GLANet: global and local anomaly network for distributed cyber threat detection using FL

This paper introduces GLANet, a novel FL-based framework designed for real-time, privacy-preserving anomaly detection in distributed network environments. GLANet is a FL-based framework that integrates a lightweight convolutional neural network (CNN) as a local anomaly detector at each distributed node with a global model aggregation mechanism based on federated averaging (FedAvg). The framework incorporates consistency regularization to align local and global model parameters, ensuring that node-specific threat patterns are preserved while enabling network-wide generalization. Differential privacy is employed through the injection of calibrated Gaussian noise into model updates before transmission to the central server, providing formal privacy guarantees without compromising detection performance. The experimental findings reveal that GLANet achieves a high detection accuracy of 97.8% on the CICIDS 2017 dataset, surpassing traditional FL baselines that achieved 92.7%. The model also achieves superior precision (96.5%), recall (97.0%), and F1 Score (96.8%), reflecting a well-balanced anomaly detection performance. Additionally, GLANet reduces communication costs by 37.5% and achieves a lower privacy loss of ε = 0.8 compared to 1.5 in baseline methods. These findings demonstrate the potential of GLANet as an effective, scalable, and secure anomaly detection framework for comprehensive defense against evolving cyber threats in dynamic and distributed network environments.