Collective Intelligence for Cybersecurity: Federated Learning under Non-IID Conditions for Intrusion Detection - Mohammed, Hutheifa Anwar; Awos Kh. Ali (Sinkron : jurnal dan penelitian teknik informatika, 2025)
Cyber threats are becoming increasingly complex in cyberspace, which highlights the necessity for strong Intrusion Detection Systems (IDS). However, traditional centralized IDS methods have large problems with data privacy and scalability. Federated Learning (FL) is an intriguing new idea that lets multiple clients train a model together without sharing data directly, which keeps privacy intact. The proposed federated intrusion detection model develops and assesses FL models for detecting network intrusions, focusing on the important issue of non-independent and non-identically distributed (non-IID) data among clients. This work implements and compares two widely recognized FL algorithms, Federated Averaging (FedAvg) and Federated Proximal (FedProx), using a 1D Convolutional Neural Network (CNN) architecture specifically designed for tabular network traffic data. The authors utilize a Dirichlet distribution (α=0.1) to distribute the data among 10, 20, and 30 clients, thereby simulating non-IID conditions in the experiment. The authors thoroughly compare the performance of algorithms using two benchmark datasets: NSL-KDD and NF-Bot-Net-V2. The comparison reveals that while both FedAvg and FedProx achieve high detection rates on NSL-KDD, FedProx is more capable of maintaining stability and converging on the more complex NF-Bot-Net-V2 dataset, achieving an accuracy of 0.9953. The results highlight that FedProx is a more appropriate algorithm for implementing robust and privacy-preserving federated intrusion detection systems in statistically heterogeneous network environments found in the real world.