Collaborative Intrusion Detection Systems (CIDS) are increasingly adopted to counter cyberattacks, as their collaborative nature enables them to adapt to diverse scenarios across heterogeneous environments. As distributed critical infrastructure operates in rapidly evolving environments, such as drones in both civil and military domains, there is a growing need for CIDS architectures that can flexibly accommodate these dynamic changes. In this study, we propose a novel CIDS framework designed for easy deployment across diverse distributed environments. The framework dynamically optimizes detector allocation per node based on available resources and data types, enabling rapid adaptation to new operational scenarios with minimal computational overhead. We first conducted a comprehensive literature review to identify key characteristics of existing CIDS architectures. Based on these insights and real-world use cases, we developed our CIDS framework, which we evaluated using several distributed datasets that feature different attack chains and network topologies. Notably, we introduce a public dataset based on a realistic cyberattack targeting a ground drone aimed at sabotaging critical infrastructure. Experimental results demonstrate that the proposed CIDS framework can achieve adaptive, efficient intrusion detection in distributed settings, automatically reconfiguring detectors to maintain an optimal configuration, without requiring heavy computation, since all experiments were conducted on edge devices.

翻译：协作式入侵检测系统（CIDS）因其协作特性能够适应异构环境下的多样化场景，正日益广泛地应用于抵御网络攻击。随着分布式关键基础设施（如民用和军用领域的无人机）在快速演进的环境中运行，对能够灵活适应这些动态变化的CIDS架构的需求日益增长。本研究提出了一种新型CIDS框架，其设计目标是在多样化分布式环境中实现便捷部署。该框架根据可用资源和数据类型动态优化每个节点的检测器分配，从而以最小的计算开销快速适应新的操作场景。我们首先通过全面的文献综述，梳理出现有CIDS架构的关键特征。基于这些见解和实际用例，我们开发了该CIDS框架，并利用多个具有不同攻击链和网络拓扑的分布式数据集对其进行了评估。值得注意的是，我们引入了一个基于真实网络攻击的公开数据集，该攻击以破坏关键基础设施为目标，针对地面无人机。实验结果表明，所提出的CIDS框架能够在分布式环境中实现自适应、高效的入侵检测，自动重新配置检测器以保持最优配置，且无需繁重计算（所有实验均在边缘设备上完成）。