ST-Fedxids: A Spatiotemporal Federated Explainable Intrusion Detection System With Drift-Adaptive Graph Learning For High-Density Public Wifi Environments

Quang-Vinh Dang; Dat Le; Minh Ngoc Dinh; Ngoc-Son-An Nguyen; Thi-Bich-Diem Vo

doi:10.29284/zcrk2p65

Authors

Quang-Vinh Dang School of Innovative and Computing Sciences, British University Vietnam, Hung Yen 160000, Vietnam
Dat Le Department of Science, Technology, and International Projects, Ho Chi Minh City University of Economics and Finance, Ho Chi Minh City, 700000, Vietnam
Minh Ngoc Dinh School of Data Science and IT, Millennia University, Ho Chi Minh City, 700000, Vietnam
Ngoc-Son-An Nguyen Faculty of Information Technology, Industrial University of Ho Chi Minh City, Ho Chi Minh City, 700000, Vietnam
Thi-Bich-Diem Vo Giao Hang Nhanh, Ho Chi Minh City, 700000, Vietnam

DOI:

https://doi.org/10.29284/zcrk2p65

Keywords:

Intrusion Detection System; Federated Learning; Graph Neural Networks; Spatiotemporal Learning; Explainable AI; Concept Drift; Public WiFi Security; Fairness-Aware Machine Learning

Abstract

Public WiFi networks deployed across high-density transit environments — such as train stations, bus terminals, and airports — present a largely unaddressed frontier in network intrusion detection research. These venues collectively serve tens of millions of users monthly yet exhibit extreme traffic heterogeneity, continuous attack pattern drift, and strict data privacy constraints that preclude centralized detection paradigms. Existing federated learning-based intrusion detection systems (FL-IDS) fail to simultaneously address the spatiotemporal dynamics of evolving network topologies, the interpretability requirements of operational security teams, the concept drift inherent to live deployments, and the fairness disparities that arise across heterogeneous venue types. We propose ST-FedXIDS, a Spatiotemporal Federated Explainable Intrusion Detection System that unifies five technical contributions: (1) a heterogeneous dynamic graph construction pipeline that models multi-protocol WiFi traffic as sliding temporal-window graphs; (2) ST-GraphSAGE with multi-head temporal self-attention, replacing the LSTM/GRU paradigm used in all prior spatiotemporal GNN-IDS works; (3) Drift-Adaptive Federated Averaging (DA-FedAvg) that embeds ADWIN-based graph embedding drift detection directly into the federated aggregation protocol; (4) a GNN-Explainer module that produces subgraph-level attack attribution explanations for operational incident response; and (5) a venue-type fairness regularizer that minimizes the maximum inter-venue false positive rate gap across heterogeneous deployment sites. Extensive experiments on three public benchmarks — CSE-CIC-IDS2018, TON_IoT, and UNSW-NB15 — against four 2025 state-of-the-art baselines demonstrate that ST-FedXIDS achieves 98.21%–99.13% accuracy, outperforming all competitors by 0.9–2.4 percentage points, reduces the inter-venue FPR gap from 8.5–12.3% to 2.1%, and recovers from concept drift in 8 federation rounds versus 19–25 rounds for competing methods. An ablation study validates the independent contribution of each component.

References

[1] Al Tfaily, M. et al. "Graph-based federated learning approach for intrusion detection in IoT networks." Scientific Reports, 2025. DOI: 10.1038/s41598-025-25175-1

[2] Wang, Y., Li, J., Han, Z. et al. "FedSTGCN: a novel federated spatiotemporal graph learning-based network intrusion detection method for the Internet of Things." Frontiers of IT & EE, 26, 1164–1179, 2025.

[3] Mansour Bahar, A.A. et al. "FedHE-Graph: federated learning with hybrid encryption on GNN for APT detection." Proc. ARES 2024.

[4] Wei, X. et al. "xNIDS: Explaining Deep Learning-based Network Intrusion Detection Systems for Active Intrusion Responses." USENIX Security 2023.

[5] Baahmed, B. et al. "E-GNNExplainer: Toward Explainable Graph Neural Network for Network Intrusion Detection." ECML-PKDD 2023.

[6] Yang, Y. et al. "ReCDA: Concept Drift Adaptation with Representation Enhancement for Network Intrusion Detection." KDD 2024.

[7] Andresini, G. et al. "INSOMNIA: towards concept-drift robustness in network intrusion detection." Proc. AISec 2021.

[8] Ezzeldin, Y.H. et al. "FairFed: Enabling Group Fairness in Federated Learning." AAAI 2023.

[9] Li, T. et al. "Fair Resource Allocation in Federated Learning." ICLR 2020.

[10] Lavaur, L. et al. "The Evolution of Federated Learning-based Intrusion Detection and Mitigation: A Survey." IEEE TNSM, 2022.

[11] Campos, J. et al. "Federated Learning for Intrusion Detection Systems: A Systematic Review." ACM Computing Surveys, 2025.

[12] Adewole, K.S. et al. "Securing Federated Learning with IDS: A Comprehensive Review." AI Review, 2024.

[13] Wu, J. et al. "FedGAT: Federated learning for network attack detection using attention-based GNNs." Scientific Reports, 2024.

[14] Mao, Q. et al. "FeCoGraph: Label-Aware Federated Graph Contrastive Learning for Few-Shot NIDS." IEEE TIFS, 20, 2266–2280, 2025.

[15] Lo, W.W. et al. "E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT." IEEE/IFIP NOMS 2022.

[16] Duan, G. et al. "Application of a Dynamic Line Graph Neural Network for Intrusion Detection with Semisupervised Learning." IEEE TIFS, 18, 699–714, 2023.

[17] Caville, E. et al. "Anomal-E: A Self-Supervised Network Intrusion Detection System based on Graph Neural Networks." Knowledge-Based Systems, 2022.

[18] Wu, C. et al. "TCG-IDS: Robust Network Intrusion Detection via Temporal Contrastive Graph Learning." IEEE TIFS, 20, 1475–1486, 2025.

[19] Bilot, T. et al. "Graph Neural Networks for Intrusion Detection: A Survey." IEEE Access, 2023.

[20] Zhong, Y. et al. "A comprehensive survey on GNN-based network intrusion detection." Computers & Security, 2024.

[21] Arreche, O. et al. "XAI-IDS: Toward Proposing an Explainable AI Framework for Enhancing Intrusion Detection." Applied Sciences, 2024.

[22] Andresini, G. et al. "ROULETTE: A Neural Attention Multi-Class Model for Explainable Network Intrusion Detection." Expert Systems with Applications, 2022.

[23] Shyaa, M.A. et al. "Explainable AI for network intrusion detection: A comprehensive review." Frontiers AI, 2025.

[24] Bifet, A., Gavalda, R. "Learning from Time-Changing Data with Adaptive Windowing." SIAM SDM 2007.

[25] Alqahtani, H. "Adaptive ADWIN-based intrusion detection in SDN environments." 2024.

[26] Yang, Y. et al. "ReCDA: Self-supervised representation enhancement for concept drift adaptation in IDS." KDD 2024.

[27] Andresini, G. et al. "Insomnia: Towards concept-drift robustness in network intrusion detection." AISec 2021.

[28] Mohri, M. et al. "Agnostic Federated Learning." ICML 2019.

[29] Sharafaldin, I. et al. "Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization." ICISSP 2018.

[30] Alsaedi, A. et al. "TON_IoT Telemetry Dataset: A New Generation Dataset of IoT and IIoT for Data-Driven Intrusion Detection Systems." IEEE Access, 2020.

[31] Moustafa, N., Slay, J. "UNSW-NB15: a comprehensive dataset for network intrusion detection systems." MilCIS 2015.