Customised Intrusion Detection for an Industrial IoT Heterogeneous Network Based on Machine Learning Algorithms Called FTL-CID  
Nasr Abosata  
School of Aerospace, Transport and Manufacturing, Cranfield University, Cranfield MK43 0 AL, UK  
1  
Saba Al-Rubaye  
School of Aerospace, Transport and Manufacturing, Cranfield University, Cranfield MK43 0 AL, UK  
1  
Gokhan Inalhan  
School of Aerospace, Transport and Manufacturing, Cranfield University, Cranfield MK43 0 AL, UK  
1  
Footnote 1: [[https://www.mdpi.com/journal/sensors](https://www.mdpi.com/journal/sensors)]([https://www.mdpi.com/journal/sensors](https://www.mdpi.com/journal/sensors))  
Footnote 2: [[https://www.mdpi.com/journals/pdf/10/1](https://www.mdpi.com/journals/pdf/10/1)]([https://www.mdpi.com/journals/pdf/10/1](https://www.mdpi.com/journals/pdf/10/1))  
to launch various attacks within the RPL-IIoT scenario, and RPL security is paramount. A common method of RPL-IIoT attack detection is to employ a machine learning (ML)-based intrusion detection system (IDS) [3; 4]. However, most traditional ML-based IDS solutions are centralised and do not have the flexibility to detect the variety and full range of RPL attacks on IIoT applications [5]. Heterogeneous IIoT networks perform various network functions and present a challenge to intrusion detection, as there are various data and attack types. ML-based solutions are typically evaluated with small datasets, resulting in a lack of detection of novel attacks in real time. The RPL is mainly utilised in heterogeneous IIoT environments, and it is crucial to evaluate the IDS security model with a variety of IIoT intrusions presented in diverse RPL-IIoT networks. Most federated learning-assisted IDS models solve intrusion detection problems in heterogeneous IoT environments, but there are no specified FTL-based IDS models for heterogeneous RPL-IoT environments. IDS plays a crucial role in ensuring the security and confidentiality of such devices. ML with systems for intrusion detection has gained significant traction due to its high classification precision. FL provides collaborative learning among devices without requiring data sharing with a centralised server. Owing to its characteristics, ML can be taught across various devices and servers with decentralised data over multiple iterations. Federated learning (FL)-based IDS models are currently effective for IIoT intrusion detection. They can train a deep learning models with global knowledge and ensure high security while protecting user data [6]. Depending on the data sample and feature distribution, FL is categorised into three types: horizontal FL, vertical FL, and federated transfer learning (FTL) [7; 8]. FL-based IDS models enhance learning efficiency with reduced overhead and protect user information by achieving distributed learning at the edges. However, the insufficiency of unique data labelling and the dissimilarity of data features make FL-based IDS systems challenging. Transfer learning (TL) solves such issues by transferring the abundant labelled source domain knowledge to the edges. This avoids the lengthy learning time of particularised RPL-IIoT for designated applications. Moreover, an FLT algorithm is a novel concept that achieves an effective learning model by implicitly integrating the local and global knowledge of the IIoT network. In this paper, we present an FTL-assisted customised IDS model, the FT-CID, to detect intrusions in a heterogeneous RPL-IIoT network. The main contributions of the FT-CID are as follows. * To the best of our knowledge, the FT-CID is the first model to apply FTL to a heterogeneous RPL-IIoT IDS security model. This approach aggregates the data from the IIoT application domain. It accomplishes a customised attack detection model with global knowledge for the IIoT network by transferring and federating learning knowledge between the server and edges.