Unmanned aerial vehicles (UAVs) have become essential cyber-physical platforms for applications such as surveillance, infrastructure inspection, emergency response, and intelligent transportation. However, their tight coupling among sensing, communication, control, actuation, and swarm coordination also exposes them to sophisticated cyber-physical attacks that are difficult to detect using conventional intrusion detection systems. Existing machine learning, deep learning, graph-based, and federated intrusion detection approaches generally rely on statistical feature representations or temporal patterns, providing limited capability to model causal dependencies among interacting UAV subsystems and to generalize across heterogeneous operating environments. To address these limitations, this paper proposes Fed-CGIDS-UAV, a federated causal graph learning framework for cross-domain intrusion detection in cyber-physical UAV networks. The proposed framework models each telemetry window as a typed causal graph in which nodes represent navigation, sensing, communication, control, actuation, and swarm states, while directed edges capture stable operational dependencies. Intrusions are detected by identifying violations of these learned causal relationships, and the framework provides interpretable node-edge explanations to support root-cause analysis. Furthermore, federated learning enables collaborative model training across distributed UAV clients without sharing raw telemetry, thereby preserving data privacy while improving robustness under heterogeneous operating conditions. The proposed framework was implemented and experimentally evaluated in a controlled simulation environment covering four UAV operating domains and six representative attack classes. All experiments were repeated over five independent runs using different random seeds, and the reported results correspond to the measured average performance. The proposed framework was implemented using Python 3.12 (Python Software Foundation, Wilmington, DE, USA) and PyTorch 2.3 (Meta Platforms, Menlo Park, CA, USA). UAV flight data were generated using Microsoft AirSim 1.9.1 (Microsoft Corporation, Redmond, WA, USA), integrated with PX4 Autopilot v1.14 (Dronecode Foundation, San Francisco, CA, USA) and Gazebo Sim 11 (Open Source Robotics Foundation, Mountain View, CA, USA). Within this simulation-based evaluation, Fed-CGIDS-UAV achieved an accuracy of 0.968, an F1-score of 0.956, and an internal–external stability gap (IESG) of 0.028, outperforming conventional machine learning, deep learning, graph-based, and centralized causal baselines while maintaining competitive computational latency. Although these results demonstrate the effectiveness of the proposed framework under controlled simulation conditions, validation using real-flight UAV telemetry remains an important direction for future research. These results demonstrate that integrating causal graph learning with federated optimization provides an effective and interpretable solution for privacy-preserving intrusion detection in heterogeneous cyber-physical UAV environments.

Effective intrusion detection for Internet of Things (IoT) environments requires balancing predictive performance, resource efficiency, and interpretability—particularly in real-world deployments where traffic distributions and attack scenarios vary. While many studies report near-perfect detection on benchmark datasets, this often overlooks model stability under distribution shifts. This paper addresses this gap by introducing a stability-focused evaluation of lightweight, explainable intrusion detection models using compact IoT-23 scenarios and a constrained set of 14 connection-level features for interpretability. Four lightweight models—logistic regression, random forest, XGBoost, and LightGBM—are assessed within a unified pipeline. Beyond standard internal validation, we implement a strict cross-scenario evaluation framework featuring a fully unseen malware capture. Our proposed Internal–External Stability Gap (IESG) framework, enhanced with normalized and multi-metric measures, highlights the degradation in consistency between internal and external metrics. Surprisingly, even models with high internal F1 scores (up to 0.9994) may experience considerable drops in external macro-F1 and specificity, exposing weaknesses in conventional evaluation. Experimentally, LightGBM provides the best trade-off between performance and compactness (606 KB) and shows the smallest stability gap for malicious detection. Nevertheless, all models show reduced balanced performance under scenario shift, underscoring that deployment readiness hinges on stability under changing conditions. Feature ablation reveals that leveraging high-impact features, such as port information, can boost internal accuracy at the expense of generalization. In summary, we demonstrate that while lightweight models deliver strong detection, only those proven stable across scenarios are viable for real-world IoT intrusion detection. Our evaluation framework offers a practical, interpretable tool for assessing model robustness.

Digital participation in higher education increasingly depends on flexible short-format learning designs that support engagement under varied access conditions. This study examines Moodle-supported microlearning through an extended Information Systems Success (IS-Success) framework and treats sustainable digital participation as an interpretive lens rather than a directly measured construct. The model analyzes how system quality, information quality, service quality, privacy and ethics, training readiness, engagement, and barriers/access relate to satisfaction, usage intention, and perceived learning outcomes. Data were collected through a bilingual Arabic–English questionnaire from 219 undergraduate students at the University of Kassala, Sudan, and analyzed using partial least squares structural equation modeling (PLS-SEM). The findings show that system quality, information quality, service quality, and privacy and ethics were positively associated with satisfaction. Satisfaction, training readiness, and engagement positively predicted usage intention, whereas barriers/access negatively predicted usage intention. Satisfaction and usage intention were positively associated with perceived learning outcomes. The model showed acceptable explanatory and predictive power. The findings suggest that perceived microlearning success depends on platform quality, ethical confidence, learner readiness, engagement, and access conditions. The results should be interpreted as perception-based associations rather than evidence of causal effects, objective academic performance, or long-term educational sustainability.