AnomLocal: A hybrid local-global anomaly detection model for network security using federated learning

Area of Science:

• Cybersecurity
• Network Security
• Machine Learning

Background:

• Distributed network security faces challenges from diverse data and sophisticated attacks.
• Traditional anomaly detection systems struggle with balancing local accuracy and global generalization.
• Centralized and local-only models present privacy risks and performance limitations.

Purpose of the Study:

• To introduce AnomLocal, a hybrid framework for scalable, privacy-preserving, and adaptive network protection.
• To address the limitations of existing anomaly detection models in distributed environments.
• To enhance the reliability and efficiency of intrusion detection systems.

Main Methods:

• Developed AnomLocal, a hybrid anomaly detection framework integrating local learning with federated aggregation.
• Utilized an enhanced Federated Averaging (FedAvg) mechanism for global model parameter aggregation.
• Trained neural models independently on client nodes using local data.

Main Results:

• AnomLocal achieved 93.5% accuracy, 92.8% precision, and 91.5% recall on the UNSW-NB15 dataset.
• Outperformed both centralized and standalone local anomaly detection models.
• Reduced detection latency by 25%, enabling real-time operation in large-scale networks.

Conclusions:

• AnomLocal offers a robust, interpretable, and efficient solution for next-generation distributed intrusion detection.
• The framework effectively unifies local data sensitivity with global adaptability.
• AnomLocal provides a privacy-preserving approach to securing distributed network infrastructures.