Trust-Aware Federated Deep Learning for Network Anomaly Detection Under Non-IID Data

Abstract

Distributed network systems produce complex traffic flows that are hard to analyze with a centralized architecture of Intrusion Detection Systems. Traffic distributions are different between participating edge nodes, and it can involve sharing sensitive traffic information and require more communication. A trust-aware federated anomaly detection framework based on a Hybrid Long Short-Term Memory Autoencoder is proposed to detect anomalies in networks with non-independent and identically distributed data. To avoid divergence from local data, FedProx is integrated with the client-side optimization, and to avoid the impact of low-confidence model updates, trust-aware aggregation is employed. The experimental study is based on the CSE-CIC-IDS2018 intrusion dataset where the clients are unequally partitioned, and the performance of convergence, communication cost, non-IID performance, energy consumption, and detection metrics are evaluated. Better detection performance is noted using the proposed system than the baseline models.