Prototype Retrieval-Augmented Federated Learning System for Robust Intrusion Detection

Federated learning-driven cloud intrusion detection using transfer learning and ablation frigate-fairy hybrid optimization

AMoE-IDS: An Adaptive Mixture-of-Experts Framework for Cross-Dataset Intrusion Detection

Intrusion Detection Systems (IDS) are essential for securing modern network infrastructures against increasingly sophisticated cyber threats. While deep learning-based IDS have shown promising performance, most existing approaches rely on static and monolithic architectures that struggle to adapt to heterogeneous environments such as Internet of Things (IoT) systems, enterprise networks, and mixed traffic scenarios. Moreover, conventional ensemble and hybrid methods typically employ fixed fusion strategies, limiting their ability to exploit input-dependent specialization. To address these limitations, this paper proposes an Adaptive Mixture-of-Experts Intrusion Detection System (AMoE-IDS), a hybrid deep learning framework that integrates a shared feature encoder, multiple specialized expert networks, and an adaptive gating mechanism. The shared encoder learns a unified latent representation from heterogeneous feature spaces, while the gating network dynamically routes each input to the most relevant experts, enabling conditional computation and improved detection performance. Extensive experiments conducted on three recent benchmark datasets, CICIoT2023, CSE-CICIDS 2018, and TII-SSRC-23, demonstrate that AMoE-IDS consistently outperforms conventional deep learning and hybrid IDS models. The proposed framework achieves F1-scores of 99.19%, 99.67%, and 99.68% and AUC values of 0.992, 0.991, and 0.990 on CICIoT2023, CSE-CICIDS 2018, and TII-SSRC-23, respectively. Despite its multi-expert architecture, the model maintains low inference latency ranging from 1.28 to 1.56 ms per network flow, supporting real-time deployment. Cross-dataset evaluation confirms the robustness of AMoE-IDS under distribution shifts, while ablation studies highlight the critical role of feature harmonization and adaptive expert selection. Statistical significance analysis further validates the reliability of the observed improvements. Overall, the proposed framework demonstrates competitive performance, good scalability, and improved cross-dataset generalization.

SmartVille: A Framework for Realistic Deep Learning-Based Online Network Intrusion Detection

SmartVille is introduced, a framework for formulating and studying deep learning-based NID under online, open-world, and multi-modal assumptions, and providing a principled way to design, train, and benchmark adaptive NID models under realistic assumptions while separating the theoretical contribution from its open-source implementation.

Multi-Class Network Intrusion Detection: Machine and Deep Learning Benchmark with Live Stream Deployment

FLMLog: A Federated LLM Framework for Unified Online Log Anomaly Detection

Anomaly detection plays a pivotal role in ensuring the reliability of modern large-scale distributed systems. However, traditional log anomaly detection systems are centralized, which poses the risk of privacy leakage during data transmission. Previous research mainly focuses on single-domain logs,requiring domain-specific models and retraining, which limits flexibility and scalability. Significant advancements have been made by Large Language Models (LLMs) in the domains of natural language understanding and automated content creation. However,they still face persistent problems, including substantial computational costs and inadequate availability of training data. The combination of Federated Learning (FL) and LLMs (federated LLMs) offers a solution by leveraging distributed data while protecting privacy, which positions it as an ideal choice for sensitive domains. In this paper, we propose a unified online log anomaly detection framework, FLMLog, which is based on federated Learning and large language model. To enhance the operational efficiency, the FLMLog framework adopts a prefix-aware in-context learning (ICL) refinement strategy. This strategy is specifically designed to refine both the selection of in-context examples and the per-mutation order of these examples, thereby achieving an improvement in prefix caching efficiency. Our experiments demonstrate that the FLMLog framework is rigorously evaluated on five publicly available production log datasets, and the results show that it achieves superior comprehen-sive performance, outperforming state-of-the-art methods in F1-score on four out of five datasets with remarkable improvements.

Towards Secure and Robust Federated Learning

Federated Learning (FL) is a new way to train machine learning models across many decentralized devices while keeping data private. In Intrusion Detection Systems (IDS), FL allows different networks to share security intelligence without sharing sensitive raw data. However, this decentralized structure makes the system vulnerable to security risks, especially poisoning attacks. In these attacks, malicious clients provide fake updates to damage the global model's accuracy. This paper studies how to defend FL-based IDS against these threats. We evaluate two main defenses: robust aggregation techniques and client selection strategies. Our experiments show that these methods successfully maintain high IDS performance even when many clients are compromised. The findings offer a practical guide for building secure and privacy-preserving intrusion detection systems