A federated transformer-enhanced double Q-network for collaborative intrusion detection

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Network Security

Background:

• The increasing prevalence of Internet of Things (IoT) devices presents significant cybersecurity challenges.
• Traditional centralized Network Intrusion Detection Systems (NIDS) struggle with privacy concerns and modeling complex spatiotemporal data.
• Limitations in current NIDS necessitate advanced, privacy-preserving solutions for dynamic threat detection.

Purpose of the Study:

• To propose FedT-DQN, a novel federated reinforcement learning framework for dynamic network intrusion detection.
• To address the limitations of centralized NIDS, including privacy risks and inadequate spatiotemporal correlation modeling.
• To develop a robust and privacy-preserving intrusion detection system for the growing IoT ecosystem.

Main Methods:

• Developed FedT-DQN, integrating a Transformer encoder with self-attention for federated aggregation.
• Implemented a dual-layer Q-network architecture for feature extraction and decision optimization in intrusion detection.
• Utilized Soft Actor-Critic (SAC) for local training, accommodating system heterogeneity in a federated setting.

Main Results:

• Achieved high detection accuracy exceeding [Formula: see text] across four benchmark datasets.
• Demonstrated significant improvements in F1 scores, indicating better detection performance.
• Successfully reduced false positive rates while ensuring data privacy throughout the detection process.

Conclusions:

• FedT-DQN offers a powerful and privacy-preserving approach to dynamic network intrusion detection.
• The framework effectively models spatiotemporal correlations and handles system heterogeneity.
• This method represents a significant advancement in securing IoT environments against cyber threats.