Claim Missing Document
Check
Articles

Found 1 Documents
Search

Federated Continual Learning for Intrusion Detection: A Drift-Aware Benchmark on the Windows-APT 2025 Dataset Ilham Achmad Fiqrin; Taufiq Hidayat
ARMADA : Jurnal Penelitian Multidisiplin Vol. 4 No. 9 (2026): ARMADA : Jurnal Penelitian Multidisplin, September 2026
Publisher : LPPM Sekolah Tinggi Ilmu Ekonomi 45 Mataram

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.55681/armada.v4i9.3928

Abstract

Federated Learning (FL) enables collaborative intrusion detection among organizations without sharing raw telemetry data. However, existing FL approaches often assume static learning environments, limiting their effectiveness in detecting Advanced Persistent Threats (APTs) with continuously evolving behaviors. This study proposes a Federated Continual Learning (FCL) benchmark for APT technique detection using the Windows-APT 2025 dataset. Following a validation-first paradigm, the dataset characteristics, including client participation, label reliability, and behavioral drift, are analyzed to establish an appropriate evaluation framework. The benchmark evaluates Replay, EWC, and DER++ continual learning methods combined with FedAvg and FedProx optimization strategies, using MLP and 1D-CNN architectures with drift-triggered adaptation. Experimental results show that Replay and EWC achieve up to 23% higher multi-label F1 performance than DER++ under limited local training conditions. FedAvg consistently outperforms FedProx, while MLP surpasses 1D-CNN with approximately one-third of the communication overhead. These findings demonstrate the effectiveness of the proposed benchmark for evaluating drift-aware federated intrusion detection systems.