (which would wait for all clients).

Figure 10 shows that, even when 30% of clients are stragglers (i.e., their updates arrive after the waiting window), the asynchronous FIL-ZTA still converges within 38 rounds and achieves a final AUC of 0.984. The dynamic screening mechanism filters out any low-quality updates from stragglers, and the contribution-aware weighting ensures that only timely, high-quality updates influence the global model. This demonstrates a robustness to stragglers without explicit straggler mitigation.

4.5.2. Compatibility of Heterogeneous Devices

All of the devices in the zero-trust environment have different levels of computing capabilities as well as network conditions. In our experiment, we simulated three common devices: high-performance servers (32 GB of RAM, 1 Gbps), edge gateways (8 GB of RAM, 100 Mbps), and IoT devices (2 GB of RAM, 10 Mbps).

Table 12. Performance of heterogeneous devices.

Device Type	Computing Power	Network Bandwidth	EER (%)	Training Time (s)	Memory Occupancy (MB)	Model Size (MB)
High-performance server	High	1 Gbps	2.15	14.5	1353	12.0
Edge gateway	Medium	100 Mbps	2.41	28.7	842	8.2
Internet of Things devices	Low	10 Mbps	2.89	72.3	512	4.1

shows the performance of FIL-ZTA on these devices. The equal error rate on IoT devices increased by 2.15% to 2.89%, and the training period was increased by 72.3 s. Nevertheless, the lightweight optimization model that shrunk the parameters to 34.2% of the initial is still able to satisfy real-time authentication requirements.

5. Discussion

5.1. Analysis of the Method’s Advantages

The FIL-ZTA model has several significant benefits. First, it reaches an equal error rate (EER) of only 2.15% in a static environment, 56.0% lower than FedAvg. This is mostly because of its awareness-based weighted averaging algorithm that focuses on incorporating quality information. Under dynamic conditions, the model reacts quickly and recovers concept drift after two rounds. This is 75% faster than FedAvg and is due to its mechanism of screening clients dynamically, which means that changes can be identified at earlier stages with the latest threat intelligence. In terms of communication efficiency, the model converges within 18 training rounds in the asynchronous setting, with a cumulative communication cost of 216 MB. As shown in Table 11, asynchronous aggregation reduces wall-clock time by up to 89% for 1000 clients compared to a synchronous baseline, confirming the scalability advantage mentioned earlier. It supports a massive use scale due to its asynchronous architecture of aggregation. On the issue of security strength, the model ensures a 4.75 percent EER when subjected to a 30% malicious attack by clients, compared to the 18.92% of FedAvg. The triple protection mechanism provides an overall protection effect of 96.8%. Regarding the practical usability of the model, it still works effectively on IoT devices despite a parameter decrease of 65.8% and an EER of 2.89%, indicating its ability to operate in different settings.

5.2. Limitation Analysis

Various improvements are possible with the existing method. For example, in terms of computational complexity, the single-round training time increased by 15.4%, which may affect real-time performance on resource-constrained devices. The mechanism of dynamic evaluation would cause a bottleneck at a high number of clients. In terms of the additional cost for privacy protection, when the privacy budget e reduces ∞ to 0.1, its equal error rate increases from 2.15% to 3.12%. Even though this is superior to the baseline with no privacy protection, further refinement is required when dealing with high-precision applications. When facing extreme attacks, performance drops dramatically once malicious players go beyond 40%. The capability of the dynamic screening mechanism to identify coordinated patterns of attacks should be improved. The drift detection mechanism should also be enhanced. The current method relying on performance mutations is unable to perceive progressive drift. It is imperative to propose other sensitive measures for continuous monitoring. Finally, in terms of personalized adaptation, global aggregation can hinder flexibility to client-specific patterns. Major distinctions in the distribution of data may impact the local performance.

5.3. Research Implications and Prospects

There are several areas where future research is necessary. To optimize the algorithm, it is important to investigate lightweight contribution assessment measures and adaptive privacy budgets. Architectural innovation must take into account the hierarchical federated structure as a compromise between global sharing and local personalization or incorporate blockchain technology to improve security when attacked. Assessment and validation should involve setting up a realistic test and carrying out long-term performance monitoring. FIL-ZTA provides a viable technical solution for validation within zero-trust settings. Subsequent steps must aim to eliminate known technical constraints while retaining existing benefits, regarding the method’s effectiveness, safety, and usability, to further advance this field.