{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,11]],"date-time":"2026-09-11T13:08:50Z","timestamp":1789132130314,"version":"build-2803163510"},"reference-count":41,"publisher":"MDPI AG","issue":"18","license":[{"start":{"date-parts":[[2026,9,11]],"date-time":"2026-09-11T00:00:00Z","timestamp":1789084800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>With increasing system complexity and attack sophistication, autonomous cyber defense has become essential in edge\u2013cloud Internet of Things (IoT) ecosystems, requiring intelligent, secure, and scalable agent communication frameworks. This paper proposes FMAD (Federated Multi-Agent Defense), a conceptual federated multi-agent framework that enables intelligent agent communication for autonomous cyber defense through collaborative sensing and federated learning, with a design emphasis on security and privacy preservation. The proposed framework defines a set of specialized intelligent agents responsible for distributed traffic sensing, threat intelligence analysis, federated model optimization, secure agent-to-agent communication, and adaptive mitigation. As an initial proof of concept, the Threat Intelligence Agent (TIA) was implemented using an xLSTM-based temporal intrusion detection model developed in this study and trained on the CIC-IoT-2023 dataset, achieving a detection accuracy of 99.89% while efficiently identifying temporal traffic anomalies at edge nodes. The FMAD framework integrates multiple collaborative agents for secure communication, federated learning, and coordinated cyber defense in edge\u2013cloud IoT environments. The experimental evaluation focuses on the xLSTM-based Threat Intelligence Agent (TIA) for DDoS detection, while the remaining components are assessed at the design level. However, empirical validation in the current study is limited solely to the TIA. To support trustworthy collaboration among distributed agents, the framework further proposes a secure communication architecture based on Elliptic Curve Cryptography (ECC) key agreement, ChaCha20-Poly1305 authenticated encryption, and a permissioned blockchain ledger, which are designed to provide secure interaction management and traceability within the stated security assumptions. This federated multi-agent approach provides a promising foundation for intelligent agent communication and scalable autonomous cyber defense in real-world edge\u2013cloud IoT environments.<\/jats:p>","DOI":"10.3390\/s26185775","type":"journal-article","created":{"date-parts":[[2026,9,11]],"date-time":"2026-09-11T12:24:33Z","timestamp":1789129473000},"page":"5775","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["A Federated Multi-Agent Communication Framework for Autonomous Cyber Defense in Edge\u2013Cloud IoT Environments"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0122-8512","authenticated-orcid":false,"given":"Hakan","family":"Aydin","sequence":"first","affiliation":[{"name":"Department of Computer Engineering, Faculty of Engineering and Architecture, Istanbul Topkapi University, Istanbul 34310, Turkey"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,9,11]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"637","DOI":"10.1109\/JIOT.2016.2579198","article-title":"Edge computing: Vision and challenges","volume":"3","author":"Shi","year":"2016","journal-title":"IEEE Internet Things J."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"54038","DOI":"10.1109\/ACCESS.2022.3176106","article-title":"A survey of state-of-the-art on edge computing: Theoretical models, technologies, directions, and development paths","volume":"10","author":"Liu","year":"2022","journal-title":"IEEE Access"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Gkonis, P., Giannopoulos, A., Trakadas, P., Masip-Bruin, X., and D\u2019Andria, F. (2023). A survey on IoT-edge-cloud continuum systems: Status, challenges, use cases, and open issues. Future Internet, 15.","DOI":"10.20944\/preprints202311.0532.v1"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"849","DOI":"10.1016\/j.future.2017.09.020","article-title":"Next generation cloud computing: New trends and research directions","volume":"79","author":"Varghese","year":"2018","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"126533","DOI":"10.1016\/j.neucom.2023.126533","article-title":"The survey and meta-analysis of the attacks, transgressions, countermeasures and security aspects common to the Cloud, Edge and IoT","volume":"551","author":"Pawlicki","year":"2023","journal-title":"Neurocomputing"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Salayma, M. (2024). Risk and threat mitigation techniques in internet of things (IoT) environments: A survey. Front. Internet Things, 2.","DOI":"10.3389\/friot.2023.1306018"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"80","DOI":"10.1109\/MC.2017.201","article-title":"DDoS in the IoT: Mirai and other botnets","volume":"50","author":"Kolias","year":"2017","journal-title":"Computer"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"1153","DOI":"10.1109\/COMST.2015.2494502","article-title":"A survey of data mining and machine learning methods for cyber security intrusion detection","volume":"18","author":"Buczak","year":"2015","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_9","first-page":"102419","article-title":"Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study","volume":"50","author":"Ferrag","year":"2020","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"146","DOI":"10.1016\/j.comnet.2014.11.008","article-title":"Security, privacy and trust in Internet of Things: The road ahead","volume":"76","author":"Sicari","year":"2015","journal-title":"Comput. Netw."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"332","DOI":"10.3390\/iot3030019","article-title":"A survey of security architectures for edge computing-based IoT","volume":"3","author":"Fazeldehkordi","year":"2022","journal-title":"IoT"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Kott, A. (2023). Autonomous intelligent cyber-defense agent: Introduction and overview. Autonomous Intelligent Cyber Defense Agent (AICA) A Comprehensive Guide, Springer International Publishing.","DOI":"10.1007\/978-3-031-29269-9"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Franklin, S., and Graesser, A. (1996). Is it an Agent, or just a Program?: A Taxonomy for Autonomous Agents. Proceedings of the International Workshop on Agent Theories, Architectures, and Languages, Springer.","DOI":"10.1007\/BFb0013570"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"319","DOI":"10.1109\/JAS.2021.1003820","article-title":"Physical safety and cyber security analysis of multi-agent systems: A survey of recent advances","volume":"8","author":"Zhang","year":"2021","journal-title":"IEEE\/CAA J. Autom. Sin."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3729213","article-title":"Towards the deployment of realistic autonomous cyber network defence: A systematic review","volume":"58","author":"Vyas","year":"2025","journal-title":"ACM Comput. Surv."},{"key":"ref_16","unstructured":"McMahan, B., Moore, E., Ramage, D., Hampson, S., and y Arcas, B.A. (2017). Communication-efficient learning of deep networks from decentralized data. Proceedings of the Artificial Intelligence and Statistics, PMLR. Available online: https:\/\/proceedings.mlr.press\/v54\/mcmahan17a\/mcmahan17a.pdf."},{"key":"ref_17","first-page":"1","article-title":"Federated machine learning: Concept and applications","volume":"10","author":"Yang","year":"2019","journal-title":"ACM Trans. Intell. Syst. Technol. (TIST)"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3555308","article-title":"Edge-computing-driven internet of things: A survey","volume":"55","author":"Kong","year":"2022","journal-title":"ACM Comput. Surv."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"4","DOI":"10.1007\/s10458-023-09633-6","article-title":"A survey of multi-agent deep reinforcement learning with communication","volume":"38","author":"Zhu","year":"2024","journal-title":"Auton. Agents Multi-Agent Syst."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"2046","DOI":"10.1109\/SURV.2013.031413.00127","article-title":"A survey of defense mechanisms against distributed denial of service (DDoS) flooding attacks","volume":"15","author":"Zargar","year":"2013","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_21","unstructured":"Wooldridge, M. (2009). An Introduction to Multiagent Systems, John Wiley & Sons. Available online: https:\/\/uranos.ch\/research\/references\/Wooldridge_2001\/TLTK.pdf."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"35","DOI":"10.1145\/367211.367250","article-title":"An agent-based approach for building complex software systems","volume":"44","author":"Jennings","year":"2001","journal-title":"Commun. ACM"},{"key":"ref_23","unstructured":"FIPA ACL (2026, June 15). Message Structure Specification. Available online: http:\/\/www.fipa.org\/specs\/fipa00061\/."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Bellifemine, F.L., Caire, G., and Greenwood, D. (2007). Developing Multi-Agent Systems with JADE, John Wiley & Sons. Available online: https:\/\/www.mit.bme.hu\/data\/migrate\/oktatas\/targyak\/8671\/Developing-Multi-Agent-Systems-with-JADE.pdf.","DOI":"10.1002\/9780470058411"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"21954","DOI":"10.1109\/ACCESS.2017.2762418","article-title":"A deep learning approach for intrusion detection using recurrent neural networks","volume":"5","author":"Yin","year":"2017","journal-title":"IEEE Access"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"41525","DOI":"10.1109\/ACCESS.2019.2895334","article-title":"Deep learning approach for intelligent intrusion detection system","volume":"7","author":"Vinayakumar","year":"2019","journal-title":"IEEE Access"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"107547","DOI":"10.52202\/079017-3417","article-title":"xlstm: Extended long short-term memory","volume":"37","author":"Beck","year":"2024","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_28","unstructured":"Hankerson, D., Vanstone, S., and Menezes, A. (2004). Guide to Elliptic Curve Cryptography, Springer."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"36","DOI":"10.1007\/s102070100002","article-title":"The Elliptic Curve Digital Signature Algorithm (ECDSA)","volume":"1","author":"Johnson","year":"2016","journal-title":"Int. J. Inf. Secur."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Nir, Y., and Langley, A. (2018). ChaCha20 and Poly1305 for IETF Protocols, Internet Engineering Task Force (IETF).","DOI":"10.17487\/RFC8439"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"2292","DOI":"10.1109\/ACCESS.2016.2566339","article-title":"Blockchains and smart contracts for the internet of things","volume":"4","author":"Christidis","year":"2016","journal-title":"IEEE Access"},{"key":"ref_32","unstructured":"Dorri, A., Kanhere, S.S., and Jurdak, R. (2016). Blockchain in internet of things: Challenges and solutions. arXiv."},{"key":"ref_33","first-page":"207","article-title":"Zero trust architecture","volume":"800","author":"Rose","year":"2020","journal-title":"NIST Spec. Publ."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"3929","DOI":"10.1109\/TNET.2024.3408675","article-title":"Correlation-aware neural networks for DDoS attack detection in IoT systems","volume":"32","author":"Hekmati","year":"2024","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_35","first-page":"6450","article-title":"Intrusion detection with machine learning: A two-step federated approach using the CIC IoT 2023 dataset","volume":"26","author":"Jakotiya","year":"2025","journal-title":"Comput. Sci."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"28","DOI":"10.55056\/jec.648","article-title":"A long short-term memory based approach for detecting cyber attacks in IoT using CIC-IoT2023 dataset","volume":"3","author":"Jony","year":"2024","journal-title":"J. Edge Comput."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Ain, N.U., Sardaraz, M., Tahir, M., Abo Elsoud, M.W., and Alourani, A. (2025). Securing IoT networks against DDoS attacks: A hybrid deep learning approach. Sensors, 25.","DOI":"10.3390\/s25051346"},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"\u00c7eki\u015f, \u0130.K., Ayranc\u0131, B., Salman, F.N., and \u00d6z\u00e7elik, \u0130. (2025). IP Spoofing Detection Using Deep Learning. Appl. Sci., 15.","DOI":"10.3390\/app15179508"},{"key":"ref_39","first-page":"734","article-title":"Enhanced intrusion detection in smart grids using extended long short-term memory variants","volume":"11","author":"Baalia","year":"2025","journal-title":"Int. J. Adv. Intell. Inform."},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"205","DOI":"10.1007\/s00607-025-01544-6","article-title":"Hybxlstm: A hybrid xLSTM-XGBoost model for securing O-RAN against backdoor attacks: R. Naim et al","volume":"107","author":"Naim","year":"2025","journal-title":"Computing"},{"key":"ref_41","unstructured":"Booker, L.B., and Musman, S.A. (2020). A model-based, decision-theoretic perspective on automated cyber response. arXiv."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/18\/5775\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,11]],"date-time":"2026-09-11T12:26:00Z","timestamp":1789129560000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/18\/5775"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,11]]},"references-count":41,"journal-issue":{"issue":"18","published-online":{"date-parts":[[2026,9]]}},"alternative-id":["s26185775"],"URL":"https:\/\/doi.org\/10.3390\/s26185775","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,11]]}}}