Federated Continual Learning for Intrusion Detection: A Drift-Aware Benchmark on the Windows-APT 2025 Dataset

Ilham Achmad Fiqrin (School of Computing and Informatics, Universiti Teknologi Brunei, Jalan Tungku Link, Gadong, Bandar Seri Begawan, Brunei Darussalam)
Taufiq Hidayat (Department of Informatics, Faculty of Industrial Technology, Universitas Islam Indonesia Yogyakarta, Indonesia)

ARMADA : Jurnal Penelitian Multidisiplin
Vol. 4 No. 9 (2026): ARMADA : Jurnal Penelitian Multidisplin, September 2026

Federated Learning (FL) enables collaborative intrusion detection among organizations without sharing raw telemetry data. However, existing FL approaches often assume static learning environments, limiting their effectiveness in detecting Advanced Persistent Threats (APTs) with continuously evolving behaviors. This study proposes a Federated Continual Learning (FCL) benchmark for APT technique detection using the Windows-APT 2025 dataset. Following a validation-first paradigm, the dataset characteristics, including client participation, label reliability, and behavioral drift, are analyzed to establish an appropriate evaluation framework. The benchmark evaluates Replay, EWC, and DER++ continual learning methods combined with FedAvg and FedProx optimization strategies, using MLP and 1D-CNN architectures with drift-triggered adaptation. Experimental results show that Replay and EWC achieve up to 23% higher multi-label F1 performance than DER++ under limited local training conditions. FedAvg consistently outperforms FedProx, while MLP surpasses 1D-CNN with approximately one-third of the communication overhead. These findings demonstrate the effectiveness of the proposed benchmark for evaluating drift-aware federated intrusion detection systems.