EXPLAINABLE FEDERATED ARTIFICIAL INTELLIGENCE FOR ZERO-DAY CYBERATTACK DETECTION IN PAKISTAN'S CRITICAL DIGITAL INFRASTRUCTURE

Abstract

The increasing sophistication of cyberattacks poses significant risks to Pakistan's critical digital infrastructure, while conventional intrusion detection systems face limitations in zero-day detection, data centralization, and interpretability. This study evaluates an Explainable Federated Artificial Intelligence (XAI-FL) framework for privacy-preserving zero-day cyberattack detection across distributed critical-infrastructure environments. A quantitative experimental design was used with cybersecurity network-flow data distributed among simulated organizational clients. XAI-FL was compared with centralized artificial intelligence and conventional federated learning using accuracy, precision, recall, F1-score, AUROC, false-positive rate, and false-negative rate. Additional experiments examined zero-day detection, non-IID data heterogeneity, explainability, and malicious client participation. XAI-FL achieved superior overall performance and stronger generalization to unseen attacks while providing feature-level explanations. Performance declined as data heterogeneity increased, whereas robust aggregation reduced the effect of malicious client updates. The findings suggest that integrating XAI with federated learning provides a promising foundation for privacy-aware, interpretable, and collaborative zero-day detection. However, real-world validation using Pakistani critical-infrastructure data is required.