Using Federated Learning for Collaborative Intrusion Detection Systems

Abstract

Neural networks have become cutting edge machine learning models for detecting network attacks. Traditional implementations provide fast and accurate predictions, but require centralised storage of labelled historical data for training. This solution is not always suitable for real-world applications, where regulatory constraints and privacy concerns hamper the collection of sensitive data into a single server. Federated Learning has recently been proposed as a framework for training a centralised model without the need to share data between different providers. We use the CICIDS2017 dataset provided by the Canadian Institute of Cybersecurity to demonstrate the benefits of Neural Networks-based Federated Learning for the detection of the most relevant types of network attacks. We conclude that a federated-trained neural network outperforms locally-trained models (at isoarchitecture) in terms of F1-score and False Negative detection ratio. Further, such model has a minor loss of performance and convergence rapidity compared to a model trained over a hypothetical centralised dataset.