## 4 Proposed System Design Overview  
The aim of this work is to design a novel RPL-IIoT security protocol with intrusion detection and introduce an optimised FTL-assisted customised IDS model: the FT-CID. The proposed FT-CID model is intended to achieve a very high intrusion detection accuracy in heterogeneous RPL-IIoT networks by adopting an FTL approach. The FTL model shares global attack knowledge among the various IIoT application scenarios generated based on the unique local learning parameters oof a distributed IDS model. A design overview of the FT-CID is shown in Figure 2. The FT-CID design process can be explained according to three steps. First, the centralised server initiates the network and sends a predefined learning model to the edges to trigger the local learning process on the data. The edges collect unique IIoT application data from application-specific IIoT networks and generate a local copy for each IIoT using a CNN classifier. Thirdly, the optimised FTL-based customised IDS model detects various RPL-IIoT intrusions based on local learning data and is optimised using a global learning model. Instead of transferring raw input data or results from the local learning model, the FT-CID transfers only the non-normalised prediction output as the logit outcome of a fully connected CNN with an IIoT network or application-specific weight values to optimise the global model generation. After receiving the logits from the local learning model, the centralised server initiates federated aggregation on local model logits, considering the degree of importance in the weights of local learning model parameters and logits for the IIoT network. The FT-CID model can then generate novel logit-based global shared parameters, such as the number of hidden layers and neurons and activation functions, to optimise the local learning model of the different RPL edge devices. Inspired by the idea of an attention mechanism [25], the FT-CID minimises the number of communications rounds and maximises learning convergence. With the federation of different local RPL-IIoT network parameters, the FT-CID achieves strong security and generalisation attack detection ability in heterogeneous IIoT networks. Finally, the central server sends back the globally shared learning parameters by utilising TL for the IIoT network to build customised learning models. Hence, the FT-CID model focuses on stochastic gradient descent (SGD)-based TL optimisation to improve the learning accuracy of each edge IDS without increasing the training time, which is repeated until the learning process converges. Intrusions are identified based on the global federated and unique attack knowledge acquired during testing. Thus, the distributed-learning-based detection model overcomes the shortcomings of centralised intrusion detection models and improves RPL security compared to a heterogeneous IIoT network without degrading network efficiency. Figure 3 shows the process involved in the proposed FT-CID model. First, the FT-CID model collects RPL data traffic with normal intrusion samples from the heterogeneous IIoT networks. The model preprocesses the collected traffic samples using Euclidean distance measurement to remove noisy data and then selects potential features from the preprocessed data from the IIoT network with the assistance of the improved grey wolf optimisation (IGWO) algorithm. The model then adopts the CNN model for local learning and generates logits for a local dataset of the IIoT network. The FT-CID model uses TL to communicate between the sensor's local learning model and the server's global learning model. After training the local model at the edge of the IIoT networks, the FT-CID model utilises the TL model with parameter transfer and relational knowledge transfer to update the global model.