An Explainable Federated Intrusion Detection Framework for SDN Using Distributed Key Generation and Threshold Homomorphic Encryption

Abstract

The rapid advancement of software-defined networking (SDN) has enhanced network programmability, centralized control, and traffic management flexibility, while also increasing exposure to sophisticated attacks targeting the control plane. Although federated learning (FL) enables collaborative intrusion detection without centralized raw data sharing, existing FL-based intrusion detection systems remain vulnerable to plaintext model update leakage, centralized cryptographic trust, limited interpretability, and insufficient validation in operational SDN environments. To address these limitations, this paper presents an explainable federated intrusion detection framework that integrates distributed key generation (DKG), CKKS-based threshold homomorphic encryption, collaborative decryption, and SHapley Additive exPlanations (SHAP). Unlike conventional HE-enabled FL systems that rely on a trusted authority or a globally shared secret key, the proposed framework removes the trusted key-generation dealer, avoids centralized custody of the complete secret key, and prevents any single client or aggregation server from independently decrypting ciphertexts using locally held key material. A gated recurrent unit (GRU)-based model is used for privacy-preserving intrusion detection, and SHAP provides global and local explanations of model decisions. The framework is further deployed in a real-time SDN testbed to evaluate the online inference pipeline following threshold-secured federated training. Computationally intensive cryptographic operations, including DKG, encrypted aggregation, and threshold decryption, are performed during offline training, while the converged global model enables low-latency inference at runtime. Experiments on the InSDN, CICDDoS2017, and CICDDoS2019 datasets with 4, 8, and 12 client federated configurations achieved detection accuracies above 99% across all datasets. The evaluation also examines encryption latency, collaborative decryption overhead, secure aggregation cost, communication complexity, and scalability. The results demonstrate that the proposed framework provides a practical balance among decentralized key management, privacy-preserving aggregation, explainability, detection performance, and real-time SDN deployment feasibility.