Design and Evaluation of a Three-Tier Hybrid Cloud-Edge-AI Intrusion Detection and Response Framework for Mobile and IP Networks

Networks carrying mobile traffic face three demands that pull against each other. Finding new attacks needs statistical models rich enough to describe normal behaviour, yet such models run poorly on battery powered devices. Cutting false alarms needs longer observation, yet fast containment needs a quick decision. Learning from traffic at many sites needs that traffic pooled, yet privacy rules forbid pooling. Most published work meets one demand at a time. This paper presents HIDRF, which spreads detection and response across three tiers so each tier can take a different position on the same trade off. Device agents send only flow metadata, never packet contents. At the edge, a C4.5 signature module and a Naive Bayes anomaly module run side by side, a Meta-AdaBoostM1 combiner merges their outputs, and its confidence score decides whether a flow triggers an immediate response, goes to the cloud, or is only logged.
The same score selects the response action, so detection and response are one mechanism. Federated learning, simulated with ten edge nodes on one machine, spreads what each node learns into a shared model while data stays where it was collected. On UNSW-NB15 the hybrid edge engine reached 90.25 per cent accuracy at a false alarm rate of 1.1 per cent, below both of its own modules at 8.4 and 2.1 per cent, and the full framework reached 95.0 per cent. Edge processing used 34.6 per cent of a Raspberry Pi 3 Model B+ and finished in under 0.9 seconds from flow record arrival to response. Under deliberate evasion, edge detection fell to 57.3 per cent and cloud escalation recovered it to 81.9 per cent. The contribution is the architecture and its measured breakdown, not any single mechanism. All results come from one 2015 benchmark and are an upper bound rather than expected field performance.

intrusion detection, intrusion response, edge computing, federated learning, hybrid detection, mobile IP, UNSW-NB15

1. Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016). Deep learning with differential privacy. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, 308–318. [Google Scholar] [Crossref]

2. Abdulhammed, R., Faezipour, M., Abuzneid, A., & AbuMallouh, A. (2019). Deep and machine learning approaches for anomaly-based intrusion detection of imbalanced network traffic. IEEE Sensors Letters, 3(1), 1–4. [Google Scholar] [Crossref]

3. Anoh, N. G., et al. (2024). IoT intrusion detection system based on machine learning algorithms using the UNSW-NB15 dataset. International Journal of Advanced Science and Research Engineering, 10(1). [Google Scholar] [Crossref]

4. Bhatti, S. N., & Crowcroft, J. (2013). Mobile IP: Security and vulnerabilities. Computer Networks, 57(3), 745–760. [Google Scholar] [Crossref]

5. Bonawitz, K., et al. (2019). Towards federated learning at scale: System design. Proceedings of Machine Learning and Systems (MLSys), 1, 374–388. [Google Scholar] [Crossref]

6. Chawla, A., Lee, B., Fallon, S., & Jacob, P. (2023). Host based intrusion detection system with combined CNN/RNN model. Journal of Network and Computer Applications, 210, 103–118. [Google Scholar] [Crossref]

7. Denning, D. E. (1987). An intrusion-detection model. IEEE Transactions on Software Engineering, SE-13(2), 222–232. [Google Scholar] [Crossref]

8. Freund, Y., & Schapire, R. E. (1997). A decision-theoretic generalization of on-line learning and an application to boosting. Journal of Computer and System Sciences, 55(1), 119–139. [Google Scholar] [Crossref]

9. Hindy, H., Brosset, D., Bayne, E., Seeam, A., Tachtatzis, C., Atkinson, R., & Bellekens, X. (2020). A taxonomy of network threats and the effect of current datasets on intrusion detection systems. IEEE Access, 8, 104650–104675. [Google Scholar] [Crossref]

10. Hochreiter, S., & Schmidhuber, J. (1997). Long short-term memory. Neural Computation, 9(8), 1735–1780. [Google Scholar] [Crossref]

11. Jouhari, M., Benaddi, H., & Ibrahimi, K. (2024). Efficient intrusion detection: Combining chi-square feature selection with CNN-BiLSTM on the UNSW-NB15 dataset. IEEE Access, 12. [Google Scholar] [Crossref]

12. McMahan, B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. (2017). Communication-efficient learning of deep networks from decentralized data. Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, 54, 1273–1282. [Google Scholar] [Crossref]

13. More, S., Idrissi, M., Mahmoud, H., & Asyhari, A. T. (2024). Enhanced intrusion detection systems performance with UNSW-NB15 data analysis. Algorithms, 17(2), 64. [Google Scholar] [Crossref]

14. Moustafa, N., & Slay, J. (2015). UNSW-NB15: A comprehensive data set for network intrusion detection systems. Proceedings of the Military Communications and Information Systems Conference (MilCIS), 1–6. [Google Scholar] [Crossref]

15. Ola, S., Bhavani, R., & Kumar, S. (2025). Enhanced multiclass intrusion detection using deep convolutional neural networks on UNSW-NB15. Scientific Reports, 15. [Google Scholar] [Crossref]

16. Ou, Y.-J., & Ou, Y. (2012). Host-based intrusion detection systems adapted from agent-based artificial immune systems. Neurocomputing, 88, 78–86. [Google Scholar] [Crossref]

17. Park, S., Kim, J., & Lee, H. (2024). Host-based intrusion detection model using Siamese network with few-shot learning. IEEE Access, 12. [Google Scholar] [Crossref]

18. Perkins, C. (2010). IP mobility support for IPv4, revised (RFC 5944). Internet Engineering Task Force. [Google Scholar] [Crossref]

19. Roesch, M. (1999). Snort: Lightweight intrusion detection for networks. Proceedings of the 13th USENIX Conference on System Administration (LISA), 229–238. [Google Scholar] [Crossref]

20. Statista. (2024). Number of Internet of Things (IoT) connected devices worldwide from 2019 to 2030. Statista Research Department. [Google Scholar] [Crossref]

21. Wang, Y., Meng, W., Li, W., Liu, Z., Liu, Y., & Xue, H. (2020). Security and privacy in mobile edge computing: An artificial intelligence perspective. IEEE Internet of Things Journal, 7(10), 9663–9680. [Google Scholar] [Crossref]

22. Weiss, M., Ferrag, M. A., & Maglaras, L. (2021). Intrusion detection in the era of edge computing: A survey. IEEE Access, 9. [Google Scholar] [Crossref]

• What the Desert Fathers Teach Data Scientists: Ancient Ascetic Principles for Ethical Machine-Learning Practice
• Comparative Analysis of Some Machine Learning Algorithms for the Classification of Ransomware
• Comparative Performance Analysis of Some Priority Queue Variants in Dijkstra’s Algorithm
• Transfer Learning in Detecting E-Assessment Malpractice from a Proctored Video Recordings.
• Dual-Modal Detection of Parkinson’s Disease: A Clinical Framework and Deep Learning Approach Using NeuroParkNet