## 3 System Model  
The architecture of the proposed FT-CID is shown in Figure 1. The FT-CID model design assists in intrusion detection for heterogeneous IIoT networks. To demonstrate the process of the FT-CID, IIoT networks are modelled: IIoT1 = advanced metering infrastructure (AMI). The edge devices of the corresponding IIoT network are denoted as E-AMI. First, the edge devices collect data from different IIoT devices through the RPL routing process. The FT-CID then instructs 'N' different edges of the IIoT network to obtain traffic data and construct the datasets. An IIoT network refers to a heterogeneous network that consists of a set of IoT devices, such as smartphones and smart sensors, cameras, and meters. The FT-CID comprises the following aspects: IIoT devices, edges of the IIoT network or sensors, and a central server. The devices in an IIoT network are tiny and have constrained energy, storage space, and bandwidth. Compared with resource-constrained IIoT devices, edge nodes have enormous resource capabilities. Therefore, the FT-CID places a signature-based IDS on the edge of the IIoT networks. Unlike resource-limited IIoT devices and edges, such as smart watches, fire alarms, security systems, and medical sensors, the central server has enormous processing and storage capability. In FL, the central or global server gains knowledge from a heterogeneous IIoT network instead of storing or processing the data that belong to the sensors and thus facilitates a distributed IDS at the edge of  
Figure 1: Architecture of heterogeneous IIoT network. network considered in the FT-CID is represented as a set of heterogeneous IIoT (HIIoT) = [IIoT1], where IIoT1 = AMI. The edges of the IIoT network are denoted by [E-AMI], and the traffic data collected from the heterogeneous IIoT network are represented by [D1]. By building a local learning model, the edge devices are responsible for learning the patterns from the local dataset gathered from the distributed IIoT network. The central server exploits a traditional dataset to construct a predefined global learning model. It partially retrains the global learning model with the assistance of the local model parameters provided through the TL process. The data collected from the heterogeneous IIoT network comprises normal and abnormal data. Finally, a convolutional neural network (CNN)-based learning model in the FT-CID classifies the data at the edges as normal or abnormal based on the global learning parameters provided by the central server. Attack Model: The RPL is exploited in heterogeneous IIoT environments, and the attacks faced in such environments are also different. To experiment with the intrusion detection model, we built a dataset with a design of intrusion patterns from RPL protocol-related attacks, such as rank, version, hello flood, denial of service (DoS), blackhole, Sybil, selective forwarding, sinkhole, theft, and wormhole attacks. In the FT-CID, all the attacks mentioned above are modelled as intrusions, which addresses the binary classification problem of having only normal and intrusion samples. In a blackhole attack, a malicious intruder may attempt to throw packets away instead of forwarding them. A sinkhole attack is performed by changing the RPL ranks and obtaining a large amount of traffic from the network to alter its RPL topology. In a rank attack, a malicious intruder disseminates false ranks to enjoy the network benefits. Wormhole attackers employ the off-band communication of two different entities to perform attacks. During hello flooding, the malicious node exploits DODAG information object (DIO) messages of destination-oriented directed acyclic graphs (DODOG) to launch attack activity. A clone ID attacker mimics legitimate nodes to diminish the network performance. Traffic analysis attackers exploit the features and data patterns of communication and launch harmful activities in a network. During a sniffing attack, a malicious node notices the network traffic exchanges between two entities and performs attacking activities.