HED-ID: a federated expert system for interpretable and resource-adaptive intrusion detection on edge devices

Author First name, Last name, Institution

• Kushboo Nasir, Gomal University
• Sahar K. Badri, Faculty of Computing and Information Technology, King Abdulaziz University
• Asad Khattak, Zayed University, Abu Dhabi CampusFollow
• Daniyal M. Alghazzawi, Faculty of Computing and Information Technology, King Abdulaziz University
• Mohammed Yahya Alghamdi, Al Baha University
• Mona Alkhozae, Faculty of Computing and Information Technology, King Abdulaziz University
• Abeer Almakky, Faculty of Computing and Information Technology, King Abdulaziz University
• Rania M. Alhazmi, Faculty of Computing and Information Technology, King Abdulaziz University
• Muhammad Zubair Asghar, Gomal University

Document Type

Article

Source of Publication

Scientific Reports

Publication Date

12-1-2026

Abstract

The proliferation of edge computing in industrial and IoT networks necessitates expert systems that support accurate, interpretable, and resource-efficient intrusion detection under strict privacy and computational constraints. This paper presents HED-ID, a fully integrated federated expert system designed for real-time, edge-oriented anomaly detection. The system combines: (i) a stacked bidirectional GRU (BiGRU) architecture with hybrid temporal–spatial attention for sequential and feature-level anomaly modeling, (ii) a resource-adaptive Grey Wolf Optimizer (A-GWO) that modulates exploration–exploitation behavior based on real-time CPU utilization and Bayesian epistemic uncertainty, with formal convergence proof under bounded resource shifts (Appendix A), (iii) federated SHAP, which aggregates local explanations using weighted averaging to produce consistent global attributions without sharing raw data, (iv) a multi-objective fitness function that simultaneously considers accuracy, model complexity, and predictive uncertainty, and (v) SHAP-guided iterative pruning for reducing computational overhead while preserving model fidelity. Empirical evaluation on CICIDS-2017, UNSW-NB15, ToN-IoT, and a noisy-edge variant of ToN-IoT (10–20% controlled packet loss and jitter) demonstrates 95.6% accuracy in cloud-like conditions and 93.8% on Raspberry Pi 4 (4 GB RAM) before pruning, with inference latency maintained within 18–22 ms. Post-pruning, memory usage decreases from 92 to 115 MB to 78–96 MB, with ≤ 1.1% accuracy degradation. To support deployment, Docker orchestration templates, pruning threshold configurations, and Grafana-based monitoring are provided—reducing retraining interventions from 11 to 4 per year in a simulated 50-device edge environment.

DOI Link

10.1038/s41598-026-61336-6

ISSN

2045-2322

Publisher

Springer Science and Business Media LLC

Volume

16

Issue

1

Disciplines

Computer Sciences

Keywords

Convergent metaheuristics, Edge computing, Expert systems, Explainable AI, Federated learning, Intrusion detection, Resource-adaptive optimization

Scopus ID

105050587627

Creative Commons License

This work is licensed under a Creative Commons Attribution 4.0 International License.

Recommended Citation

Nasir, Kushboo; Badri, Sahar K.; Khattak, Asad; Alghazzawi, Daniyal M.; Alghamdi, Mohammed Yahya; Alkhozae, Mona; Almakky, Abeer; Alhazmi, Rania M.; and Asghar, Muhammad Zubair, "HED-ID: a federated expert system for interpretable and resource-adaptive intrusion detection on edge devices" (2026). All Works. 8428.
https://zuscholars.zu.ac.ae/works/8428

Indexed in Scopus

yes

Open Access

yes

Open Access Type

Gold: This publication is openly available in an open access journal/series