Enhancing Transferability using Federated Learning for ML-based Network Intrusion Detection

Abstract

Network Intrusion Detection Systems (NIDS) are critical for securing network-connected devices, yet their ability to detect novel attacks remains limited due to poor transferability across attack classes. This thesis explores federated learning (FL) to enhance transferability in NIDS, addressing privacy and data heterogeneity challenges in cross-device settings. Using the CIC-IDS 2017 dataset, we implemented FedAdam and Fedprox, two different Federated Learning Techniques, toimproveconvergenceoverthebaselineFedAvgalgorithm in a federated setup. Experiments revealed that FedAdam and FedProx yield improvements in validation accuracy. We also used Synthetic Minority Oversampling Technique (SMOTE) other thanBootstrapping for classbalancing, simulaterealisticvariationsandimprovemodel robustness. These methods aim to better tackle non-IID data and class imbalance, critical for transferability. This study underscores the potential of FL in NIDS, offering a foundation for developing models that can generalize across diverse attack classes while preserving privacy, with future work focusing on optimizing adaptive methods and integrating more diverse datasets.