Federated Continual Learning with Digital Twins for Adaptive Industrial Intrusion Detection: A Simulated Edge-Security Study

This empirical-style article presents a clearly labeled simulated study in Computer Science and Engineering. A simulated industrial-IoT environment with six edge sites was generated using normal telemetry and four attack families: distributed denial-of-service, scanning, command injection, and lateral movement. Each site maintained a lightweight digital twin and trained a local intrusion model. Federated aggregation occurred every six hours, while continual-learning updates were triggered by distribution-shift indicators. No real industrial network or organization was used. The simulated federated continual-learning digital-twin approach achieved a macro-F1 of 0.94 after drift, compared with 0.82 for a static federated model. Catastrophic forgetting was reduced, and local adaptation improved detection of newly introduced command-injection behavior while preserving performance on earlier attack classes. The numerical observations, assignments, and measured outcomes are synthetic and intended for methodological illustration only. No real industrial facility, enterprise network, laboratory, construction project, or manufactured component was used. The study demonstrates a realistic research framework aligned with current 2026 research directions while clearly separating simulated evidence from verified literature.