Communication-efficient federated multi-domain learning for network anomaly detection

Abstract

Efficient and accurate anomaly detection in a network is of great significance for maintaining network and device security. Most anomaly detection methods assume that different anomalous network data distributions are the same or similar and ignore data privacy preservation. In this paper, a novel Federated Learning (FL) is proposed that it can quickly detect different types of anomalies in Non-Independent and Identically Distributed (Non-IID) data. First, we design a multi-domain machine learning model for multi-domain data, named Aegean, which consists of two modules: an ensemble AutoEncoder (AE) and a Generative Adversarial Network (GAN). Second, because data from different domains are non-IID, we model the anomaly detection problem as a dual problem, which can be recast as a robust optimization problem. The robust optimization problem is non-convex and therefore difficult to solve. As a remedy, we formulate and solve a dual problem by taking the Lagrangian dual function of the original problem. Experiments demonstrate that Aegean significantly outperforms the current state-of-the-art methods, with a 16% F1 score improvement over that of a One-Class Support Vector Machine (OCSVM). The designed FL significantly reduces the communication overhead of FedAvg without sacrificing anomaly detection performance.