A Cloud-Driven Support Layer for Enhancing Distributed IDS in IoT Networks

Abstract The exponential growth of connected devices, including sensors, mobile equipment, and various Internet of Things (IoT) nodes, has significantly increased the volume of data generated at the edge. Traditionally, data analysis tasks are offloaded to centralized cloud servers, resulting in increased latency, bandwidth bottlenecks and privacy concerns. While edge computing addresses these limitations by enabling local processing, it also faces challenges related to limited computational capacity and isolated decision-making. In this context, Multi-Agent Systems provide a promising solution by enabling collaboration among edge nodes for distributed machine learning-based intrusion detection. This work extends previous research by introducing a hierarchical approach within the edge-cloud continuum, where agents deployed in the cloud continuously monitor edge-level behaviour and employ reinforcement learning techniques to suggest dynamic updates to decision parameters of edge agents. This feedback-driven mechanism allows agents to adapt their behaviour over time, improving detection accuracy and collaboration efficiency while keeping communication overhead under control. The proposed architecture balances decentralisation and adaptability, offering a scalable and privacy-preserving solution for intrusion detection in dynamic and resource-constrained IoT environments.