A federated learning method for network intrusion detection

Abstract Intrusion detection is a common network security defense technology. At present, there are many research using deep learning to realize network intrusion detection. This method has been proved to have high detection accuracy. However, deep learning requires large‐scale data sets for training. The network intrusion detection data set of some institution is lacking. If the network traffic data set is uploaded for centralized deep learning training, it will face privacy problems. Combined with the characteristics of network traffic, this article proposes a network intrusion detection method based on federated learning. This method allows multiple ISPs or other institutions to conduct joint deep learning training on the premise of retaining local data. It not only improves the detection accuracy of the model but also protects privacy in network traffic. This article conducts experiments on the CICIDS2017 network intrusion detection data set. Experimental results show that worker participating in federated learning have higher detection accuracy. The accuracy and other performance of federated learning are almost equal to those of centralized deep learning models.