Hybrid Federated Learning for Privacy-Preserving Intrusion Detection in Heterogeneous Network Environments

Abstract

Centralized deep-learning intrusion detection systems (IDS) are accurate, but they scale badly and require raw traffic to be collected on one server, which creates privacy and communication problems. Federated learning (FL) avoids moving the data: clients train a shared model and exchange only updates. Its weakness is that accuracy drops when the clients hold non-IID data, which is the usual situation for IDS. This paper proposes a hybrid framework that starts from a centrally trained model, fine-tunes it on each client, and merges the results by weighted averaging, so the model keeps a global view while still adapting locally. We test it on three public datasets that differ considerably in their traffic and attacks (CICIDS2017, UNSW-NB15, and CICDDoS2019), with each dataset acting as one non-IID client, and we compare it against Centralized, FedAvg, FedProx, FedNova, and Personalized FL trained through the same pipeline. The hybrid model reaches $\mathbf{9 5. 3 6} \boldsymbol{\%}$ accuracy and an F1-score of 0.9496. That is close to centralized training (96.68% accuracy) even though client data never leave the clients during the federated stage, and it beats the standard federated baselines by about 8 to 11 points of accuracy. The ROC and precisionrecall results (ROC-AUC 0.9937, PR-AUC 0.9933) show that it holds up under the class imbalance that IDS data usually have.