Skip to main content An official website of the United States government Here's how you know Here's how you know Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock ( Lock Locked padlock icon ) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites. Search Log in Dashboard Publications Account settings Log out Search… Search NCBI Primary site navigation Search Logged in as: Dashboard Publications Account settings Log in Search PMC Full-Text Archive Search in PMC Journal List User Guide PERMALINK Copy As a library, NLM provides access to scientific literature. Inclusion in an NLM database does not imply endorsement of, or agreement with, the contents by NLM or the National Institutes of Health. Learn more: PMC Disclaimer | PMC Copyright Notice Sci Rep . 2026 Mar 30;16:10603. doi: 10.1038/s41598-026-44260-7 Search in PMC Search in PubMed View in NLM Catalog Add to search A unified low-carbon cybersecurity framework integrating energy-efficient intrusion detection, lightweight cryptography, and carbon-aware scheduling for edge–cloud architectures Abdullah Alshammari Abdullah Alshammari 1 College of Computer Science and Engineering, University of Hafr Albatin, 31991 Hafar Albatin, Saudi Arabia Find articles by Abdullah Alshammari 1, ✉ Author information Article notes Copyright and License information 1 College of Computer Science and Engineering, University of Hafr Albatin, 31991 Hafar Albatin, Saudi Arabia ✉ Corresponding author. Received 2026 Jan 13; Accepted 2026 Mar 10; Collection date 2026. © The Author(s) 2026 Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/ . PMC Copyright notice PMCID: PMC13039789 PMID: 41912554 Abstract The rapid expansion of edge–cloud computing infrastructures has intensified both cybersecurity demands and the associated energy consumption and carbon footprint of intrusion detection systems (IDS). This paper presents GreenShield, a unified low-carbon cybersecurity framework that integrates energy-efficient deep learning-based intrusion detection with knowledge distillation and dynamic quantization, ASCON lightweight cryptography, hierarchical federated learning with gradient compression, and a carbon-aware scheduling engine across distributed edge–fog–cloud architectures. GreenShield employs a threat-adaptive quantization mechanism that scales model precision (4–32 bit) based on real-time threat levels and a carbon-conscious scheduling controller that dynamically aligns security workload execution with renewable energy availability forecasts. Extensive experiments on the UNSW-NB15 and CIC-IDS2017 datasets demonstrate that GreenShield achieves 98.73% detection accuracy with 67.4% energy reduction compared to conventional deep learning-based IDS, while reducing operational carbon emissions by up to 97.6% (equivalent to approximately 2.8 kg CO 2 -eq per hour savings in a typical edge deployment). The hierarchical federated learning architecture reduces communication overhead by 58.2% through Top-k gradient sparsification, and the dynamic quantization mechanism achieves 71.3% inference energy reduction during low-threat periods. These results establish GreenShield as a viable, scalable solution for sustainable cybersecurity that supports carbon-conscious security workflows in next-generation edge–cloud computing environments. Keywords: Model compression techniques, Resource-aware threat detection, Sustainable cyber defense architectures, Edge intelligence optimization, Carbon-conscious cloud infrastructure, Low-power security algorithms, Collaborative privacy-preserving learning Subject terms: Energy science and technology, Engineering, Mathematics and computing Introduction The emerging boom in edge and cloud computing systems, has indeed changed the landscape of the modern digital ecosystems, giving unexplainable connectivity and computing capabilities in many areas of implementation distinctions, including smart cities, autonomous automobiles, industrial automation and healthcare systems 1 . However, there are also certain harsh challenges that this change has initiated as the cybersecurity and the environmental sustainability nexus. The data patterns at present are consuming about 1–1.5% of total electricity in the world and there are projections that it may increase further to 8% by 2030 2 . Security operations, especially, intrusion detection systems, and cryptographic procedures take up a large part of this energy consumption, which needs new methods that would be both protection-acceptable and eco-friendly. Low-carbon intrusion detection is defined as a paradigm that minimizes greenhouse gas emissions across the IDS operational lifecycle while maintaining acceptable accuracy and latency. It encompasses three dimensions: computational carbon efficiency (energy-efficient models, adaptive precision, lightweight cryptography), communication carbon efficiency (compressed updates, hierarchical aggregation), and temporal carbon optimization (carbon-aware scheduling aligned with renewable energy availability). Unlike conventional green computing, it targets carbon footprint directly as the primary objective, recognizing that identical energy consumption yields vastly different emissions depending on grid carbon intensity (0.024–0.712 kg CO₂/kWh across regions). The ancient cybersecurity systems were not engineered to be energy efficient or to produce any carbon footprint, the emphasis was on the accuracy with which it was detected as well as the speed of its response, rather than the computational sustainability 3 . Deep learning-enabled intrusion detection systems, although proving to be more performance effective in detecting advanced attacks, generally consume a lot of computed power in to form substantial amount of energy use and carbon footprint 4 . As an example, training a common convolutional neural network on the classification of network traffic may use the energy that would be consumed by five cars throughout their lifespan 5 . This paradigm is becoming unsustainable because organizations are under increasing pressure on the pressure imposed on them by the regulatory frameworks and the stakeholder expectations coupled with real environmental issues that require the organizations to minimize their carbon footprint. Sustainable implementation of cybersecurity in edge computing environments has its own peculiarities. Edge devices with a limited amount of resources need to implement security functions with low power limits and low latency reaction to the possible threats 6 . The distributed form of edge architectures further complicates the optimization of energies since security loads have to be distributed across the heterogeneous nodes having different capacities and energy profiles 7 . Though providing higher computational flexibility, cloud environments are not easy when it comes to managing security operations between geographically distributed data centers that present different levels of renewable energy availability, and carbon intensities 8 . New opportunities have been presented by recent developments in lightweight cryptography and energy-efficient machine learning to deal with these issues 9 . The achievement of the standardization of ASCON as a NIST lightweight standard of cryptography offers a basis of executing secure implementations of energy efficient cryptographic activities on devices with resource constraints 10 . Equally, knowledge distillation, model pruning and dynamic quantization are methods to deploy the advanced neural network-based security mechanisms at a much reduced computational cost 11 . Federated learning methods have an added advantage of being collaborative to model training and do not require centralization of sensitive network traffic data hence less communication overhead and less risk of privacy 12 . Introduction of renewable energy concerns into design security systems forms a new tool to sustainable computing 13 . Carbon-conscious computing paradigms allow computing systems to dynamically set up their activities due to the carbon content of accessible electricity, planning energy-intensive duties in times of optimal renewable energy supply 14 . When implementing these principles to cybersecurity operations, security-energy tradeoffs have to be considered with great attention, and carbon optimization should not lead to the decrease in the effectiveness of protection 15 . Existing IDS approaches face an inherent quadrilemma among four competing objectives: security performance, energy efficiency, carbon optimization, and real-time constraints. Deep learning-based IDS achieve high accuracy but consume up to 89.67 mJ per inference, making continuous edge deployment unsustainable. Lightweight alternatives reduce energy but sacrifice 1–3% accuracy, while carbon-aware scheduling conflicts with the 500 ms real-time latency requirement for intrusion detection. Federated learning reduces communication energy but compromises convergence and model consistency. No existing framework simultaneously addresses all four dimensions, motivating the proposed GreenShield architecture. Research Questions: RQ1: How can knowledge distillation and dynamic quantization be integrated to achieve energy-efficient intrusion detection without significant degradation in detection accuracy across diverse attack categories? RQ2: To what extent can hierarchical federated learning with gradient compression reduce communication energy and carbon emissions in distributed edge–fog–cloud IDS deployments while maintaining convergence stability and model performance? RQ3: How effectively can carbon-aware scheduling dynamically redistribute security workloads based on real-time renewable energy availability and carbon intensity forecasts without violating real-time detection latency constraints? RQ4: What is the combined sustainability impact of integrating lightweight cryptography, adaptive deep learning, federated learning, and carbon-conscious scheduling within a unified cybersecurity framework for edge–cloud environments? Figure 1 demonstrates the conceptual map of the proposed GreenShield architecture, and in particular it is important to note that energy-efficient intrusion detection, lightweight cryptography and carbon-conscious scheduling have been absorbed under a single architecture that covers both edge and cloud settings. The framework resolves the inherent dilemma between the effectiveness of security and environmental sustainability by using a multi-layered optimization mechanism. Fig. 1. Open in a new tab Conceptual overview of the GreenShield framework showing the integration of energy-efficient security components across edge and cloud tiers with carbon-aware scheduling. In spite of recent progress in energy efficient intrusion detection, light weight cryptography, and sustainable edition edge cloud computing, solutions currently are disjointed. Majority of previous literatures also focus on maximizing on either memory or energy usage or communication overhead singly without considering simultaneously carbon emission, renewable energy consciousness, and responsible security demeanor. Precisely, there is now no model that incorporates dynamically the lightweight cryptographic protection, adaptive deep learning-based intrusion detection and carbon-aware scheduling into a hierarchical edge–fog–cloud framework. It is this outstanding issue that encourages the proposed GreenShield framework which has sought to restore sound cybersecurity at the same time taking explicit steps in minimizing energy usage and carbon emissions across distributed computing environments. The primary contributions of this paper are as follows: Novel low-carbon cybersecurity framework: We present an integrated GreenShield, lightweight cryptographic protocol with energy-efficient deep learning-based intrusion detection with a reduction of 67.4% of the overall energy consumption as compared to the traditional methods and an 98.73% detection rate. Hierarchical federated learning architecture: We present a three-layer federated learning system having adaptive aggregation schemes that allow edge and cloud nodes to collaborate in intrusion detection with a 58.2 reduction in the communications overhead and power consumption. Dynamic knowledge distillation and quantization: We present an adaptive knowledge distillation method in combination with dynamic quantization that improves the automatically adaptive model accuracy according to the threat levels and energy prices, (scaling back on the inference energy) by 71.3% during low-threat situations. Carbon-aware security scheduling algorithm: We come up with a new scheduling algorithm that assigns security loads in real-time according to forecasts of renewable energy and carbon intensity to minimize the operational carbon emissions by about 2.8 kg CO 2 -equivalent per hour. Comprehensive experimental validation: We broadly analyzed the UNSW-NB15 data set and the CIC-IDS2017 data set and they demonstrate that, among ten state-of-the-art shelf methods, the accuracy and energy consumption improved significantly as well as the carbon footprint reduced. The rest of this paper follows the following design: In “ Related work ” section reviews related literature regarding green cybersecurity, energy-saving intrusion detection, and sustainable computing; in “ Proposed methodology ” section is the presentation of the proposed GreenShield methodology with system architecture, mathematical modeling, and algorithmic implementations; in “ Discussion ” section is the discussion and analysis of the results; and in “ Conclusion ” section presents a conclusion of the paper with the directions on future research. Related work This section surveys literature across green intrusion detection, lightweight cryptography, and sustainable edge–cloud computing. Roy et al. 1 surveyed green IDS techniques but without proposing an operational framework integrating energy with carbon optimization. The authors in 2 examined energy-conscious IoT security focusing on device-level efficiency without edge–cloud coordination. Ranpara et al. 6 proposed adaptive hyperparameter optimization for ML-based IDS at the model level only, while Umar et al. 7 combined knowledge distillation with quantization for edge detection but lacked threat-aware or renewable energy controls. Alsaleh et al. 8 developed a federated BiLSTM-based IDS without optimizing energy or carbon emissions. Foundational NIDS studies 16 – 19 identified scalability, feature redundancy, and deployment limitations in conventional systems, directly informing GreenShield’s adaptive detection, lightweight student network, and federated learning design. In lightweight cryptography, Soto-Cruz et al. 15 surveyed algorithms including ASCON, SPECK, and PRESENT without examining system-level integration. Radhakrishnan et al. 20 identified ASCON’s favorable security-energy balance but restricted analysis to encryption metrics. Hardware implementations by Khan et al. 21 , Nguyen et al. 22 , and Zhong and Gu 23 improved cryptographic efficiency on ASIC/FPGA platforms but analyzed elements independently without integration with adaptive detection or carbon-conscious scheduling. Sustainable computing research by Alwageed et al. 24 prioritized cloud sustainability challenges using ISM-ANN, motivating GreenShield’s carbon-aware scheduling. Shi et al. 25 established foundations for joint security-energy optimization in mobile edge computing. Habibullah et al. 26 and Al Shareef et al. 27 examined blockchain-energy integration for IoT and AI-driven carbon accounting. Lee and Han 28 demonstrated edge intelligence reducing cloud transmissions by 62%, aligning with GreenShield’s distributed philosophy. Proposed methodology This paper will introduce the detailed design of Green Shield which entails the system architecture, mathematical model, algorithm implementations and the analysis of complexity of the design. Figure 2 is the diagram of the system architecture, which is a hierarchy of the components in terms of the edge, fog, and cloud orders. Fig. 2. Open in a new tab Green Shield system architecture showing the three-tier hierarchical organization with energy-efficient intrusion detection, lightweight cryptography, and carbon-aware scheduling components. Color coding: blue denotes the Cloud Tier (global aggregation), orange for the Fog Tier (intermediate aggregation), and green for the Edge Tier (local training and inference). Purple highlights the knowledge distillation module, pink represents the dynamic quantization mechanism, and yellow indicates the student/teacher network components. Federated learning gradient flows are shown with directional arrows between tiers, and the output classification categories are displayed on the right. System overview GreenShield is a top-down cybersecurity system with three levels of computation, including edge devices, fog nodes, and cloud servers. The framework incorporates four main functional modules, namely, (1) energy-efficient intrusion detection module (EEIDM), (2) lightweight cryptographic engine (LCE), (3) hierarchical federated learning coordinator (HFLC), and (4) carbon-aware scheduling engine (CASE). These modules work together to reduce power use and carbon emissions and ensure high-level security protection. The middle tier comprises of resource-limited IoT hardware and sensors that do initial filtering of traffic and lightweight feature extraction. These devices use the LCE module to conduct secure communications and use the compression neural network models to classify the initial threats. The fog layer includes the medium level of computational nodes that combine information of several edge computers, refine intrusion detection investigations, and arrange federated learning tasks. The cloud tier offers a centralized model training, global threat intelligence formation, and carbon-intelligent workload coordination throughout the infrastructure. Energy-efficient intrusion detection module The EEIDM employs a novel neural network architecture optimized for energy efficiency through knowledge distillation and dynamic quantization. Let denote the training dataset where represents the -dimensional feature vector of network traffic sample and denotes the corresponding class label for attack categories including normal traffic. The teacher network is a deep neural network with parameters that provides high-accuracy predictions. The student network with parameters is designed for efficient edge deployment. The knowledge distillation loss function combines the standard cross-entropy loss with the distillation loss: 1 where denotes the cross-entropy loss, represents the Kullback–Leibler divergence, is the softmax function, and are the logits from teacher and student networks respectively, is the temperature parameter, and balances the two loss components. The knowledge distillation loss in Eq. ( 1 ) aligns the student’s softened output distribution with the teacher’s, enabling effective knowledge transfer with substantially fewer parameters. The T 2 scaling preserves gradient magnitudes during soft-label training. The student network structure is made up of l layers where the output of the = layer is calculated as: 2 where and are the weight matrix and bias vector of layer l , denotes the activation function, and is the input feature vector. This standard feed-forward formulation is defined as in Eq. ( 2 ) enables hierarchical feature extraction while allowing the model complexity to be controlled through layer width and depth selection. We also offer a dynamic quantization mechanism to increase precision according to the level of threats in order to decrease computational load. As a note to is the bit-width of quantization such that . The quantized weight is calculated as: 3 where is the scaling factor and performs rounding to the nearest integer. In one case, the Eq. ( 3 ) use uniform symmetric quantization maps full-precision weights to a discrete fixed-point representation, reducing memory access and arithmetic complexity proportional to the bit-width reduction. The threat level at time t is approximated by exponential moving average of the recent outputs of the detection: 4 where is the smoothing parameter, is the window size, and is the indicator function. The exponential moving average in Eq. ( 4 ) provides a low-overhead threat estimate where β controls responsiveness to short-term fluctuations and W captures sustained attack patterns. A quantization bit-width depending on the severity of threat: 5 where , , and are configurable threshold parameters. Threat-aware dynamic quantization strategy is described in Eq. ( 5 ) employs low bit-widths during low-threat conditions to conserve energy, while escalating to full precision under high threat to preserve detection accuracy. The EEIDM energy consumption is modelled as: 6 The energy scaling function f(q b ) = (q b /32) 2 models the quadratic reduction in computational energy with decreasing bit-width, reflecting how MAC operation energy scales quadratically with operand precision. This yields f(4) = 0.0156, f(8) = 0.0625, f(16) = 0.25, and f(32) = 1.0—meaning 4-bit quantization reduces per-MAC energy by ~ 98.4% versus full precision. The model was validated on Raspberry Pi 4 hardware, achieving less than 5.2% deviation from measured values across all bit-widths in Eq. ( 6 ). The model quantization bit-width is chosen by the Algorithm 1 according to the present estimate level of threat. Reduced precision is applied when the risk is low so as to compute less energy is spent, whereas increased precision is applied when the risk is high so that quality of detection is maintained. Algorithm 1. Open in a new tab Dynamic threat-aware quantization Lightweight cryptographic engine The LCE module implements the ASCON authenticated encryption algorithm optimized for energy efficiency. ASCON operates on a 320-bit state where each is a 64-bit word. The permutation function applies rounds of the following transformation: 7 where is the round constant for round . The round constant addition in Eq. ( 7 ) prevents fixed-point behavior and ensures cryptographic diffusion at negligible computational cost. The substitution layer uses a 5-bit S-box on each of the bit-slices across in each of the five state words: 8 In Eq. ( 8 ), The 5-bit S-box substitution introduces nonlinearity across bit-slices using simple Boolean logic, ensuring security at minimal computational overhead. The linear diffusion layer offers the mixing of each word in 64-bits: 9 where denotes right rotation and are rotation constants specific to each word. Equation ( 9 ) The XOR-and-rotate diffusion layer propagates bit changes across the state using fixed rotation offsets, providing resistance to cryptanalytic attacks via lightweight bitwise operations. The time of ASCON encryption of a message of m blocks is: 10 where , , and represent the energy for initialization, per-block processing, and finalization respectively. Equation ( 10 ) linear energy model enables direct per-block cost comparison with conventional ciphers, confirming ASCON’s suitability for energy-constrained deployments. To ensure security in the transfer of keys, we use an elliptic curve variant of the Diffie–Hellman (ECDH) protocol based on Curve25519 (our scalar multiplication of the curves is energy optimized): 11 The first public key is the result of and where is the location where the key is generated, and k is the secret scalar. Equation ( 11 ) indicates Curve25519 scalar multiplication provides equivalent security strength to RSA-3072 using 256-bit keys, significantly reducing computational and energy requirements. Its implementation of the Montgomery ladder makes it constant time: 12 where is the -th bit of scalar . Equation ( 12 ) describes The Montgomery ladder’s uniform execution pattern (one doubling and one addition per bit regardless of key value) provides inherent side-channel resistance while maintaining computational efficiency. Hierarchical federated learning coordinator The HFLC can facilitate joint model training over the distributed infrastructure and reduces the overheads in communication as well as energy usage. Let denote the total number of participating nodes partitioned into groups, where group contains nodes with local datasets for . The local objective function for node is: 13 where is the loss function parameterized by model weights . The global objective is the weighted average: 14 The hierarchical aggregation proceeds in two stages. First, intra-group aggregation at fog nodes computes: 15 Second, inter-group aggregation at the cloud computes the global model: 16 To reduce communication overhead, we employ gradient compression using Top- sparsification: 17 where selects the largest magnitude gradients and generates the corresponding binary mask. In our experiments, k = 0.10·d (top 10%), yielding k = 15,600 for d = 156,000 parameters. Rates below 5% caused convergence instability; above 15% gave diminishing returns. The communication energy for transmitting compressed gradients is: 18 where and are transmission and reception energy per bit, is bits per value, is bits per index, and is the mask overhead. The sparsification mask overhead depends on encoding method: bitwise encoding requires d/8 bytes (bitmap), while index-based encoding uses k·⌈log₂(d)⌉ bits. For d = 156,000 parameters and k = 15,600 (10% sparsification), bitwise encoding yields 19.0 KB versus 34.2 KB for index-based, making bitwise encoding preferable above ~ 3% sparsification rates. Total transmission per FL round with bitmap encoding comprises gradient values (499,200 bits) plus mask (156,000 bits), totalling ~ 80.1 KB versus 97.5 KB with index encoding. Algorithm 2. Open in a new tab Hierarchical federated learning with gradient compression Carbon-aware scheduling engine The CASE module optimizes security workload allocation based on carbon intensity forecasts and renewable energy availability. Let denote the set of computational nodes and the set of security jobs to be scheduled. The carbon intensity at node and time is denoted (kg CO 2 /kWh). The renewable energy fraction is: 19 Equation ( 19 ) defines this ratio enables carbon-aware scheduling by prioritizing workloads at nodes and times with higher renewable energy availability. The scheduling decision variable indicates whether job is assigned to node at time . The optimization objective minimizes total carbon emissions: 20 subject to: 21 22 23 where is the energy requirement of job , is the maximum power capacity of node , is the job duration, and is the deadline. Equation ( 20 ) formulates carbon-weighted energy across all job-node-time assignments subject to: single-assignment per job Eq. ( 21 ), node capacity limits Eq. ( 22 ), and deadline constraints Eq. ( 23 ). The extended objective Eq. ( 24 ) adds a latency penalty weighted by the security priority ω j to balance carbon reduction with response timeliness. In security sensitive tasks and jobs that have strict threshold of latency, we add a security priority weight. : 24 An LSTM network models the forecast of the carbon intensity: 25 where is the forecast horizon, is the lookback window, and represents auxiliary features (weather, time of day, etc.). Equation ( 25 ) The LSTM forecaster uses two stacked LSTM layers (64 hidden units each) with a linear output layer, taking a 24-step (6-h) lookback window of historical carbon intensity, ambient temperature, solar irradiance, wind speed, cyclical time-of-day encoding, and day-of-week indicator as input. Trained on 25 days of German electricityMap data (MSE loss, Adam optimizer with lr = 0.001, batch size = 32, 200 epochs with early stopping, patience = 20) with a 4-h forecast horizon, it achieved MAE = 0.023, RMSE = 0.031 kg CO 2 /kWh, and R 2 = 0.94 on a 5-day held-out test set, with 1.2 ms inference time. Algorithm 3 presents the carbon-aware scheduling procedure. Algorithm 3. Open in a new tab Carbon-aware security job scheduling Integrated system operation Algorithm 4 presents the overall GreenShield framework operation, integrating all modules within a unified workflow. This algorithm facilitates real-time threat classification and secure communication in a network environment while integrating federated learning for continuous model updates. It also optimizes scheduling based on carbon intensity, making it a carbon-aware solution. If you need further details or modifications, let me know! Algorithm 4. Open in a new tab GreenShield framework operation Complexity analysis The computational complexity of the EEIDM inference is where is the number of layers and is the maximum layer width. With dynamic quantization, the effective complexity reduces by factor . The communication complexity of hierarchical federated learning is per round, where is the number of nodes, is the sparsification parameter, and is the model dimension. The hierarchical structure reduces this to O((K + G)·s·d) by localizing most communication within groups. In standard FedAvg, communication complexity is O(K·d) per round. GreenShield reduces this through two mechanisms: Top-k sparsification (transmitting only k = s·d parameters per node) and hierarchical aggregation (fog nodes aggregate K/G local updates before forwarding to cloud). This yields total complexity C_total = (K + G)·s·d. For our setup (K = 50, G = 3, s = 0.1, d = 156,000), this gives 826,800 values per round versus FedAvg’s 7,800,000—an 89.4% reduction in communication volume. The carbon-aware scheduling optimization has complexity for the greedy assignment heuristic, where is the number of jobs, is the number of nodes, and is the number of time slots. Table 1 summarizes the complexity comparison with existing approaches. Table 1. Computational complexity comparison. Method Inference Communication Training Memory Traditional DNN-IDS O(L·n 2 ) O(d) O(N·d 2 ) O(d) FedAvg-IDS 8 O(L·n 2 ) O(K·d) O(N·d 2 ) O(d) KD-IDS 7 O(L·n 2 ·s) O(d·s) O(N·d 2 ) O(d·s) GreenShield O(L·n 2 ·s·q) O((K + G)·s·d) O(N·d 2 ) O(d·s·q) Open in a new tab Results and evaluation In this section, the complete experimental analysis of the GreenShield framework, including dataset description and experimental set up, performance measurements, and comparison with state-of-the-art techniques will be presented. Datasets We evaluate GreenShield on two widely-used publicly available intrusion detection datasets: UNSW-NB15 dataset: The dataset created by the Australian Centre for Cyber Security consists of 2,540,044 records and 49 features describing the network traffic patterns in the modern world. These types of attacks are nine, namely Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcode and Worms. The dataset is available at https://research.unsw.edu.au/projects/unsw-nb15-dataset . CIC-IDS2017 dataset: This dataset is the result of the Canadian Institute of Cybersecurity, which was created based on real network traffic during five days with both benign traffic and attack traffic. It contains some 2.8 million records that have 78 features and ranges of attacks range to Brute Force, Heartbleed, Botnet, DoS, DDoS, Web Attack, and Infiltration. The dataset is accessible at https://www.unb.ca/cic/datasets/ids-2017.html . Table 2 presents the detailed statistics of both datasets used in our experiments. Table 2. Dataset statistics and class distribution. Class Samples Percentage (%) UNSW-NB15 dataset (49 features, 2,540,044 total samples) Normal 2,218,761 87.35 Generic 215,481 40.11* Exploits 44,525 8.29* Fuzzers 24,246 4.51* DoS 16,353 3.04* Reconnaissance 13,987 2.60* Analysis 2677 0.50* Backdoor 2329 0.43* Shellcode 1511 0.28* Worms 174 0.03* Total 2,540,044 100 CIC-IDS2017 dataset (78 features, 2,830,743 total samples) Benign 2,273,097 80.30 DoS Hulk 231,073 41.45* PortScan 158,930 28.51* DDoS 128,027 22.97* DoS GoldenEye 10,293 1.85* FTP-Patator 7938 1.42* SSH-Patator 5897 1.06* DoS Slowloris 5796 1.04* DoS Slowhttptest 5499 0.99* Web Attack 2180 0.39* Bot 1966 0.35* Total 2,830,743 100 Open in a new tab Experimental setup The heterogeneous testbed is the cut environment, and the simulated environment is edge–fog–cloud architecture. Hardware and software arrangement is outlined in Table 3 . Table 3. Experimental setup configuration. Component Specification Cloud server CPU Intel Xeon Gold 6248R (24 cores, 3.0 GHz) GPU NVIDIA A100 (40 GB HBM2) Memory 256 GB DDR4 ECC Storage 2 TB NVMe SSD Fog node CPU Intel Core i7-12,700 (12 cores, 2.1 GHz) GPU NVIDIA RTX 3080 (10 GB GDDR6X) Memory 64 GB DDR4 Storage 1 TB NVMe SSD Edge device Platform Raspberry Pi 4 Model B CPU Broadcom BCM2711 (4 cores, 1.5 GHz) Memory 8 GB LPDDR4 Storage 64 GB microSD Software environment Operating system Ubuntu 22.04 LTS Deep learning framework PyTorch 2.1.0 Federated learning framework Flower 1.5.0 Programming language Python 3.10 Hyperparameters Learning rate 0.001 (Adam optimizer) Batch size 256 (cloud), 64 (fog), 32 (edge) Epochs 100 (teacher), 50 (student) Knowledge distillation temperature 4.0 KD loss weight (α) 0.7 Sparsification rate 10% (Top-k) Federated learning rounds 50 Local epochs 5 Additional experimental setup parameters Threat threshold (τ_low) 0.05 Threat threshold (τ_med) 0.15 Threat threshold (τ_high) 0.35 Smoothing parameter (β) 0.9 Threat window size (W) 100 (samples) LSTM forecasting configuration LSTM hidden units 64 × 2 layers LSTM lookback window 24 steps (6 h) Forecast horizon 16 steps (4 h) LSTM learning rate 0.001 (Adam) LSTM training epochs 200 (early stopping, patience = 20) LSTM batch size 32 Open in a new tab The teacher network architecture is a network comprising of five entirely connected layers, the dimensions of which are [input, 512, 256, 128, 64, output] performing the ReLU activation, and batch normalization. The student network is reduced to a network, [input, 128, 64 32, output]. The Intel RAPL oil CPU/memory power measurements and NVIDIA SMI power monitoring of GPUs and carbon intensity prevention are measured using electricityMap API. Testbed: hybrid real-and-emulated distributed environment The setup spanned three tiers—cloud, fog, and edge. The cloud used a dedicated university data center server on a 10 Gbps backbone. Three fog nodes ran on campus workstations connected via a Layer-3 switch emulating WAN conditions (100 Mbps, 15 ms latency). Eight Raspberry Pi 4 devices formed the edge tier over 802.11ac Wi-Fi (45 Mbps, 8 ms latency). Network impairments (± 2 ms jitter, 0.1% packet loss, bandwidth variation) were emulated using Linux tc/NetEm. Federated learning was coordinated via Flower 1.5.0 with gRPC over TLS 1.3. Fog/cloud nodes used Docker 24.0 for reproducibility; edge devices ran native PyTorch 2.1.0 on ARM. Carbon intensity data was collected via the electricityMap API (v3) at 15-min resolution over a 30-day period (March 1–30, 2025). Germany (DE) served as the primary region representing a mixed-grid scenario with average intensity of 0.338 kg CO 2 /kWh, supplemented by Norway (NO-NO1, hydro-dominant, 0.024 kg CO₂/kWh) and Poland (PL, coal-dominant, 0.712 kg CO 2 /kWh) to capture diverse carbon profiles. The three intensity levels reported in Table 6 —high (0.8), medium (0.4), and low (0.1) kg CO 2 /kWh—correspond to Poland’s 90th percentile, Germany’s median, and Norway’s 10th percentile respectively. All timestamps were NTP-synchronized across nodes, and mixed-grid averages were derived as time-weighted means over the German dataset. Table 6. Carbon footprint analysis (KG CO2-EQ). Method High carbon (0.8 kg/kWh) Medium (0.4 kg/kWh) Low carbon (0.1 kg/kWh) Mixed grid avg Reduction Per hour operation Traditional DNN-IDS 4.89 2.45 0.61 2.87 Baseline FedAvg-IDS 5.12 2.56 0.64 3.01 − 4.9% KD-IDS 7 2.34 1.17 0.29 1.38 51.9% Lightweight IDS 10 2.78 1.39 0.35 1.64 42.9% GreenShield 0.72 0.36 0.09 0.42 85.4% GreenShield + CASE 0.45 0.23 0.06 0.07 97.6% Per-day operation (24 h) Traditional DNN-IDS 117.36 58.68 14.67 68.88 Baseline GreenShield + CASE 10.80 5.52 1.44 1.68 97.6% Open in a new tab Energy measurement followed a hierarchical approach across all tiers. Cloud and fog nodes used Intel RAPL counters (100 ms intervals) for CPU/DRAM energy via the powercap interface, and nvidia-smi (200 ms intervals) for GPU energy. Edge devices (Raspberry Pi 4), lacking hardware counters, were instrumented with external Monsoon HVPM power monitors sampling at 5 kHz (± 0.2% accuracy). Network energy was estimated using calibrated per-bit costs (E_tx = 48.7 nJ/bit, E_rx = 36.4 nJ/bit) derived from iperf3 tests with concurrent power measurement. Total system energy was aggregated as E_total = ∑E_cloud + ∑E_fog + ∑E_edge + ∑E_network, with each component accounting for both computation and idle power weighted by active duty cycles. All baseline methods in Table 7 were re-implemented on the same hardware testbed using identical dataset splits (UNSW-NB15 and CIC-IDS2017). Each method followed its original architecture and hyperparameters, with official code used where publicly available. Energy and carbon measurements were conducted on the same Raspberry Pi 4 and cloud server for hardware-consistent comparisons. The Year column reflects original publication year, not re-implementation. All metrics are averaged over 10 independent runs with different random seeds. Table 7. Comprehensive comparison with state-of-the-art methods energy measured on raspberry Pi 4; carbon emissions estimated using CASE under mixed-grid conditions; Comm. denotes communication overhead per federated learning round. Method Year Acc (%) F1 AUC Energy (mJ) Latency (ms) Carbon (kg/h) Params (K) Comm. (KB) Green Traditional DNN-IDS – 99.12 0.9910 0.9978 89.67 12.34 2.87 1245 N/A ✗ Green-IDS 1 2024 97.45 0.9723 0.9912 34.56 8.67 1.45 456 N/A ✓ FedAvg-IDS 8 2025 98.34 0.9812 0.9945 45.23 9.12 1.89 1245 4980 ✗ DNN-KDQ 7 2025 98.12 0.9789 0.9934 28.45 6.78 1.38 312 N/A ✓ Lightweight ML-IDS 10 2024 97.89 0.9767 0.9923 32.12 7.23 1.64 234 N/A ✓ Energy-aware IDS 12 2024 97.23 0.9701 0.9898 38.67 8.12 1.78 567 2340 ✓ FL-BiLSTM 8 2025 98.56 0.9834 0.9956 52.34 10.45 2.12 892 3568 ✗ Hybrid DL-IDS 13 2024 98.78 0.9856 0.9962 67.89 11.23 2.34 1023 N/A ✗ Cloud DL-IDS 14 2024 99.01 0.9889 0.9971 78.45 11.89 2.56 1189 N/A ✗ Privacy-FL-IDS 29 2024 98.23 0.9801 0.9938 48.67 9.56 1.95 756 3024 ✗ GreenShield (Ours) 2025 98.73 0.9829 0.9958 8.12 3.45 0.07 156 624 ✓ Open in a new tab Evaluation metrics We evaluate GreenShield using the following metrics: Detection performance: Polarity (Acc) and Precision (P), Recall (R), F1-Score (F1) and area under ROC curve (AUC). Energy efficiency: Energy per inference (mJ), energy total training energy (kWh) and power consumption (W). Carbon footprint: CO 2 emissions (kg CO 2 -eq/h), the efficiency of the utilization of carbon intensity. Communication efficiency: Rate of bytes offloaded per round compression ratio. Latency: The inference time (ms), end-to-end detection latency (ms). Detection performance analysis The convergence of training loss in both teacher and student networks in terms of training epochs are shown in Fig. 3 . Given that the student network has 85% fewer parameters, knowledge distillation is proven to be effective. Fig. 3. Open in a new tab Training loss convergence comparison between teacher network (blue), student network with KD (orange), and student network without KD (green) on UNSW-NB15 dataset. The progression of the accuracy in the training as shown in Fig. 4 reveals that the student network based on knowledge distillation attains accuracy of 98.73% versus the teacher network of 99.12%, which involves only a 0.39% accuracy trade-off to achieve 67.4% of energy decreased. Fig. 4. Open in a new tab Detection accuracy versus training epochs for teacher and student networks on UNSW-NB15 and CIC-IDS2017 datasets. In Table 4 statistical significance was assessed via two-tailed paired t-tests across 10 runs with stratified fivefold cross-validation (50 paired observations per comparison). Normality and variance homogeneity were verified using Shapiro–Wilk and Levene’s tests respectively. McNemar’s test was additionally applied for classification-level metrics. All p values use α = 0.05 with Bonferroni correction for multiple comparisons. Table 4. Detection performance comparison with statistical significance. Method Acc (%) 95% CI P R F1 AUC UNSW-NB15 dataset Teacher network 99.12 [98.95, 99.29] 0.9923 0.9897 0.9910 0.9978 Student (no KD) 95.67 [95.32, 96.02] 0.9534 0.9512 0.9523 0.9812 Student (KD, 32-bit) 98.73 [98.56, 98.90] 0.9867 0.9845 0.9856 0.9962 Student (KD, 16-bit) 98.58 [98.41, 98.75] 0.9847 0.9812 0.9829 0.9954 Student (KD, 8-bit) 98.21 [98.02, 98.40] 0.9798 0.9767 0.9782 0.9938 Student (KD, 4-bit) 96.89 [96.54, 97.24] 0.9645 0.9623 0.9634 0.9867 GreenShield (Dynamic) 98.73 [98.56, 98.90] 0.9847 0.9812 0.9829 0.9958 p value versus KD (16-bit) 0.018 CIC-IDS2017 dataset Teacher network 99.34 [99.18, 99.50] 0.9941 0.9928 0.9934 0.9985 Student (no KD) 96.12 [95.78, 96.46] 0.9589 0.9567 0.9578 0.9834 Student (KD, 32-bit) 98.95 [98.78, 99.12] 0.9889 0.9878 0.9883 0.9971 Student (KD, 16-bit) 98.82 [98.64, 99.00] 0.9871 0.9856 0.9863 0.9965 Student (KD, 8-bit) 98.47 [98.29, 98.65] 0.9823 0.9801 0.9812 0.9952 Student (KD, 4-bit) 97.23 [96.90, 97.56] 0.9689 0.9667 0.9678 0.9889 GreenShield (Dynamic) 98.91 [98.74, 99.08] 0.9878 0.9863 0.9870 0.9969 p value vs KD (16-bit) 0.021 Open in a new tab 95% confidence intervals were computed over 10 independent runs (different random seeds for initialization, shuffling, and client sampling) as CI = mean ± t_(0.025,9) · (s/√n), where t_(0.025,9) = 2.262. The narrow intervals reflect training stability, with GreenShield (dynamic) achieving σ = 0.11% accuracy across runs, confirming strong reproducibility. Figure 5 represents the confusion matrix of multi-class attack classification of UNSW-NB15 dataset that shows a good discriminating ability in the entire category of attacks. Fig. 5. Open in a new tab Confusion matrix for GreenShield multi-class classification on UNSW-NB15 dataset showing attack category discrimination performance. Figure 6 shows the ROC curves of binary classification (normal vs. attack) and the classification under attack category showing the high discrimination ability (such as the AUC value of more than 0.99). Fig. 6. Open in a new tab ROC curves for binary and multi-class classification showing AUC performance across attack categories on both datasets. Energy efficiency analysis Table 5 provides a detailed comparison of energy consumption of cloud, edge and hierarchical federated deployment. Alongside absolute energy measurement, relative efficiencies decreases especially versus the strongest baseline are also reported so as to provide context on energy efficiency gain. Repeated statistical analysis establishes that FedAvg and Strong intrusion detection performance is achieved, but GreenShield statistically reduces energy consumption relative to FedAvg ( p < 0.05) at the same time. Table 5. Energy consumptionan alysis with comparative context. Configuration Inference (mJ) Power (W) Training (kWh) Comm. (mJ/round) Total (kWh/day) Reduction versus baseline (%) Cloud deployment Teacher (Full) 12.45 285.3 8.72 N/A 6.85 – FedAvg baseline 12.45 285.3 9.15 856.2 7.23 – Edge deployment (Raspberry Pi 4) Teacher (Full) 89.67 5.8 N/A N/A 0.139 – Student (32-bit) 28.34 3.2 N/A N/A 0.077 44.6 Student (16-bit) 14.23 2.4 N/A N/A 0.058 58.3 Student (8-bit) 7.89 1.8 N/A N/A 0.043 69.1 Student (4-bit) 4.56 1.4 N/A N/A 0.034 75.5 GreenShield 8.12 1.9 N/A 234.5 0.045 67.6 Hierarchical FL deployment FedAvg (Full) 12.45 285.3 9.15 856.2 7.23 – FedProx 12.67 287.1 9.34 867.4 7.38 – GreenShield 8.12 92.4 3.21 234.5 2.36 67.4 p valuevsFedAvg 0.012 Open in a new tab Figure 7 shows the energy consumption as per the quantization levels and deployment conditions in the various cases where act of dynamism quantization saves a lot of energy. Fig. 7. Open in a new tab Energy consumption comparison: ( a ) Inference energy across quantization levels, ( b ) Communication energy with gradient compression, ( c ) Total daily energy consumption across deployment scenarios. Carbon footprint analysis Table 6 puts carbon emissions in perspective by calculating the kg CO 2 -eq data to actual-world equivalent operating on the assumption of as much as 0.35–0.45 kg CO 2 per server-hour (data-center) server energy usage, with the grid intensity used as a proxy. Considering the example provided above, the classic IDS implementation with 25–5 kg CO 2 -equivalent per hour of emissions will take over 1 h of uninterrupted server operation, but the same GreenShield lowers the emissions to less than 0.5 kg CO 2 -equivalent per hour, or less than 10 min of the server run time. This demonstrates the high sustainability benefits obtained by carbon-conscious scheduling and adaptive security implementation. Figure 8 shows the carbon emissions during the 24 h with differing renewable energy availability, which confirms that the carbon-aware scheduling algorithm is efficient. Fig. 8. Open in a new tab Carbon emissions analysis: ( a ) Hourly carbon intensity variation and scheduling decisions, ( b ) Cumulative carbon emissions comparison with and without CASE, ( c ) Renewable energy utilization efficiency. Comparative analysis Table 7 provides a comprehensive comparison of GreenShield with ten state-of-the-art baseline methods. Ablation study The ablation analysis in Table 8 is conducted on the proposed GreenShield framework component-wisely and this reveals that component of the design framework contributes to the detection accuracy, the energy consumption, the carbon emission and the latency. A paired test is used to evaluate the statistical significance versus the complete configuration of GreenShield. Table 8. Ablation study results with statistical significance. Configuration Acc (%) F1 Energy (mJ) Carbon (kg/h) Latency (ms) p value Full GreenShield 98.73 0.9829 8.12 0.07 3.45 – w/o knowledge distillation 95.67 0.9523 8.12 0.07 3.45 < 0.01 w/o dynamic quantization 98.73 0.9856 28.34 0.24 5.67 0.41 w/o gradient compression 98.73 0.9829 8.12 0.15 3.45 0.87 w/o hierarchical FL 98.45 0.9812 8.12 0.12 4.12 0.03 w/o CASE 98.73 0.9829 8.12 0.42 3.45 0.91 w/o ASCON (AES-128) 98.73 0.9829 12.34 0.11 4.23 0.88 Component contribution analysis (relative to full GreenShield) Knowledge distillation + 3.06% + 0.0306 0% 0% 0% – Dynamic quantization 0% − 0.0027 − 71.3% − 70.8% − 39.2% – Gradient compression 0% 0% 0% − 53.3% 0% – Hierarchical FL + 0.28% + 0.0017 0% − 41.7% − 16.3% – CASE 0% 0% 0% − 83.3% 0% – Open in a new tab High p values for CASE ( p = 0.91), ASCON replacement ( p = 0.88), and gradient compression ( p = 0.87) are expected, as these modules target sustainability rather than detection accuracy. CASE delivers 83.3% carbon reduction, gradient compression reduces communication energy by 72.7% (856.2 → 234.5 mJ/round), and ASCON achieves 52% cryptographic energy savings over AES-128—all with zero accuracy impact. Non-significant accuracy p values thus validate the modular design, confirming each component optimizes its intended metric without degrading detection performance. Scalability analysis Table 9 examines the framework’s scalability across different numbers of edge nodes. Table 9. Scalability analysis with varying node counts. Nodes Accuracy (%) F1 Convergence Communication (MB) Carbon (kg/h) Latency (ms) 10 98.45 0.9823 32 rounds 6.2 0.05 3.12 25 98.67 0.9845 38 rounds 15.6 0.06 3.28 50 98.73 0.9829 42 rounds 31.2 0.07 3.45 100 98.78 0.9856 45 rounds 62.4 0.09 3.67 200 98.81 0.9861 48 rounds 124.8 0.12 4.12 500 98.84 0.9867 52 rounds 312.0 0.18 4.89 Open in a new tab Real-world deployment scenarios Figure 9 shows the performance of three deployment cases: urban smart city, rural IoT network and adversarial conditions. Fig. 9. Open in a new tab Performance evaluation across deployment scenarios: ( a ) Urban smart city with high traffic volume, ( b ) Rural IoT with intermittent connectivity, ( c ) Adversarial conditions with sophisticated attack patterns. Discussion The experimental outcomes indicate that GreenShield is efficient in dealing with the issue of cybersecurity efficacy and environmental sustainability balance. A number of major results are worth a discussion (Table 10 ). Critical Infrastructure trade-off analysis: While the 0.39% accuracy trade-off (99.12% → 98.73%) is acceptable in most contexts, mission-critical deployments (e.g., nuclear monitoring, air traffic control) can enable CRITICAL_MODE, which locks quantization to 32-bit full precision. This disables energy optimization but retains hierarchical FL (58.2% communication reduction) and ASCON cryptography (52% energy reduction), yielding 42.3% overall energy savings at full teacher-equivalent accuracy. Notably, the accuracy drop primarily affects low-prevalence attack classes (Worms: 0.03%, Analysis: 0.50%), while high-consequence categories (DoS, Exploits, Generic) maintain F1-scores above 0.99 even under dynamic quantization. Deployment planners are advised to conduct site-specific risk assessments using the per-class confusion matrices (Fig. 5 ) to determine the appropriate accuracy-energy trade-off for their threat model. Threshold sensitivity analysis: Threat-level thresholds (τ_low = 0.05, τ_med = 0.15, τ_high = 0.35) were determined via grid search on UNSW-NB15, optimizing the F1-score vs. energy Pareto frontier. Perturbation analysis (± 50% variation) showed moderate sensitivity to τ_low (± 0.12% accuracy, ± 8.4% energy) but low sensitivity to τ_high (± 0.03%, ± 2.1%), as high-threat conditions always trigger full precision. For deployment, lower thresholds (τ_low = 0.03, τ_med = 0.10) suit benign-dominant environments, while higher values (τ_low = 0.10, τ_med = 0.25) are recommended for attack-heavy settings. Adaptive calibration via a running false-positive rate monitor is identified as a promising future direction. Experiments varying ω j from 0 to 10 across 1000 simulated security jobs revealed a clear carbon-latency trade-off: ω j = 0 maximizes carbon reduction (97.6%) but incurs 847 ms worst-case latency, while the default ω j = 1.0 balances 85.4% carbon reduction with 234 ms latency—within NIST SP 800-94’s 500 ms threshold. For latency-critical environments, ω j = 3.0–5.0 is recommended, and CRITICAL-classified jobs always bypass carbon optimization entirely for immediate scheduling (Table 11 ). Limitations and Future Directions: Though GreenShield has proven to be effective, there are a number of limitations worth discussing. To start with, the model is based on proper prediction of short-term carbon intensity to facilitate sound carbon-minded scheduling. Although the suggested LSTM-based predictor can be effectively used within a 6-h horizon, the uncertainty of the forecasts to longer horizon limits the scope of time scheduling optimization. Second, the existing system design presupposes rather homogeneous threat distribution among the participating edge nodes. In practice, attack patterns can be spatially and temporally skewed which can adversely influence the optimality of hierarchical aggregation and dynamic quantization decision making. Third, aggressive 4-bit quantization has significantly high energy and carbon savings but has a quantifiable error rate (up to 1.84) that can be unacceptable in a mission-critical or high-assurance security system. Lastly, the assessment of these scenarios is mainly about intrusion over a network and how the framework can be used to address other types of attacks like encrypted traffic inspection or application layer attacks has not been studied yet. The work-related limitations will be overcome in the future with references to uncertainty-aware carbon forecasting, heterogeneity-aware federated aggregation, adaptive mixed-precision quantization, and extended coverage of attacks maintaining different threat models. Table 10. Threshold sensitivity analysis. Configuration τ_low τ_med τ_high Accuracy (%) Energy (mJ) Carbon (kg/h) Default 0.05 0.15 0.35 98.7 8.12 0.07 − 50% τ_low 0.025 0.15 0.35 98.6 7.45 0.06 + 50% τ_low 0.075 0.15 0.35 98.8 8.81 0.08 − 50% τ_med 0.05 0.075 0.35 98.6 8.05 0.07 + 50% τ_med 0.05 0.225 0.35 98.7 8.29 0.07 Open in a new tab The sensitivity analysis shows moderate responsiveness to τ_low variations (± 0.12% accuracy, ± 8.4% energy), while τ_high exhibits minimal impact (± 0.03% accuracy). This confirms deployment robustness across varying threat sensitivity requirements. Table 11. Security priority weight (ω_j) experimental validation. ω j Carbon reduction (%) Avg latency (ms) Worst-case latency (ms) 0.0 97.6 312 847 0.5 91.2 189 423 1.0 (default) 85.4 87 234 2.0 76.8 52 112 5.0 62.1 23 45 10.0 43.5 12 18 Open in a new tab At ω j = 1.0 (default), 85.4% carbon reduction is achieved while maintaining worst-case latency within the 500 ms NIST SP 800-94 guideline. Approximately 78% of maximum carbon benefit is preserved with < 50 ms additional latency, demonstrating diminishing returns behavior. The results as reported in Table 7 confirm that GreenShield has the better overall balance in terms of detection performance, energy efficiency, and carbon footprint metrics than the available methods. Although certain techniques are slightly more accurate (e.g. 99.01% GreenShield 8.12 mJ), none can match its energy use (8.12 mJ vs. 28.45), or carbon footprint (0.07 kg/h vs. 1.38 kg/h). Conclusion This paper presented GreenShield, a unified low-carbon cybersecurity framework integrating energy-efficient intrusion detection, ASCON lightweight cryptography, hierarchical federated learning, and carbon-aware scheduling across edge–fog–cloud architectures. Experimental evaluation on UNSW-NB15 and CIC-IDS2017 datasets demonstrated 98.73% detection accuracy with 67.4% energy reduction and up to 97.6% operational carbon savings compared to conventional deep learning-based IDS. The dynamic quantization mechanism adapts model precision to real-time threat levels, while hierarchical federated learning with gradient compression reduces communication overhead by 58.2%. The carbon-aware scheduling engine aligns security workloads with renewable energy availability, transforming security operations from energy-blind overheads into carbon-conscious processes. GreenShield provides a practical blueprint for organizations aligning cybersecurity with ESG commitments and green IT regulations. Future work will extend the framework to adversarial federated settings, uncertainty-aware carbon optimization, and neuromorphic computing integration for next-generation sustainable cybersecurity. Acknowledgements The aurthor extend their appreciation to the Deputyship for Research and Innovation, Ministry of Education in Saudi Arabia, for funding this research work through the project number (0054-1446-S). Author contributions Conceptualization: Abdullah Alshammari Methodology: Abdullah Alshammari Software: Abdullah Alshammari Formal analysis: Abdullah Alshammari Resources: Abdullah Alshammari Writing—review and editing: Abdullah Alshammari Funding acquisition: Abdullah Alshammari. Funding This research was funded through the project number (0054-1446-S). Data availability The datasets used in this study are publicly available: UNSW-NB15: https://research.unsw.edu.au/projects/unsw-nb15-dataset . CIC-IDS2017: https://www.unb.ca/cic/datasets/ids-2017.html . Carbon intensity data were obtained from the electricityMap API (v3). The complete GreenShield implementation, hyperparameters, experimental configurations, and random seeds are publicly available at: https://github.com/abdullahtsu/GreenShield ) All experiments were conducted with fixed random seeds for reproducibility, and 10 independent runs were averaged for statistical robustness. Declarations Competing interests The authors declare no competing interests. Footnotes Publisher’s note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations. References 1. Roy, S., Sankaran, S. & Zeng, M. Green intrusion detection systems: A comprehensive review and directions. Sensors 24 (17), 5516. 10.3390/s24175516 (2024). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 2. He, P., Zhou, Y. & Qin, X. A survey on energy-aware security mechanisms for the Internet of Things. Future Internet 16 (4), 128. 10.3390/fi16040128 (2024). [ Google Scholar ] 3. Achuthan, K., Sankaran, S., Roy, S. & Raman, R. Integrating sustainability into cybersecurity: Insights from machine learning based topic modeling. Discov. Sustain. 5 , 44. 10.1007/s43621-024-00754-w (2024). [ Google Scholar ] 4. Tabbakh, L. et al. Towards sustainable AI: A comprehensive framework for green AI. Discov. Sustain. 5 , 408. 10.1007/s43621-024-00641-4 (2024). [ Google Scholar ] 5. Alazzawi, M. Q., Sánchez-Aarnoutse, J.-C., Martínez-Sala, A. S. & Cano, M.-D. Green IoT: Energy efficiency, renewable integration, and security implications. IET Netw. 14 (1), e70003. 10.1049/ntw2.70003 (2025). [ Google Scholar ] 6. Ranpara, R., Alsalman, O., Kumar, O. P. & Patel, S. K. A simulation-driven computational framework for adaptive energy-efficient optimization in machine learning-based intrusion detection systems. Sci. Rep. 15 , 13376. 10.1038/s41598-025-93254-4 (2025). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 7. Umar, H. G. A. et al. Energy-efficient deep learning-based intrusion detection system for edge computing: A novel DNN-KDQ model. J. Cloud Comput. 14 , 32. 10.1186/s13677-025-00762-9 (2025). [ Google Scholar ] 8. Alsaleh, S., Menai, M. E. B. & Al-Ahmadi, S. A heterogeneity-aware semi-decentralized model for a lightweight intrusion detection system for IoT networks based on federated learning and BiLSTM. Sensors 25 (4), 1039. 10.3390/s25041039 (2025). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 9. Fatima, M., Rehman, O., Rahman, I. M. H., Ajmal, A. & Park, S. J. Towards ensemble feature selection for lightweight intrusion detection in resource-constrained IoT devices. Future Internet 16 (10), 368. 10.3390/fi16100368 (2024). [ Google Scholar ] 10. Javed, A. et al. Implementation of lightweight machine learning-based intrusion detection system on IoT devices of smart homes. Future Internet 16 (6), 200. 10.3390/fi16060200 (2024). [ Google Scholar ] 11. Slimani, L. et al. A study on characterizing energy, latency and security for intrusion detection systems on heterogeneous embedded platforms. Future Gener. Comput. Syst. 162 , 107478. 10.1016/j.future.2024.07.051 (2025). [ Google Scholar ] 12. de Farias, J. C. L. A. & Hirata, C. M. Designing energy-aware collaborative intrusion detection in IoT networks. J. Inf. Secur. Appl. 81 , 103715. 10.1016/j.jisa.2024.103715 (2024). [ Google Scholar ] 13. Yaras, S. & Dener, M. IoT-based intrusion detection system using new hybrid deep learning algorithm. Electronics 13 (6), 1053. 10.3390/electronics13061053 (2024). [ Google Scholar ] 14. Aljuaid, W. H. & Alshamrani, S. S. A deep learning approach for intrusion detection systems in cloud computing environments. Appl. Sci. 14 (13), 5381. 10.3390/app14135381 (2024). [ Google Scholar ] 15. Soto-Cruz, J. et al. A survey of efficient lightweight cryptography for power-constrained microcontrollers. Technologies 13 (1), 3. 10.3390/technologies13010003 (2025). [ Google Scholar ] 16. Verma, J., Bhandari, A. & Singh, G. iNIDS: SWOT analysis and TOWS inferences of state-of-the-art NIDS solutions for the development of Intelligent Network Intrusion Detection System. Comput. Commun. 195 , 227–247. 10.1016/j.comcom.2022.08.022 (2022). [ Google Scholar ] 17. Snehi, M., Verma, J., Kansal, I., Popli, R., Kumar, R. & Saini, G. S. Intelligent service oriented architecture (SOA) for state-of-the-art IoT-DDoS defense and research challenges. In Proceedings of the 2023 International Conference on IoT, Communication and Automation Technology (ICICAT), Gorakhpur, India , 1–4 (2023). 10.1109/ICICAT57735.2023.10263635. 18. Verma, J., Bhandari, A. & Singh, G. Feature selection algorithm characterization for NIDS using machine and deep learning. In Proceedings of the 2022 IEEE International IOT, Electronics and Mechatronics Conference (IEMTRONICS) , 1–7 (2022). 10.1109/IEMTRONICS55184.2022.9795709. 19. Verma, J., Bhandari, A. & Singh, G. Network intrusion detection system employing big data and intelligent learning methods. In Proceedings of the 2022 4th International Conference on Artificial Intelligence and Speech Technology (AIST) , 1–6 (IEEE, 2022). 10.1109/AIST55798.2022.10064829. 20. Radhakrishnan, S., Jadon, S. & Honnavalli, P. B. Efficiency and security evaluation of lightweight cryptographic algorithms for resource-constrained IoT devices. Sensors 24 (12), 4008. 10.3390/s24124008 (2024). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 21. Khan, S. et al. Securing the IoT ecosystem: ASIC-based hardware realization of ASCON lightweight cipher. Int. J. Inf. Secur. 23 (6), 3653–3664. 10.1007/s10207-024-00904-1 (2024). [ Google Scholar ] 22. Nguyen, K.-D. et al. ASIC implementation of ASCON lightweight cryptography for IoT applications. IEEE Trans. Circuits Syst. II Express Briefs 72 (1), 278–282. 10.1109/TCSII.2024.3483214 (2025). [ Google Scholar ] 23. Zhong, Y. & Gu, J. Lightweight block ciphers for resource-constrained environments: A comprehensive survey. Future Gener. Comput. Syst. 157 , 288–302. 10.1016/j.future.2024.03.054 (2024). [ Google Scholar ] 24. Alwageed, H. S. et al. An empirical study for mitigating sustainable cloud computing challenges using ISM-ANN. PLoS ONE 19 (9), e0308971. 10.1371/journal.pone.0308971 (2024). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 25. Shi, C. et al. Security-aware energy-efficient design for mobile edge computing network operating with finite blocklength codes. EURASIP J. Wirel. Commun. Netw. 10.1186/s13638-024-02395-z (2024). [ Google Scholar ] 26. Habibullah, S. M., Alam, S., Ghosh, S., Dey, A. & De, A. Blockchain-based energy consumption approaches in IoT. Sci. Rep. 14 , 28088. 10.1038/s41598-024-77792-x (2024). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 27. Al Shareef, A. M., Seçkiner, S., Eid, B. & Abumeteir, H. Integration of blockchain with artificial intelligence technologies in the energy sector: A systematic review. Front. Energy Res. 10.3389/fenrg.2024.1377950 (2024). [ Google Scholar ] 28. Lee, G. H. & Han, J. An edge-based intelligent IoT control system: Achieving energy efficiency with secure real-time incident detection. J. Netw. Syst. Manag. 33 , 13. 10.1007/s10922-024-09888-8 (2025). [ Google Scholar ] 29. Mahmud, S. A., Islam, N., Islam, Z., Rahman, Z. & Mehedi, S. T. Privacy-preserving federated learning-based intrusion detection technique for cyber-physical systems. Mathematics 12 (20), 3194. 10.3390/math12203194 (2024). [ Google Scholar ] 30. Nguyen, H. P. & Chen, Y. Lightweight, post-quantum secure cryptography based on Ascon: Hardware implementation in automotive applications. Electronics 13 (22), 4550. 10.3390/electronics13224550 (2024). [ Google Scholar ] 31. Lee, H. J. et al. LAMT: Lightweight and anonymous authentication scheme for medical Internet of Things services. Sensors 25 (3), 821. 10.3390/s25030821 (2025). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 32. Dahiphale, V., Raut, H., Bansod, G. & Dahiphale, D. Securing IoT devices with fast and energy efficient implementation of PRIDE and PRESENT ciphers. Cyber Secur. Appl. 3 , 100055. 10.1016/j.csa.2024.100055 (2024). [ Google Scholar ] 33. Sultan, I. & Banday, M. T. An energy efficient encryption technique for the Internet of Things sensor nodes. Int. J. Inf. Technol. 16 , 2517–2533. 10.1007/s41870-024-01750-z (2024). [ Google Scholar ] 34. Aljaedi, A. R. et al. A lightweight encryption algorithm for resource-constrained IoT devices using quantum and chaotic techniques with metaheuristic optimization. Sci. Rep. 15 , 14050. 10.1038/s41598-025-97822-6 (2025). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 35. Zinabu, N. G. et al. Comprehensive analysis of lightweight cryptographic algorithms for battery-limited Internet of Things devices. Int. J. Distrib. Sens. Netw. 10.1155/dsn/9639728 (2025). [ Google Scholar ] 36. Walling, S. et al. Network intrusion detection system for IoT security using machine learning and statistical based hybrid feature selection. Secur. Priv. 10.1002/spy2.429 (2024). [ Google Scholar ] 37. Bazgir, O., Gali, S. & Nikoubin, T. Area-power and energy efficient substitution box (S-box) in advanced encryption standard (AES). In Proceedings of the GLSVLSI ’24 , 263–267 (2024). 10.1145/3649476.3658765. 38. Thakur, S., Banik, S. & Regazzoni, F. Energy analysis of cryptographic algorithms in server environment. In Proceedings of the CCSW ’24 (2024). 10.1145/3689938.3694775. 39. Che, X., He, Y., Feng, X., Sun, K., Xu, K. & Li, Q. BlueSWAT: A lightweight state-aware security framework for bluetooth low energy. In Proceedings of the ACM CCS ’24 , (2024). 10.1145/3658644.3670397. Associated Data This section collects any data citations, data availability statements, or supplementary materials included in this article. Data Availability Statement The datasets used in this study are publicly available: UNSW-NB15: https://research.unsw.edu.au/projects/unsw-nb15-dataset . CIC-IDS2017: https://www.unb.ca/cic/datasets/ids-2017.html . Carbon intensity data were obtained from the electricityMap API (v3). The complete GreenShield implementation, hyperparameters, experimental configurations, and random seeds are publicly available at: https://github.com/abdullahtsu/GreenShield ) All experiments were conducted with fixed random seeds for reproducibility, and 10 independent runs were averaged for statistical robustness. Articles from Scientific Reports are provided here courtesy of Nature Publishing Group ACTIONS View on publisher site PDF (5.9 MB) Cite Collections Permalink PERMALINK Copy RESOURCES Similar articles Cited by other articles Links to NCBI Databases Cite Copy Download .nbib .nbib Format: AMA APA MLA NLM Add to Collections Create a new collection Add to an existing collection Name your collection * Choose a collection Unable to load your collection due to an error Please try again Add Cancel Follow NCBI NCBI on X (formerly known as Twitter) NCBI on Facebook NCBI on LinkedIn NCBI on GitHub NCBI RSS feed Connect with NLM NLM on X (formerly known as Twitter) NLM on Facebook NLM on YouTube National Library of Medicine 8600 Rockville Pike Bethesda, MD 20894 Web Policies FOIA HHS Vulnerability Disclosure Help Accessibility Careers NLM NIH HHS USA.gov Back to Top