Figure 3.
The image depicts a multi-layer workflow architecture with three numbered layers: I O T Layer 1, Local Edge Node Edge Layer 2, and Global Layer Cloud Layer 3. The I O T Layer shows devices sending raw data to the Intrusion Detection Module in the Local Edge Node. In the Edge Layer, data flows through a Data Processing Engine and an Intrusion Detection Module, followed by a decision step labelled Threat or Attack. If yes, alerts are generated, mitigation actions are triggered through a Mitigation Module, and events are stored in a Logging Module. A Model Training Module updates the local edge model, and updated model weights are uploaded to the Global Layer. In the Global Layer, edge nodes are checked for reputation using Blockchain before approval for aggregation. Approved updates enter a Data Processing Engine and a Federated Averaging Fed Avg Model Aggregator. A Global Policy and Management Module coordinates decisions, while a Mitigation Module applies advanced mitigation strategies. A Generative A I Module supports smarter threat detection strategies and simulated data processing, with alerts generated and actions logged. Arrows depict bidirectional data, control, and model update flows across all layers.Workflow for our proposing IDMS