The significant growth in modern communication technologies has led to an increase in zero-day vulnerabilities that degrade the performance of industrial cyber-physical systems (ICPS). Distributed denial of service (DDoS) attacks are one such threat that overwhelms a target with floods of packets, posing a severe risk to the normal operations of the ICPS. Current solutions to detect DDoS attacks are unsuitable for resource-constrained ICPS. This study proposes actively detecting multiscale flooding DDoS attacks in resource-constrained ICPS by analyzing network traffic in the frequency domain. A two-phased technique detects attack presence and attack volume. Both phases use a novel combination of light-weight and theoretically sound statistical methods. The effectiveness of the proposed technique is evaluated using mainstream metrics like true and false positive rates, accuracy, and precision using BOUN DDoS 2020 and CICDDoS 2019 datasets. An implementation of the proposed approach on a programmable logic controllers-based ICPS demonstrated improvements in resource usage and detection time compared to the existing state-of-the-art.

The exponential growth of connected devices, including sensors, mobile equipment, and various Internet of Things (IoT) nodes, has significantly increased the volume of data generated at the edge. Traditionally, data analysis tasks are offloaded to centralized cloud servers, resulting in increased latency, bandwidth bottlenecks and privacy concerns. While edge computing addresses these limitations by enabling local processing, it also faces challenges related to limited computational capacity and isolated decision-making. In this context, Multi-Agent Systems provide a promising solution by enabling collaboration among edge nodes for distributed machine learning-based intrusion detection. This work extends previous research by introducing a hierarchical approach within the edge-cloud continuum, where agents deployed in the cloud continuously monitor edge-level behaviour and employ reinforcement learning techniques to suggest dynamic updates to decision parameters of edge agents. This feedback-driven mechanism allows agents to adapt their behaviour over time, improving detection accuracy and collaboration efficiency while keeping communication overhead under control. The proposed architecture balances decentralisation and adaptability, offering a scalable and privacy-preserving solution for intrusion detection in dynamic and resource-constrained IoT environments.