Federated transfer learning for rare attack class detection in network intrusion detection systems

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• Federated learning (FL) enables model training with reduced data sharing, improving privacy.
• Effective FL-based network intrusion detection systems (NIDS) are hindered by the need for extensive, diverse datasets.
• Detecting rare and zero-day cyberattacks remains a significant challenge in NIDS.

Purpose of the Study:

• To introduce a novel FL framework to enhance NIDS performance.
• To improve the detection of rare attack classes and identify zero-day attacks.
• To reduce false alarm rates for novel attack types.

Main Methods:

• Incorporation of adaptive, personalized layers at the client level within the FL framework.
• Leveraging Transfer Learning (TL) for zero-day attack identification.
• Utilizing client-specific gradients to update a server-side global model.

Main Results:

• The proposed FL framework demonstrated superior performance in detecting rare and novel attack types across multiple datasets (CICIDS-2018, Edge IIoT, UNSW-NB 15).
• Achieved high accuracy rates: 98.90% on CICIDS-2018, 98.70% on UNSW-NB 15, and 97.92% on Edge-IIoT.
• Outperformed the FL-TL-CNN model by significant margins, indicating enhanced robustness and adaptability.

Conclusions:

• The novel FL framework effectively addresses challenges in NIDS, particularly for rare and zero-day attacks.
• The adaptive, personalized, and TL-enhanced approach offers a robust and sustainable solution for intrusion detection.
• The study highlights the framework's adaptability across heterogeneous network environments, improving overall cybersecurity posture.