GowFed A novel federated network intrusion detection system

Network intrusion detection systems are evolving into intelligent systems that perform data analysis while searching for anomalies in their environment. Indeed, the development of deep learning techniques paved the way to build more complex and effective threat detection models. However, training those models may be computationally infeasible in most Edge or IoT devices. Current approaches rely on powerful centralized servers that receive data from all their parties - violating basic privacy constraints and substantially affecting response times and operational costs due to the huge communication overheads. To mitigate these issues, Federated Learning emerged as a promising approach, where different agents collaboratively train a shared model, without exposing training data to others or requiring a compute-intensive centralized infrastructure. This work presents GowFed, a novel network threat detection system that combines the usage of Gower Dissimilarity matrices and Federated averaging. Different approaches of GowFed have been developed based on state-of the-art knowledge: (1) a vanilla version - achieving a median point of [0.888, 0.960] in the PR space and a median accuracy of 0.930; and (2) a version instrumented with an attention mechanism - achieving comparable results when 0.8 of the best performing nodes contribute to the model. Furthermore, each variant has been tested using simulation oriented tools provided by TensorFlow Federated framework. In the same way, a centralized analogous development of the Federated systems is carried out to explore their differences in terms of scalability and performance - the median point of the experiments is [0.987, 0.987]) and the median accuracy is 0.989. Overall, GowFed intends to be the first stepping stone towards the combined usage of Federated Learning and Gower Dissimilarity matrices to detect network threats in industrial-level networks.

Automated summary

Network intrusion detection systems are evolving into intelligent systems that perform data analysis while searching for anomalies in their environment. Federated Learning, combined with Gower Dissimilarity matrices, is proposed as a promising approach to overcome the computational limitations of training complex threat detection models on Edge or IoT devices. GowFed, a novel network threat detection system, is introduced that achieves good results in terms of accuracy and PR score. The system is tested using simulation tools provided by TensorFlow Federated framework and compared to a centralized analogous development of Federated systems.