{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,15]],"date-time":"2026-09-15T11:04:08Z","timestamp":1789470248271,"version":"build-2803163510"},"reference-count":22,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2026,9,15]],"date-time":"2026-09-15T00:00:00Z","timestamp":1789430400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,9,15]],"date-time":"2026-09-15T00:00:00Z","timestamp":1789430400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Sci Rep"],"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>\n                    The proliferation of edge computing in industrial and IoT networks necessitates expert systems that support accurate, interpretable, and resource-efficient intrusion detection under strict privacy and computational constraints. This paper presents\n                    <jats:bold>HED-ID<\/jats:bold>\n                    , a fully integrated\n                    <jats:bold>federated expert system<\/jats:bold>\n                    designed for real-time, edge-oriented anomaly detection. The system combines: (i) a stacked bidirectional GRU (BiGRU) architecture with hybrid temporal\u2013spatial attention for sequential and feature-level anomaly modeling, (ii) a resource-adaptive Grey Wolf Optimizer (A-GWO) that modulates exploration\u2013exploitation behavior based on real-time CPU utilization and Bayesian epistemic uncertainty, with formal convergence proof under bounded resource shifts (Appendix A), (iii) federated SHAP, which aggregates local explanations using weighted averaging to produce consistent global attributions without sharing raw data, (iv) a multi-objective fitness function that simultaneously considers accuracy, model complexity, and predictive uncertainty, and (v) SHAP-guided iterative pruning for reducing computational overhead while preserving model fidelity. Empirical evaluation on CICIDS-2017, UNSW-NB15, ToN-IoT, and a noisy-edge variant of ToN-IoT (10\u201320% controlled packet loss and jitter) demonstrates 95.6% accuracy in cloud-like conditions and 93.8% on Raspberry Pi 4 (4 GB RAM) before pruning, with inference latency maintained within 18\u201322 ms. Post-pruning, memory usage decreases from 92 to 115\u00a0MB to 78\u201396\u00a0MB, with \u2264\u20091.1% accuracy degradation. To support deployment, Docker orchestration templates, pruning threshold configurations, and Grafana-based monitoring are provided\u2014reducing retraining interventions from 11 to 4 per year in a simulated 50-device edge environment.\n                  <\/jats:p>","DOI":"10.1038\/s41598-026-61336-6","type":"journal-article","created":{"date-parts":[[2026,9,15]],"date-time":"2026-09-15T10:16:49Z","timestamp":1789467409000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["HED-ID: a federated expert system for interpretable and resource-adaptive intrusion detection on edge devices"],"prefix":"10.1038","volume":"16","author":[{"given":"Kushboo","family":"Nasir","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3018-048X","authenticated-orcid":false,"given":"Sahar K.","family":"Badri","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0630-1264","authenticated-orcid":false,"given":"Asad","family":"Khattak","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5533-3203","authenticated-orcid":false,"given":"Daniyal M.","family":"Alghazzawi","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mohammed Yahya","family":"Alghamdi","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5600-3559","authenticated-orcid":false,"given":"Mona","family":"Alkhozae","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2498-9365","authenticated-orcid":false,"given":"Abeer","family":"Almakky","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9374-0985","authenticated-orcid":false,"given":"Rania M.","family":"Alhazmi","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3320-2074","authenticated-orcid":false,"given":"Muhammad Zubair","family":"Asghar","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,9,15]]},"reference":[{"key":"61336_CR1","doi-asserted-by":"publisher","first-page":"110827","DOI":"10.1016\/j.compeleceng.2025.110827","volume":"129","author":"AP Chowdhury","year":"2026","unstructured":"Chowdhury, A. P. et al. FLEX-IDS: A secure and explainable federated intrusion detection framework for Edge-of-Things environments under adversarial conditions. Comput. Electr. Eng. 129, 110827 (2026).","journal-title":"Comput. Electr. Eng."},{"issue":"1","key":"61336_CR2","doi-asserted-by":"publisher","first-page":"33291","DOI":"10.1038\/s41598-025-15052-2","volume":"15","author":"AA Alanazi","year":"2025","unstructured":"Alanazi, A. A. et al. Secure federated learning with metaheuristic optimized dimensionality reduction and multi-head attention for DDoS attack mitigation. Sci. Rep. 15 (1), 33291. https:\/\/doi.org\/10.1038\/s41598-025-15052-2 (2025).","journal-title":"Sci. Rep."},{"issue":"4","key":"61336_CR3","doi-asserted-by":"publisher","first-page":"3","DOI":"10.52866\/2788-7421.1328","volume":"6","author":"MO Nassar","year":"2025","unstructured":"Nassar, M. O. A Robust and Energy-Efficient Federated IDS for IIoT Using Spiking Neural Networks and Differential Evolution with Adversarial Resilience. Iraqi J. Comput. Sci. Math. 6 (4), 3 (2025).","journal-title":"Iraqi J. Comput. Sci. Math."},{"key":"61336_CR4","unstructured":"Shimin, S. et al. Hybrid Deep Learning-Federated Learning Powered Intrusion Detection System for IoT\/5G Advanced Edge Computing Network, arXiv:2509.15555, 2025. https:\/\/arxiv.org\/abs\/2509.15555"},{"key":"61336_CR5","doi-asserted-by":"crossref","unstructured":"Georgiades, M. & Hussain, F. An Explainable AI Approach for Interpretable Cross-Layer Intrusion Detection in Internet of Medical Things. Electronics, 14(16), 3218. (2025). https:\/\/www.mdpi.com\/2079-9292\/14\/16\/3218","DOI":"10.3390\/electronics14163218"},{"issue":"1","key":"61336_CR6","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/s10791-025-09708-w","volume":"28","author":"AK Shukla","year":"2025","unstructured":"Shukla, A. K., Dwivedi, S. & Mishra, A. An effective hybrid deep learning metaheuristic model for robust IoT intrusion detection. Discover Comput. 28 (1), 1\u201331 (2025).","journal-title":"Discover Comput."},{"key":"61336_CR7","doi-asserted-by":"publisher","first-page":"21745","DOI":"10.1109\/ACCESS.2024.3362246","volume":"12","author":"A Shanbhag","year":"2024","unstructured":"Shanbhag, A., Vincent, S., Gowda, S. B., Kumar, O. P. & Francis, S. A. J. Leveraging metaheuristics for feature selection with machine learning classification for malicious packet detection in computer networks. IEEE Access. 12, 21745\u201321764 (2024).","journal-title":"IEEE Access."},{"key":"61336_CR8","doi-asserted-by":"crossref","unstructured":"Alkanhel, R. et al. Network Intrusion Detection Based on Feature Selection and Hybrid Metaheuristic Optimization. Computers Mater. & Continua, 74(2). 2677\u20132693 https:\/\/doi.org\/10.32604\/cmc.2023.033273 (2023).","DOI":"10.32604\/cmc.2023.033273"},{"key":"61336_CR9","doi-asserted-by":"crossref","unstructured":"Sharma, A., Rani, S. & Shabaz, M. A comprehensive review of explainable AI in cybersecurity: Decoding the black box. ICT Express, 11(6), 1200\u20131219 https:\/\/doi.org\/10.1016\/j.icte.2025.10.004 (2025).","DOI":"10.1016\/j.icte.2025.10.004"},{"key":"61336_CR10","doi-asserted-by":"publisher","first-page":"1520741","DOI":"10.3389\/fcomp.2025.1520741","volume":"7","author":"VZ Mohale","year":"2025","unstructured":"Mohale, V. Z. & Obagbuwa, I. C. Evaluating machine learning-based intrusion detection systems with explainable AI: enhancing transparency and interpretability. Front. Comput. Sci. 7, 1520741 (2025).","journal-title":"Front. Comput. Sci."},{"key":"61336_CR11","doi-asserted-by":"crossref","unstructured":"Moustafa, N. & Slay, J. UNSW-NB15: A comprehensive dataset for network intrusion detection systems. [Dataset]. University of New South Wales. (2015). Available at: https:\/\/research.unsw.edu.au\/projects\/unsw-nb15-dataset","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"61336_CR12","unstructured":"rdpahalavan. GitHub - rdpahalavan\/nids-datasets: Download UNSW-NB15 and CIC-IDS2017 Datasets for Network Intrusion Detection (NIDS). GitHub. (2017). https:\/\/github.com\/rdpahalavan\/nids-datasets"},{"key":"61336_CR13","unstructured":"Moustafa, N. ToN_IoT datasets. IEEE DataPort. (2019)., October 16 https:\/\/ieee-dataport.org\/documents\/toniot-datasets"},{"key":"61336_CR14","unstructured":"Joshi, H. From Missing to Meaning: Strategies for Effectively Handling Missing Data. Medium, Python in Plain English, 4 Feb. python. (2024). plainenglish.io\/from-missing-to-meaning-strategies-for-effectively-handling-missing-data-220b33c8f511. Accessed 4 Oct. 2025."},{"issue":"2","key":"61336_CR15","doi-asserted-by":"publisher","first-page":"45","DOI":"10.29207\/joseit.v2i2.5411","volume":"2","author":"AM Oyelakin","year":"2023","unstructured":"Oyelakin, A. M. et al. Overview and exploratory analyses of CICIDS2017 intrusion detection dataset. J. Syst. Eng. Inform. Technol. (JOSEIT). 2 (2), 45\u201352 (2023).","journal-title":"J. Syst. Eng. Inform. Technol. (JOSEIT)"},{"key":"61336_CR16","doi-asserted-by":"publisher","first-page":"100164","DOI":"10.1016\/j.dajour.2023.100164","volume":"6","author":"CSK Dash","year":"2023","unstructured":"Dash, C. S. K., Behera, A. K., Dehuri, S. & Ghosh, A. An outliers detection and elimination framework in classification task of data mining. Decis. Analytics J. 6, 100164 (2023).","journal-title":"Decis. Analytics J."},{"key":"61336_CR17","unstructured":"Baidar, R., Maric, S. & Abbas, R. Hybrid Deep Learning-Federated Learning Powered Intrusion Detection System for IoT\/5G Advanced Edge Computing Network. arXiv preprint arXiv:2509.15555. (2025)."},{"issue":"5","key":"61336_CR18","doi-asserted-by":"publisher","first-page":"1578","DOI":"10.3390\/s25051578","volume":"25","author":"D Guo","year":"2025","unstructured":"Guo, D. & Xie, Y. Research on Network Intrusion Detection Model Based on Hybrid Sampling and Deep Learning. Sensors 25 (5), 1578. https:\/\/doi.org\/10.3390\/s25051578 (2025).","journal-title":"Sensors"},{"issue":"4","key":"61336_CR19","doi-asserted-by":"publisher","first-page":"347","DOI":"10.1007\/s12293-017-0234-5","volume":"9","author":"MA Tawhid","year":"2017","unstructured":"Tawhid, M. A. & Ali, A. F. A hybrid grey wolf optimizer and genetic algorithm for minimizing potential energy function. Memetic Comput. 9 (4), 347\u2013359 (2017).","journal-title":"Memetic Comput."},{"key":"61336_CR20","doi-asserted-by":"crossref","unstructured":"Shamim Ahsan, M., Islam, S. & Shatabda, S. A Systematic Review of Metaheuristics-Based and Machine Learning-Driven Intrusion Detection Systems in IoT. arXiv e-prints, arXiv-2506. (2025).","DOI":"10.1016\/j.swevo.2025.101984"},{"issue":"1","key":"61336_CR21","doi-asserted-by":"publisher","first-page":"2313","DOI":"10.1038\/s41598-025-32183-8","volume":"16","author":"K Nasir","year":"2026","unstructured":"Nasir, K. et al. HED-ID: an edge-deployable and explainable intrusion detection system optimized via metaheuristic learning. Sci. Rep. 16 (1), 2313 (2026).","journal-title":"Sci. Rep."},{"key":"61336_CR22","doi-asserted-by":"crossref","unstructured":"Tabassum, N., Khattak, A. M., Khali, A., Khan, W. A. & Asghar, M. Z. Attribute-Guided Zero-Shot Activity Recognition in Wearable Health Systems. In 2025 5th International Conference on Electrical, Computer, Communications and Mechatronics Engineering (ICECCME) (pp. 1\u20136). IEEE. (2025), October.","DOI":"10.1109\/ICECCME64568.2025.11277770"}],"container-title":["Scientific Reports"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.nature.com\/articles\/s41598-026-61336-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.nature.com\/articles\/s41598-026-61336-6","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.nature.com\/articles\/s41598-026-61336-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,15]],"date-time":"2026-09-15T10:16:56Z","timestamp":1789467416000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.nature.com\/articles\/s41598-026-61336-6"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,15]]},"references-count":22,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2026,12]]}},"alternative-id":["61336"],"URL":"https:\/\/doi.org\/10.1038\/s41598-026-61336-6","relation":{},"ISSN":["2045-2322"],"issn-type":[{"value":"2045-2322","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,15]]},"assertion":[{"value":"20 November 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"3 July 2026","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"15 September 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"The authors declare no competing interests.","order":1,"name":"Ethics","label":"Competing interests","group":{"name":"EthicsHeading","label":"Declarations"}}],"article-number":"28717"}}