Cyber-Security in Cyber-Physical Systems and Critical Infrastructure: A Self-Healing Federated Learning Intrusion Detection Framework

Abstract

Cyber-Physical Systems (CPS) underpin critical infrastructures such as power grids, water treatment facilities, and transportation systems. Their increasing connectivity, combined with legacy physical components and modern digital interfaces, expands the attack surface and exposes CPS to sophisticated cyber threats. The resulting heterogeneous, latency-sensitive environments challenge conventional security mechanisms, while centralized Intrusion Detection Systems (IDS) introduce privacy risks and fail to meet real-time operational constraints. To address these challenges, this paper proposes a hybrid framework that integrates Federated Learning (FL) with a Lightweight Intrusion Detection System (LIDS), augmented by Model-Agnostic Meta-Learning (MAML) and a self-healing feedback loop. Edge-based LSTM anomaly detectors are collaboratively trained using FedAvg to preserve data locality and privacy, meta-learning enables rapid adaptation to zero-day attacks, and the self-healing mechanism supports automated rollback, isolation of compromised clients, retraining, and feedback-driven threshold adjustment. We further present a practical deployment blueprint for production CPS environments, leveraging edge gateways with MQTT telemetry, Flower for FL orchestration, KubeEdge or AWS IoT Greengrass for edge management, and secure aggregation protocols, along with an analysis of communication overhead and mitigation strategies. The framework is evaluated on the ICS-AD and SWaT datasets, as well as a synthetic digital twin environment. Data preprocessing includes min–max normalization, 50-timestep sliding windows, and SMOTE-based class balancing. Experiments simulate 50 non-IID federated clients over 100 rounds with a two-layer LSTM architecture (128 and 64 units, dropout 0.3), trained using Adam. Results demonstrate strong detection performance (mean F1-score ≈ 92.4% ± 1.2) and low detection latency (≈ 1.2 s ± 0.1), with improved resilience to zero-day attacks compared to centralized baselines, albeit with increased communication overhead. Key limitations include federated communication cost, model drift, and deployment complexity. This work contributes an integrated self-healing federated IDS framework with meta-learning, designed for privacy-preserving, adaptive, and practical CPS security deployment.