Towards Fast Network Intrusion Detection based on Efficiency-preserving Federated Learning

Abstract

Network Intrusion Detection Systems (NIDSs) are extremely important in defending against emergent cyberattacks. However, current NIDSs for Internet-of-Things (IoT) devices have not taken actual device computation limitation into account, and are still based on resource-consuming neural networks. In this paper, we propose a simple but effective FL-based NIDS. Specifically, we leverage the characteristic of network traffic data (a kind of tabular data), i.e. slight value change does not affect inherent feature, and use data binning to extract feature data on clients. The feature data are then used for training the classifier on the server. We also use data masking to further enhance data protection. We evaluate our NIDS on the public DDoS attack classification benchmark, and the result shows that our NIDS can achieve comparable performance as locally trained NIDS while significantly reducing the communication cost.