Federated dual correction intrusion detection system: Efficient aggregation for heterogeneous data

Abstract

Federated learning-based intrusion detection system (FL-IDS) can effectively ensure global security without the concerns of data privacy, becoming the primary defense method for distributed networks. However, the inherent challenge of heterogeneous data in FL brings client drift to IDS. Besides, the dynamic learning of FL further aggravates model bias caused by the sparsity of malicious traffic. Therefore, we propose a federated dual correction intrusion detection system called FIST-G2 to optimize global aggregation. In the first correction, a momentum-like update mechanism with gradient memory is proposed to solve the client drift. Specifically, with the gradient memory buffer, we leverage the current updated gradient change, historical information, and global information to fix the momentum factor used in global model update. We propose gradient memory buffering strategy in this mechanism to dynamically maintain the information of each client, particularly the records of stragglers. In the second correction, a fine-tuning mechanism with GAN boundary samples is proposed to alleviate the model bias. A generator, deployed on the server, which extracts local models’ knowledge by data-free knowledge distillation, is used to supplement rare traffic. By forming an adversarial training pattern instead of direct data balancing, a GAN boundary samples mining scheme is introduced to keep the ambiguity of samples to improve global model constantly. Extensive experiments on UNSW-NB15 dataset and CICIDS2018 dataset show that the proposed method is robust for heterogeneous data and completely compatible with many client-side optimization algorithms, having excellent scalability and portability.