GLANet: global and local anomaly network for distributed cyber threat detection using FL.

Area of Science:

• Cybersecurity
• Network Security
• Machine Learning

Background:

• Distributed network environments face challenges in real-time anomaly detection due to data privacy and communication constraints.
• Existing federated learning (FL) approaches often struggle to balance detection performance with privacy preservation and communication efficiency.

Purpose of the Study:

• To introduce GLANet, a novel FL-based framework for real-time, privacy-preserving anomaly detection in distributed networks.
• To enhance anomaly detection accuracy and efficiency in distributed systems while ensuring robust privacy guarantees.

Main Methods:

• GLANet integrates a lightweight convolutional neural network (CNN) for local anomaly detection with federated averaging (FedAvg) for global model aggregation.
• Consistency regularization is employed to align local and global model parameters, preserving node-specific threat patterns for network-wide generalization.
• Differential privacy is implemented via calibrated Gaussian noise injection into model updates to provide formal privacy guarantees.

Main Results:

• GLANet achieved a high detection accuracy of 97.8% on the CICIDS 2017 dataset, outperforming traditional FL baselines (92.7%).
• The framework demonstrated superior precision (96.5%), recall (97.0%), and F1 Score (96.8%), indicating balanced anomaly detection performance.
• GLANet reduced communication costs by 37.5% and achieved a lower privacy loss (ε=0.8) compared to baseline methods (ε=1.5).

Conclusions:

• GLANet presents a scalable and secure solution for anomaly detection in dynamic, distributed network environments.
• The framework effectively addresses the trade-offs between detection performance, privacy, and communication efficiency in federated learning.
• GLANet shows significant potential for comprehensive defense against evolving cyber threats.