ST-Fedxids: A Spatiotemporal Federated Explainable Intrusion Detection System With Drift-Adaptive Graph Learning For High-Density Public Wifi Environments

Public WiFi networks deployed across high-density transit environments — such as train stations, bus terminals, and airports — present a largely unaddressed frontier in network intrusion detection research. These venues collectively serve tens of millions of users monthly yet exhibit extreme traffic heterogeneity, continuous attack pattern drift, and strict data privacy constraints that preclude centralized detection paradigms. Existing federated learning-based intrusion detection systems (FL-IDS) fail to simultaneously address the spatiotemporal dynamics of evolving network topologies, the interpretability requirements of operational security teams, the concept drift inherent to live deployments, and the fairness disparities that arise across heterogeneous venue types. We propose ST-FedXIDS, a Spatiotemporal Federated Explainable Intrusion Detection System that unifies five technical contributions: (1) a heterogeneous dynamic graph construction pipeline that models multi-protocol WiFi traffic as sliding temporal-window graphs; (2) ST-GraphSAGE with multi-head temporal self-attention, replacing the LSTM/GRU paradigm used in all prior spatiotemporal GNN-IDS works; (3) Drift-Adaptive Federated Averaging (DA-FedAvg) that embeds ADWIN-based graph embedding drift detection directly into the federated aggregation protocol; (4) a GNN-Explainer module that produces subgraph-level attack attribution explanations for operational incident response; and (5) a venue-type fairness regularizer that minimizes the maximum inter-venue false positive rate gap across heterogeneous deployment sites. Extensive experiments on three public benchmarks — CSE-CIC-IDS2018, TON_IoT, and UNSW-NB15 — against four 2025 state-of-the-art baselines demonstrate that ST-FedXIDS achieves 98.21%–99.13% accuracy, outperforming all competitors by 0.9–2.4 percentage points, reduces the inter-venue FPR gap from 8.5–12.3% to 2.1%, and recovers from concept drift in 8 federation rounds versus 19–25 rounds for competing methods. An ablation study validates the independent contribution of each component.