Cluster-based Federated Learning Framework for Intrusion Detection

With the rapid development of Industrial Internet, the network intrusion detection has become particularly important. In the Industrial Internet, large-scale data is distributed in the edge nodes caused the joint analysis of network intrusion detection at each edge node has become necessary. Federated learning structure can avoid data out of local nodes to protect user privacy data. However, the data distribution is different for each edge nodes, which limits the effectiveness of federated learning models. We focus on the non-IID data features and propose a new cluster-based federated learning framework for network intrusion detection. In this method, we cluster clients into different communities by data labels, which the clients contain the similar proportion of data labels in the same community. Based on the clustering results, we decompose federated learning model aggregation into cluster aggregation and global aggregation by leveraging similarities both within and between clusters. We conduct extensive experiments based on UNSW_NB15 dataset. The results show that our method has better performance than FedAvg and FedProx. It can work well in scenarios with different distributions of data samples while ensuring data security and privacy protection.