Federated deep learning for distributed intrusion detection and privacy preservation in power networks

The deepening cyber-physical integration of smart grids has expanded the attack surface of power networks, while centralised intrusion detection schemes struggle with data silos, privacy exposure, and prohibitive communication costs across geographically dispersed substations. This paper proposes a federated deep learning framework that addresses these constraints jointly. A three-tier cloud-edge-terminal architecture confines raw measurements to local devices and exchanges only model parameters across tiers. At each edge node, a hybrid CNN-BiLSTM detector trained under focal loss captures both spatial protocol motifs and temporal attack signatures, including stealthy false data injection and APT traces. Privacy is preserved through a layer-selective mechanism that combines Paillier homomorphic encryption on sensitive gradient slices with calibrated differential privacy on the residual components, pushing the privacy-utility frontier outward without saturating cryptographic cost. An adaptive aggregation rule weights client updates by data quality, drift severity, and marginal validation contribution, mitigating the convergence pathologies that vanilla FedAvg exhibits under sharp non-IID partitioning. Experiments on NSL-KDD, CICIDS2017, and an ICS power-system corpus show that the proposed scheme recovers within 0.7 F1 points of the centralised upper bound, suppresses membership inference advantage to below 0.08, holds detection quality against up to 20% Byzantine clients, and converges in roughly half the rounds required by FedAvg. The framework offers a deployable path toward collaborative intrusion detection across regional grid operators without compromising data sovereignty.