PROTEAN: Federated Intrusion Detection in Non-IID Environments through Prototype-Based Knowledge Sharing

TL;DR

PROTEAN is a federated intrusion detection framework that uses prototype-based knowledge sharing to effectively detect diverse cyberattacks in non-IID environments, enhancing collaboration while preserving privacy.

Contribution

It introduces a novel prototype learning approach for federated intrusion detection that handles data heterogeneity and improves attack understanding across organizations.

Findings

Effective detection in highly non-IID attack environments

Improved understanding of attack techniques through prototype sharing

Demonstrated privacy-preserving collaboration on real datasets

Abstract

In distributed networks, participants often face diverse and fast-evolving cyberattacks. This makes techniques based on Federated Learning (FL) a promising mitigation strategy. By only exchanging model updates, FL participants can collaboratively build detection models without revealing sensitive information, e.g., network structures or security postures. However, the effectiveness of FL solutions is often hindered by significant data heterogeneity, as attack patterns often differ drastically across organizations due to varying security policies. To address these challenges, we introduce PROTEAN, a Prototype Learning-based framework geared to facilitate collaborative and privacy-preserving intrusion detection. PROTEAN enables accurate detection in environments with highly non-IID attack distributions and promotes direct knowledge sharing by exchanging class prototypes of different attack types among participants. This allows organizations to better understand attack techniques not present in their data collections. We instantiate PROTEAN on two cyber intrusion datasets collected from IIoT and 5G-connected participants and evaluate its performance in terms of utility and privacy, demonstrating its effectiveness in addressing data heterogeneity while improving cyber attack understanding in federated intrusion detection systems (IDSs).