Distributed cyber defense framework based on federated learning for attack detection in defense infrastructure - Saragih, Hondor; Saragih, Hoga; Manurung, Jonson; Adha, Rochedi Idul; Naibaho, Frainskoy Rio (Journal of Intelligent Decision Support System (IDSS), 2026)
Cyber threats targeting defense infrastructure have escalated in complexity, rendering centralized intrusion detection systems insufficient due to their inability to guarantee data privacy across distributed military nodes. This study proposes a distributed cyber defense framework that employs federated learning to enable collaborative model training without transmitting raw network traffic beyond individual nodes. The framework integrates an adaptive aggregation strategy combining FedAvg and FedProx, a hybrid deep learning architecture consisting of convolutional neural networks and long short term memory networks, an autoencoder module for unsupervised anomaly detection, a Byzantine robust aggregation mechanism, and post hoc explainability through SHAP and LIME. Experiments were conducted on CIC IDS 2017, CIC IDS 2018, UNSW NB15, and a synthetically generated military network traffic dataset. The proposed framework attained a peak accuracy of 98.74% and an F1 score of 98.12% on CIC IDS 2017, consistently outperforming five baseline methods by up to 5.29 percentage points in F1 score. Future work will investigate differential privacy integration and model compression for deployment on resource constrained tactical edge devices.