Open-world intrusion detection in flying ad hoc networks (FANETs) is challenged by rapid three-dimensional mobility, evolving attack streams, non-IID local observations, intermittent participation, and temporary network partitioning. This paper proposes a mobilitydisentangled federated continual graph-learning framework that integrates three components. First, a temporal heterogeneous graph encoder separates mobility-explainable topology variation from
security-relevant behavioral drift. Second, a calibrated prototypebased detector combines unknown-class rejection, validated zeroday class expansion, replay, knowledge distillation, and prototype preservation. Third, a partition-aware federated mechanism exchanges lightweight adapters, prototypes, and task signatures to reconcile independently learned knowledge after reconnection. Experimental results show that the proposed method achieves a falsepositive rate of 0.071 ± 0.006 at 30 m/s and an unknown-detection rate of 0.914 ± 0.009. On a compound zero-day task, it achieves an open-set F1 score of 0.889 ± 0.010 and an average forgetting value of 0.031 ± 0.004. After FANET reconnection, the method reaches an F1 score of 0.919 ± 0.006, compared with 0.836 ± 0.013 for FedAvg fusion. Moreover, adapter–prototype exchange reduces communication volume by 82.7% relative to full-model FedAvg.
These results indicate robust and communication-efficient intrusion detection under the evaluated mobility shifts, continual attack evolution, and network partitioning conditions