Federated Intrusion Detection Framework for Heterogeneous Network Traffic Using Multi-Client Deep Learning Aggregation

Abstract

The rapid expansion of cloud computing, Internet of Things (IoT) ecosystems, and large-scale enterprise networks has intensified the complexity and frequency of cyber attacks. Traditional centralized Intrusion Detection Systems (IDS) require aggregation of raw network traffic from multiple distributed sources, raising significant concerns related to data privacy, regulatory compliance, communication overhead, and scalability. These challenges limit effective collaborative security across heterogeneous network environments. This paper presents a federated intrusion detection framework that enables decentralized collaborative learning without sharing raw network traffic data. A lightweight Multilayer Perceptron (MLP) model is trained across three independent federated clients using the Federated Averaging (FedAvg) algorithm. Each client is assigned a distinct real-world benchmark dataset — CICIDS2017, UNSW-NB15, and NSL-KDD — introducing authentic non-IID data heterogeneity in terms of dataset size, feature dimensionality, class imbalance, and attack taxonomy. The framework ensures strict data locality by transmitting only model parameters during aggregation. Experimental results demonstrate that the global federated model achieves 87% accuracy with balanced precision (0.86), recall (0.86), and F1-score (0.85), representing a 20 percentage-point improvement over the weakest local model. Convergence analysis confirms stable performance under non-IID conditions, while communication overhead is reduced by approximately 1000× compared to centralized training.