Privacy-Preserving Intrusion Detection using Federated Learning in Distributed Networks
DOI:
https://doi.org/10.68307/ab5fmp82Keywords:
Federated Learning, Intrusion Detection System (IDS), Privacy-Preserving Machine Learning, Differential Privacy, Secure Aggregation, Distributed Networks, Network Security, Cybersecurity, Deep Learning, Machine Learning, Edge Computing, IoT Security, Anomaly Detection, FedAvg, Cryptographic Protocols.Abstract
The rapid growth of things like distributed computing, cloud platforms, edge setups, and all kinds of IoT devices have greatly disrupted how our networks work. But while these developments bring some progress, they have also made cyber attacks more frequent and sophisticated. Conventional tools for detecting these problems—old-school intrusion detection systems—usually rely on funneling all traffic to a single location. This creates headaches for privacy, keeping up as networks grow, and complying with data regulations. In this paper, we propose a novel approach: a privacy-friendly intrusion detection system (PP-IDS) that operates on the basis of conjoint learning. Instead of combining all network activity and risking exposure, each part of the system uses its own data to develop a detection model. Only model improvements (not raw data) are shared with the central server using a group update method called federated averaging. And we're adding two additional layers—secure aggregation and differentiated privacy—to further lock things down and protect against data leaks when changing models. We performed tests using well-known datasets such as NSL-KDD and CICIDS2017, measuring things like accuracy, attack flow capture, false alarms, and how many network conversations the method requires. Our setup keeps up with other intrusion detection systems, but provides better privacy protection, runs smoothly as things grow, and recovers from problems more easily than a typical centralized setup. This makes PP-IDS suitable for cloud services, edge devices, Internet of Things networks or business systems – basically anywhere that data needs to remain private. Taken together, our findings suggest that federated learning can indeed lay the foundations for smarter, privacy-respecting, and more scalable tools to keep modern networks secure..
References
REFERENCES
[1] H. B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, "Communication-efficient learning of deep networks from decentralized data," in Proc. 20th Int. Conf. Artificial Intelligence and Statistics (AISTATS), 2017, pp. 1273–1282.
[2] P. Kairouz et al., "Advances and open problems in federated learning," Foundations and Trends in Machine Learning, vol. 14, no. 1–2, pp. 1–210, 2021.
[3] T. Li, A. K. Sahu, A. Talwalkar, and V. Smith, "Federated learning: Challenges, methods, and future directions," IEEE Signal Processing Magazine, vol. 37, no. 3, pp. 50–60, 2020.
[4] C. Dwork and A. Roth, "The algorithmic foundations of differential privacy," Foundations and Trends in Theoretical Computer Science, vol. 9, no. 3–4, pp. 211–407, 2014.
[5] K. Bonawitz et al., "Practical secure aggregation for privacy-preserving machine learning," in Proc. ACM SIGSAC Conf. Computer and Communications Security (CCS), 2017, pp. 1175–1191.
[6] Y. Lindell, "Secure multiparty computation," Communications of the ACM, vol. 64, no. 1, pp. 86–96, 2021.
[7] R. Shokri and V. Shmatikov, "Privacy-preserving deep learning," in Proc. 22nd ACM SIGSAC Conf. Computer and Communications Security (CCS), 2015, pp. 1310–1321
[8] L. Zhu, Z. Liu, and S. Han, "Deep leakage from gradients," in Advances in Neural Information Processing Systems (NeurIPS), vol. 32, 2019, pp. 14774–14784.
[9] M. Abadi et al., "Deep learning with differential privacy," in Proc. ACM SIGSAC Conf. Computer and Communications Security (CCS), 2016, pp. 308–318.
[10] R. C. Geyer, T. Klein, and M. Nabi, "Differentially private federated learning: A client level perspective," arXiv preprint arXiv:1712.07557, 2017.
[11] S. A. Rahman, H. Tout, C. Talhi, and A. Mourad, "Internet of things intrusion detection: Centralized, on-device, or federated learning?," IEEE Network, vol. 34, no. 6, pp. 310–317, 2020.
[12] T. D. Nguyen, S. Marchal, M. Miettinen, H. Fereidooni, N. Asokan, and A.-R. Sadeghi, "DIoT: A federated self-learning anomaly detection system for IoT," in Proc. IEEE 39th Int. Conf. Distributed Computing Systems (ICDCS), 2019, pp. 756–767.
[13] B. Li, Y. Wu, J. Song, R. Lu, T. Li, and L. Zhao, "DeepFed: Federated deep learning for intrusion detection in industrial cyber-physical systems," IEEE Trans. Industrial Informatics, vol. 17, no. 8, pp. 5615–5624, 2021.
[14] M. Nguyen, F. Nazir, N. Nguyen et al., "Federated learning for intrusion detection systems in IoT networks: A survey," IEEE Access, vol. 10, pp. 45741–45761, 2022.
[15] N. Truong, K. Sun, S. Wang, F. Guitton, and Y. Guo, "Privacy preservation in federated learning: An insightful survey from the GDPR perspective," Computers & Security, vol. 110, 2021.
[16] Q. Yang, Y. Liu, T. Chen, and Y. Tong, "Federated machine learning: Concept and applications," ACM Transactions on Intelligent Systems and Technology, vol. 10, no. 2, pp. 1–19, 2019.
[17] C. Zhang, Y. Xie, H. Bai, B. Yu, W. Li, and Y. Gao, "A survey on federated learning," Knowledge-Based Systems, vol. 216, 2021.
[18] M. Rigaki and S. Garcia, "A survey of privacy attacks in machine learning," ACM Computing Surveys, 2020.
[19] M. H. Bhuyan, D. K. Bhattacharyya, and J. K. Kalita, "Network anomaly detection: Methods, systems and tools," IEEE Communications Surveys & Tutorials, vol. 16, no. 1, pp. 303–336, 2014.
[20] M. Tavallaee, E. Bagheri, W. Lu, and A. A. Ghorbani, "A detailed analysis of the KDD CUP 99 data set," in Proc. IEEE Symp. Computational Intelligence for Security and Defense Applications (CISDA), 2009, pp. 1–6.
[21] I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, "Toward generating a new intrusion detection dataset and intrusion traffic characterization," in Proc. 4th Int. Conf. Information Systems Security and Privacy (ICISSP), 2018, pp. 108–116.
[22] N. Moustafa and J. Slay, "UNSW-NB15: A comprehensive data set for network intrusion detection systems," in Proc. Military Communications and Information Systems Conf. (MilCIS), 2015, pp. 1–6.
[23] M. Ozay, I. Esnaola, F. T. Yarman Vural, S. R. Kulkarni, and H. V. Poor, "Machine learning methods for attack detection in the smart grid," IEEE Trans. Neural Networks and Learning Systems, vol. 27, no. 8, pp. 1773–1786, 2016.
[24] H. B. McMahan and D. Ramage, "Federated learning: Collaborative machine learning without centralized training data," Google AI Blog, 2017.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 RAM CHOUHAN
This work is licensed under a Creative Commons Attribution 4.0 International License.
Articles published in the International Journal of Artificial Intelligence, Cybersecurity and Emerging Technologies (IJAICET) are licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0).
Under this license, users are free to share, copy, redistribute, adapt, and build upon the published material for any purpose, including commercial use, provided appropriate credit is given to the original author(s) and the source, a link to the license is provided, and any changes made are indicated.
Authors retain copyright of their work while granting IJAICET the right to publish, archive, distribute, and index the article. The journal supports the free exchange of scientific knowledge through open access publishing and encourages the widest possible dissemination of research.
