Segmented Federated Learning for Adaptive Intrusion Detection System

TL;DR

This paper introduces a Segmented-Federated Learning approach for network intrusion detection, enabling organizations to collaboratively improve security models while preserving data privacy and addressing data heterogeneity.

Contribution

The paper proposes a novel Segmented-Federated Learning scheme that groups similar network environments for more effective intrusion detection, improving over standard FL and centralized methods.

Findings

Segmented-FL outperforms traditional FL and centralized models on standard datasets.

The segmentation improves model accuracy by grouping similar network environments.

Weighted aggregation based on data samples enhances model performance.

Abstract

Cyberattacks are a major issues and it causes organizations great financial, and reputation harm. However, due to various factors, the current network intrusion detection systems (NIDS) seem to be insufficent. Predominant NIDS identifies Cyberattacks through a handcrafted dataset of rules. Although the recent applications of machine learning and deep learning have alleviated the enormous effort in NIDS, the security of network data has always been a prime concern. However, to encounter the security problem and enable sharing among organizations, Federated Learning (FL) scheme is employed. Although the current FL systems have been successful, a network's data distribution does not always fit into a single global model as in FL. Thus, in such cases, having a single global model in FL is no feasible. In this paper, we propose a Segmented-Federated Learning (Segmented-FL) learning scheme for a more efficient NIDS. The Segmented-FL approach employs periodic local model evaluation based on which the segmentation occurs. We aim to bring similar network environments to the same group. Further, the Segmented-FL system is coupled with a weighted aggregation of local model parameters based on the number of data samples a worker possesses to further augment the performance. The improved performance by our system as compared to the FL and centralized systems on standard dataset further validates our system and makes a strong case for extending our technique across various tasks. The solution finds its application in organizations that want to collaboratively learn on diverse network environments and protect the privacy of individual datasets.