Federated Learning for Privacy-Preserving Collaborative Intrusion Detection

Abstract

An intrusion-detection model learns best from large and varied data, yet theorganisations that hold such data are reluctant, and often legally unable, toshare their network records, which are sensitive and may reveal theirvulnerabilities, so that each organisation is left to train on its own limited data. Federated learning offers a way out of this dilemma, allowing manyorganisations to train a shared model collaboratively without any of themdisclosing its raw data. This study applies federated learning to collaborativeintrusion detection and compares it with the alternatives of centralizedtraining, which requires data to be pooled, and local-only training, in whicheach organisation learns alone. Several participants, each holding its ownintrusion data, repeatedly trained a shared detection model locally andcombined their improvements through a central coordinator, exchanging only model updates and never the data itself, and the accuracy of the resulting model was measured over successive rounds and set against the centralized and local-only baselines. The federated model improved steadily as the rounds proceeded, approaching the accuracy of the centralized model that had access to all the pooled data and substantially exceeding the accuracy that any participant achieved by training on its own data alone, while no participant ever revealed its raw records. The study shows that federated learning enables organisations to build an effective shared intrusion detector without sacrificing the privacy of their data, reconciling the need for collaboration in cyber defence with the requirements of digital trust and confidentiality. KEYWORDS: Federated learning, Intrusion detection, Privacy preservation,Collaborative defence, Digital trust, Distributed learning, Data confidentiality, Model aggregation, Cyber defence