💻 computer science

An Explainable Federated Framework for Zero Trust Micro-Segmentation in IIoT Networks

This paper proposes EFAH-ZTM, an explainable federated framework that leverages autoencoders and hypergraph modeling to dynamically generate secure, interpretable micro-segments for Zero Trust Industrial Internet of Things networks while preserving data privacy.

Original authors: Muhammad Liman Gambo, Ahmad Almulhem

Published 2026-03-27

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Muhammad Liman Gambo, Ahmad Almulhem

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a massive, bustling factory floor filled with thousands of different machines: robotic arms, temperature sensors, conveyor belts, and security cameras. In the old days, security was like putting a single giant lock on the front door of the factory. Once a thief got in, they could walk anywhere, steal anything, and break anything because the inside was considered "safe."

This paper proposes a new way to secure these "Industrial Internet of Things" (IIoT) factories. It's called EFAH-ZTM, and it's like turning that one big factory into a high-tech, self-guarding city with strict neighborhoods and smart, honest security guards.

Here is the breakdown of how it works, using simple analogies:

1. The Problem: The "Flat" Factory

In traditional factories, if a hacker hacks one small sensor, they can often move sideways to control the whole assembly line. This is called "lateral movement." Also, factories are often run by different companies or in different locations, and they don't want to share their secret recipe data (raw data) with each other just to get security advice.

2. The Solution: Micro-Segmentation (The Neighborhoods)

Instead of one big open floor, this system divides the factory into tiny, isolated micro-segments (neighborhoods).

The Analogy: Imagine the factory is a city. Instead of one big wall around the whole city, you have fences around every single house and block. If a burglar breaks into the "Robot Arm Neighborhood," they are stuck there. They can't jump the fence to the "Temperature Sensor Neighborhood."
Zero Trust: The system operates on the rule: "Never trust, always verify." Even if you are inside a neighborhood, you still need a badge to move around.

3. The Secret Sauce: How It Learns Without Sharing Secrets (Federated Learning)

Usually, to teach a security AI what "normal" looks like, you have to send all the factory data to a central brain. But factories hate sharing their private data.

The Analogy: Imagine 10 different factory managers. Instead of sending their secret ledgers to a central office, they each hire a local tutor (a small AI) to learn what's normal in their specific factory.
The Magic: These local tutors meet in a virtual "study hall" (Federated Learning) and share only their lessons learned (math updates), not their actual ledgers. They combine these lessons to create one super-smart "Global Tutor" that knows what normal behavior looks like everywhere, without anyone ever seeing the private data.

4. Seeing the Invisible Connections (Hypergraphs)

Machines talk to each other in complex groups, not just one-on-one. A sensor might talk to a controller, which talks to a valve, all at the same time.

The Analogy: A normal map shows roads connecting two cities. A Hypergraph is like a map that shows a "group bus" that picks up five different people at once and drops them off together. It understands that these specific machines always work together as a team.
By mapping these group behaviors, the system can spot if a machine is suddenly trying to talk to a group it doesn't belong to.

5. The "Risk Score" (The Security Guard's Gut Feeling)

The system doesn't just say "Yes" or "No." It calculates a Risk Score for every interaction.

The Analogy: Imagine a security guard at a club.
- Reconstruction Error: If a machine tries to act like it's doing its job, but the math says it's "faking it" (the AI can't predict its behavior), the risk score goes up.
- Structural Outlierness: If a machine is hanging out in a neighborhood where it doesn't fit the vibe, the risk score goes up.
The Decision: If the risk score is low, the guard says "Allow." If it's high, the guard says "Block."

6. The "Why" (Explainable AI)

Old security systems are "black boxes." They block you, but they won't tell you why. This is frustrating for factory managers.

The Analogy: This system is like a police officer who, instead of just arresting you, hands you a printed report saying: "I stopped you because you were trying to access the server using a protocol you've never used before, and your data packet size was 50% larger than usual."
It uses tools called LIME and SHAP to translate the AI's complex math into plain English reasons, so humans can trust the decision.

7. The Results

The researchers tested this on a massive dataset of factory traffic.

The Outcome: It created tiny, perfect neighborhoods. It was incredibly good at separating "good guys" (normal machines) from "bad guys" (hackers).
The Surprise: Even though it learned in a decentralized way (without sharing data), it was just as good as if they had shared all the data in one big pile. Plus, it was much faster at spotting complex group behaviors than older methods.

Summary

EFAH-ZTM is a smart, privacy-friendly security system for industrial factories. It builds invisible, tiny walls around every machine, learns what "normal" looks like without stealing private data, understands how machines work in teams, and gives human managers a clear, written explanation for why it blocked a specific action. It's like upgrading from a rusty padlock to a smart, self-driving security force.

1. Problem Statement

Industrial Internet of Things (IIoT) networks face significant security challenges due to their heterogeneous device populations, evolving communication behaviors, and the critical need for data privacy. Traditional network segmentation methods (e.g., VLANs, firewalls) are often static, lack behavioral insight, and struggle to adapt to dynamic environments. Furthermore, existing machine learning-based micro-segmentation approaches often suffer from three major limitations:

Centralization: They require aggregating raw data from distributed sites, which violates privacy regulations and is impractical for industries like healthcare and manufacturing.
Lack of Explainability: Decisions are made by "black-box" models, making it difficult for security teams to audit or trust policy decisions (e.g., why a specific flow was blocked).
Inadequate Modeling: Standard graph models fail to capture complex, higher-order relationships (multi-device interactions) common in cyber-physical systems.

The paper addresses the need for a Zero Trust Architecture (ZTA) framework that is federated (privacy-preserving), explainable (transparent decision-making), and capable of modeling higher-order relationships for dynamic micro-segmentation.

2. Methodology: The EFAH-ZTM Framework

The authors propose EFAH-ZTM (Explainable Federated Autoencoder-Hypergraph for Zero Trust Micro-segmentation), a multi-stage workflow:

A. Federated Representation Learning

Architecture: A Deep Non-Symmetric Autoencoder (DNAE) is used to learn low-dimensional behavioral embeddings of network flows.
Federated Learning (FL): Instead of centralizing data, the DNAE is trained using FedAvg across $K=10$ distributed clients (simulating industrial sites). Each client trains locally on its own data, and only model weights are aggregated. This ensures raw data privacy.
Input: The model processes preprocessed network flow features (packet/flow-level behaviors) to generate latent embeddings ( $Z$ ).

B. Decentralized Hypergraph Construction

To capture complex, multi-way relationships (e.g., coordinated sensor-controller loops) that standard graphs miss, the framework constructs hypergraphs:

Local Generation: Hyperedges are formed locally at each client based on the latent embeddings.
Two Modes:
1. kNN-based: Connects a node to its $k$ -nearest neighbors to capture local continuity.
2. Manifold-based: Uses diffusion affinities (heat-kernel similarity) to capture non-linear, global structural relationships.
Spectral Embedding: The global hypergraph is represented by an incidence matrix, from which a Zhou Normalized Hypergraph Laplacian is computed. Spectral embedding (via LOBPCG solver) transforms this structure into a Euclidean feature space ( $X_{emb}$ ) suitable for clustering.

C. Micro-Segmentation and Clustering

Two clustering algorithms are applied to the spectral embeddings to define micro-segments:

MiniBatch KMeans: For fixed, globular clusters.
HDBSCAN: A density-based algorithm capable of identifying arbitrary shapes and labeling noise/outliers (crucial for Zero Trust).

D. Operational Risk Scoring & Policy Generation

A dynamic policy is generated based on an Operational Risk Score ( $r(x_i)$ ) for each flow, calculated as a weighted sum of:

Reconstruction Error: Deviation from learned normal behavior (from the DNAE).
Structural Outlierness: Distance from the cluster centroid or noise score (from HDBSCAN).

Intra-segment Policy: Communication is allowed only if the cluster's aggregated risk score is below a threshold ( $\tau_c$ ), determined via Otsu's method or percentiles.
Inter-segment Policy: Default Deny (Zero Trust principle).

E. Explainable AI (XAI)

To ensure trust, the framework integrates LIME and SHAP:

A Surrogate Classifier (kNN) is trained on the spectral embeddings to approximate the clustering boundary.
XAI techniques generate feature-level explanations, mapping spectral importance back to original network attributes (e.g., protocol, duration, port). This provides auditable justifications for Allow/Block decisions.

3. Key Contributions

EFAH-ZTM Framework: A novel end-to-end framework integrating federated learning, hypergraph modeling, and explainable AI for IIoT micro-segmentation.
Privacy-Preserving Learning: Implementation of FedAvg with a DNAE allows for behavioral learning without sharing sensitive raw industrial data across sites.
Higher-Order Modeling: Introduction of both kNN and Manifold-based hypergraphs to capture complex, non-linear device interactions that traditional graphs miss.
Risk-Aware Policy: A dynamic policy generation mechanism driven by a composite operational risk score, enabling granular allow/block decisions rather than static rules.
Explainability: Integration of LIME and SHAP to provide transparent, feature-level justifications for security policies, addressing the "black-box" limitation of ML-based security.

4. Experimental Results

The framework was evaluated on the WUSTL-IIoT-2021 dataset (1.19M samples, 49 features) with 10 simulated clients.

Structural Quality:
- HDBSCAN outperformed MiniBatch KMeans in structural separation (Silhouette Score: ~0.67 vs. ~0.56; DBI: ~0.41 vs. ~0.94).
- Manifold-based hypergraphs produced the best security efficacy, achieving a purity of 0.9990 with near-zero contamination.
Security Efficacy (Oracle Evaluation):
- The Manifold-based HDBSCAN configuration achieved 0.9990 purity and 0.00 contamination (Attack $\to$ Benign), meaning malicious flows were almost perfectly isolated from benign traffic.
- Ablation Studies:
  - Removing Federated Learning (Centralized training) showed competitive results but highlighted that FL preserves quality while ensuring privacy.
  - Removing Hypergraphs significantly degraded structural quality (Silhouette dropped to ~0.33 for KMeans), proving the necessity of higher-order modeling.
Explainability:
- The surrogate classifier achieved 99.27% accuracy.
- SHAP explanations were deterministic (stability 1.0), and LIME showed high stability (0.96), ensuring consistent justifications for policy decisions.
Computation: Federated DNAE training took ~~6908s, while hypergraph construction and clustering were significantly faster (~~150s and ~60s respectively).

5. Significance and Conclusion

This paper presents a significant advancement in IIoT security by bridging the gap between Zero Trust principles, distributed privacy, and operational transparency.

Practical Impact: It offers a solution for industries where data cannot leave the premises (privacy) but where security policies must be dynamic and auditable (trust).
Technical Innovation: The combination of Hypergraph spectral embedding with Federated Autoencoders effectively models complex IIoT behaviors that standard clustering misses.
Operational Value: By providing XAI-driven justifications, the framework transforms micro-segmentation from an opaque automation tool into a transparent, auditable security control, facilitating adoption in critical infrastructure.

The authors conclude that while the framework is robust, future work should focus on validating against live industrial testbeds, incorporating temporal dynamics, and enhancing defenses against adversarial attacks on the federated learning process itself.