Autonomous federated defense for zero-day threats in IIoT: explainable agents with real-time edge inference

The growing interconnection of industrial devices in IIoT networks has significantly increased the exposure of critical infrastructures to sophisticated cyberattacks, including 0-day threats, sensor spoofing, and lateral propagation. Conventional intrusion detection systems, based on static rules or supervised learning, often fail to generalize to unknown patterns and lack adaptability in decentralized edge environments. Moreover, most AI-based approaches do not offer real-time interpretability, hindering their deployment in regulated and auditable industrial contexts. This work proposes an autonomous and distributed defense system for IIoT networks based on Deep Deterministic Policy Gradient agents deployed at the edge, coordinated through asynchronous federated learning. Each agent performs local inference using real-time extracted traffic features, such as entropy, command frequency, and inter-packet time, and integrates an embedded SHAP-based XAI module for real-time explainability. The model is trained in an open-world setting, excluding entire attack classes during training to simulate realistic 0-day conditions. Experimental validation using the TONIoT and N-BaIoT datasets demonstrates that the system maintains a detection F1-score of 92. 0%, a false positive rate of 4. 1%, and an inference latency of 182 m under multi-node attack conditions. The federated architecture ensures robustness and model continuity even with unstable node participation, while the embedded interpretability mechanism enables on-site auditability and decision traceability.