Safa Ben Atitallah

The Internet of Things (IoT) demands collaborative intrusion detection across distributed gateways, yet centralized training is often infeasible due to privacy constraints, bandwidth limits, and heterogeneous (non-IID) traffic. In this work, we propose FedDMGL (Federated Dynamic Markov Graph Learning), a federated framework that models traffic as temporal graphs and learns dynamic, attention-based Markov transitions to capture evolving communication patterns and anomalous deviations. FedDMGL captures multi-stage attack signatures through spatiotemporal learning over graph sequences, mitigates client heterogeneity using topology- aware aggregation based on lightweight structural fingerprints, and improves interpretability through a multi-task objective that jointly optimizes sequence-level intrusion classification and edge-level transition anomaly detection. Experiments on two benchmark datasets (NF-ToN-IoT-v3 and NF-BoT-IoT-v3) show that FedDMGL achieves 98.82% accuracy / 98.30% macro F1 on NF-ToN-IoT-v3 and 98.59% accuracy / 90.11% macro F1 on the highly imbalanced NF-BoT-IoT-v3, consistently outperforming federated baselines. Ablations attribute +3.04 macro F1 points to dynamic Markov modeling and +3.30 points to topology-aware aggregation over standard FedAvg.

The rapid expansion of Internet-of-Things (IoT) ecosystems has significantly increased the cybersecurity attack surface, necessitating intrusion detection systems (IDS) that are both accurate and explainable. This paper introduces NEXUS-IDS, a unified framework that integrates graph-based deep learning, Explainable AI (XAI), and large language models (LLMs) for trustworthy IoT security analytics. The framework employs a Flow-Node Graph Neural Network (IDS-FN-GNN) model that captures spatial dependencies and relational patterns in network traffic by representing flows as nodes and communication relationships as edges. The main contribution lies in establishing a novel dual-layer explainability framework: GraphLIME provides structural interpretability through feature-level attributions, while an LLM-powered semantic layer with entropy-aware uncertainty calibration translates technical explanations into natural-language threat narratives, mitigating hallucination risks. Evaluation in four LLM (82M–70B parameters) using an LLM-as-a-Judge framework shows that foundation models achieve quality scores of 4.8/5.0, while entropy-based caching limits LLM invocations to approximately 5% of samples. Experiments on the Edge-IIoTSet and IoTID20 datasets demonstrate detection accuracy exceeding 94% with robust performance across heterogeneous attack categories. NEXUS-IDS establishes new benchmarks for transparent and human-centric intrusion detection in next-generation IoT ecosystems, bridging the gap between high-performance detection and actionablesecurity intelligence through grounded, verifiable explanations.