Privacy-Preserving Intrusion Detection using Federated Learning in Distributed Networks

Abstract

The rapid growth of things like distributed computing, cloud platforms, edge setups, and all kinds of IoT devices have greatly disrupted how our networks work. But while these developments bring some progress, they have also made cyber attacks more frequent and sophisticated. Conventional tools for detecting these problems—old-school intrusion detection systems—usually rely on funneling all traffic to a single location. This creates headaches for privacy, keeping up as networks grow, and complying with data regulations. In this paper, we propose a novel approach: a privacy-friendly intrusion detection system (PP-IDS) that operates on the basis of conjoint learning. Instead of combining all network activity and risking exposure, each part of the system uses its own data to develop a detection model. Only model improvements (not raw data) are shared with the central server using a group update method called federated averaging. And we're adding two additional layers—secure aggregation and differentiated privacy—to further lock things down and protect against data leaks when changing models. We performed tests using well-known datasets such as NSL-KDD and CICIDS2017, measuring things like accuracy, attack flow capture, false alarms, and how many network conversations the method requires. Our setup keeps up with other intrusion detection systems, but provides better privacy protection, runs smoothly as things grow, and recovers from problems more easily than a typical centralized setup. This makes PP-IDS suitable for cloud services, edge devices, Internet of Things networks or business systems – basically anywhere that data needs to remain private. Taken together, our findings suggest that federated learning can indeed lay the foundations for smarter, privacy-respecting, and more scalable tools to keep modern networks secure..