With the widespread adoption of IoT and edge computing, federated learning (FL)-based intrusion detection systems (IDSs), which enable privacy-preserving, cost-effective training by fusing knowledge extracted from collaborators without centralizing the sensitive data, have become essential. Specifically, decentralized FL (DFL)-based IDSs are increasingly utilized to enhance robustness and eliminate the single point of failure caused by server-based aggregation in centralized FL (CFL).
Despite these advances, most methods assume stationary data, which severely limits their adaptability to evolving zero-day threats in dynamic environments. While retraining could address this concept drift, it imposes prohibitive computational and storage overheads on resource-constrained IoT devices. On the other hand, fine-tuning models solely on new data risks catastrophic forgetting (CF) of previously learned attack signatures. In federated settings, CF propagates during aggregation and compromises the global model. This degradation is exacerbated by Non-Independent and Identically Distributed (Non-IID) data across collaborators, particularly when new collaborators join the network without historical data. Furthermore, these approaches often lack transparency due to the absence of mechanisms for interpreting and explaining model decisions.
To tackle these limitations, we propose XDFC-IDS, an explainable decentralized federated class-incremental intrusion detection framework for streaming IoT environments.
The novelty of XDFC-IDS lies in its integration of a serverless federated architecture with a dual-loss class-incremental learning (CIL) objective and a local post-hoc explanation module. The serverless federated architecture adopts a mesh topology for peer-to-peer aggregation to eliminate central server bottlenecks. Meanwhile, the dual-loss objective combines cross-entropy classification with Elastic Weight Consolidation (EWC)-based regularization to mitigate CF in Non-IID and streaming environments, including scenarios with new collaborators lacking historical data. Furthermore, a local SHapley Additive exPlanations (SHAP)-based post-hoc explainability module provides transparent, feature-level interpretability without compromising the privacy of sensitive local data.
XDFC-IDS is evaluated on the real-world TONIoT and Kitsune IoT traffic datasets, utilizing Convolutional Neural Network-Gated Recurrent Unit (CNNGRU) and Long Short-Term Memory (LSTM) backbones under two challenging conditions including Non-IID federated training and sequential CIL with limited retention of old data. Experimental results show that XDFC-IDS is competitive with Fed-IDS in the initial task and consistently outperforms GLFC. Furthermore, it demonstrates stronger robustness than both baselines in subsequent tasks when historical data retention is reduced to 15\%, while concurrently achieving shorter retraining times.
The feasibility of the proposed framework is also demonstrated through local post-hoc analysis, which reveals that the predictions are driven by meaningful, security-relevant traffic features.