A personalized federated hypernetworks based aggregation approach for intrusion detection systems

Area of Science:

• Cybersecurity
• Machine Learning
• Internet of Things (IoT)

Background:

• Traditional Network Intrusion Detection Systems (NIDS) struggle with IoT data scalability and privacy concerns.
• Federated Learning (FL) offers privacy-preserving distributed training but faces challenges with model personalization and communication overhead, especially in Non-IID settings.
• Existing security enhancements increase computational costs and may still expose data patterns.

Purpose of the Study:

• To develop a novel, privacy-preserving, and efficient federated learning strategy for Network Intrusion Detection Systems (NIDS) in dynamic IoT environments.
• To address the limitations of conventional FL, including the need for uniform model architectures and high communication overhead during weight aggregation.
• To enhance personalization and adaptability in NIDS for heterogeneous and Non-IID data distributions.

Main Methods:

• Proposed Personalized Federated Hypernetworks-based aggregation strategy for Intrusion Detection Systems (PerFedHypID).
• Utilized embedding vectors instead of weight aggregation for computationally lighter and personalized learning.
• Leveraged personalized layers and hypernetwork-based aggregation for efficiency and adaptability.
• Evaluated PerFedHypID on CSE-CICIDS-2018 and UNSW-NB-15 datasets under non-IID heterogeneous settings.

Main Results:

• PerFedHypID demonstrated superior performance compared to state-of-the-art personalized federated learning algorithms.
• The proposed method achieved robust performance and improved adaptability in dynamic IoT environments.
• Embedding vector utilization proved computationally lighter and enabled enhanced personalization.

Conclusions:

• PerFedHypID effectively addresses scalability and privacy challenges in IoT-based NIDS.
• The hypernetwork-based aggregation strategy offers a more efficient and adaptable alternative to traditional FL methods.
• This approach provides a robust solution for intrusion detection in heterogeneous, dynamic IoT ecosystems.