A Federated Heterogeneous Ensemble Framework for Detecting Low-Rate Distributed Denial-of-Service Attacks

Abstract

Detecting low-rate distributed denial-of-service (LR-DDoS) attacks remains challenging because their traffic profiles closely resemble legitimate network activity, making them difficult to identify using conventional intrusion detection systems. This study proposes a federated heterogeneous ensemble framework for LR-DDoS detection under non-IID data conditions. Five local classifiers, Logistic Regression, Random Forest, SVM, Gradient Boosting, and MLP, are trained on locally partitioned datasets generated through Dirichlet-based distribution, and their probabilistic outputs are combined via a softmax-weighted aggregation mechanism. Experiments using the CICDDoS2019 dataset with a 70/15/15 train-validation-test split and results averaged over 10 independent seeds show that local model accuracy ranges from 0.664 to 0.917 under non-IID conditions. The proposed federated ensemble achieves a mean accuracy of 0.925 0.008 and F1-score of 0.910 0.009, outperforming all individual models and two alternative aggregation strategies. These results indicate that combining heterogeneous model architectures with adaptive prediction-level aggregation improves detection robustness in distributed intrusion detection systems