Federated transfer learning for rare attack class detection in network intrusion detection systems

作者：Chunduru Sri Abhijit, Y. Annie Jerusha, S. P. Syed Ibrahim, Vijay Varadharajan · 发表于：Scientific Reports · 年份：2025 · DOI：10.1038/s41598-025-02068-x · 被引用次数：5 · 研究领域：Medicine

Federated learning (FL) offers a promising approach for training machine learning models with minimal data sharing, enhancing privacy and performance. However, building effective FL-based network intrusion detection systems (NIDS) remains challenging due to the need for large, diverse training datasets. Identifying rare attack types with limited instances is a persistent obstacle, and their detection is critical in cybersecurity. This research introduces a novel FL framework to address these challenges. By incorporating adaptive, personalized layers at the client level, the model reduces false alarm rates for zero-day attack types and improves the detection of rare classes. The model also leverages Transfer Learning (TL) to identify zero-day attacks, where client-specific gradients are collected and used to update a global model on the server side after multiple rounds of exposure to new data. The proposed sustainable framework aims to disseminate knowledge about rare attack types across clients through a server-based global model within the FL ecosystem. This study achieves two main objectives: (i) improving the detection of rare attack classes and (ii) identifying zero-day attacks in a NIDS context. Evaluations on the CSE-CICIDS-2018, Edge IIoT, and UNSW-NB 15 datasets, which encompass diverse class distributions, demonstrate that the proposed approach outperforms existing models in detecting and handling rare and novel attack types. The proposed model achieves 98.90% accur...