MSCSA-SAFL: A Self-Supervised Semi-Asynchronous Federated Framework for Zero-Day Intrusion Detection in Distributed IoT

With the rapid evolution of the Internet of Things (IoT), resource-constrained clients are confronted with escalating intrusion threats, particularly zero-day attacks. In distributed IoT, heterogeneous client computing capabilities and the presence of unresponsive or failed clients during federated training pose substantial challenges to Intrusion Detection System (IDS) design. This work proposes a lightweight Multi-Scale Convolution Space Attention Semi-Asynchronous Federated Learning (MSCSA-SAFL) framework. By aggregating a small number of clients and adopting a dynamic global model aggregation method based on information entropy weighting, the framework mitigates the impact of unresponsive or failed clients and non-independent and identically distributed (non-IID) data on model convergence. The model design incorporates a Multi-Scale Convolution Attention (MSCA) mechanism, which processes and fuses temporal and variable-level information in IoT traffic for multi-scale feature extraction, enhancing efficiency while lowering complexity. A redesigned Gated S6 Block is employed to capture long-term dependencies in traffic, improving the accuracy of long-sequence data processing. Experiments on the CIC-IoT 2023, CIC-UNSW-NB15, and CIC-IoV 2024 datasets demonstrate strong zero-day intrusion detection performance. The proposed framework achieves 99.07% accuracy and 99.05% F1-score on CIC-IoT 2023, and its edge inference latency on an NVIDIA Jetson Nano is only 12.18 ms, 12.46 ms, and 11.72 ms on CIC-IoT 2023, CIC-UNSWNB15, and CIC-IoV 2024, respectively.