Federated Learning-Based Network Intrusion Detection with a Feature Selection Approach

With the increase and diversity of network attacks, machine learning has shown its efficiency in realizing intrusion detection. Federated Learning (FL) has been proposed as a new distributed machine learning approach, which collaboratively trains a prediction model by aggregating local models of users without sharing their privacy-sensitive data. Recently, the approach is applied to optimize intrusion detection for resourced-constrained environments. However, since the attacks are becoming more sophisticated and targeted, there is also a growing need to enhance detection models according to the characteristics of attack type; meanwhile, choosing effective feature sets from the network traffic characteristics is considered one of the most important technologies in data analysis. In this paper, we first proposed a federated learning-based intrusion detection system with feature selection technology. Firstly, a greedy algorithm is suggested to select features that achieve better intrusion detection accuracy regarding different attack categories. Afterward, multiple global models are generated by the server in federated learning, according to the decided features of edge devices. For evaluating the effectiveness of the proposed approach, simulation experiments based on the latest on-device neural network for anomaly detection are conducted over the NSL-KDD dataset. Experimental results demonstrate greatly improved accuracy of our method.