Fed-UGI: Federated Undersampling Learning Framework with Gini Impurity for Imbalanced Network Intrusion Detection

In the modern interconnected world, the popularization of networks and the rapid development of information technology led to the increasing security risks and threats in network systems. The existing intrusion detection system is constantly challenged by various malicious intrusion attacks. Machine learning algorithms have been widely used in intrusion detection. However, the model training requires the support of a sufficient high-quality samples, especially attack traffic data. Network intrusion detection datasets may not be shared between organizations due to data security and some privacy policy concerns. The federated learning framework is an optimal approach to address this issue, in which organizations collaborate to train a global model shared by multiple parties while keeping the data local to the client, guaranteeing the data privacy and security of all parties. However, there is a problem of class imbalance in the network traffic data owned by the organizations, which seriously affects the detection performance of the model and leads to a high consumption of model training time. Therefore, this study proposed a novel federated undersampling learning framework with Gini impurity, namely Fed-UGI. The framework is based on the hash-based block undersampling method to rebalance the client, which can solve the influence of imbalanced training data on the model detection performance and improve the model training efficiency. Moreover, the client weighted aggregation strategy based on Local Gini impurity can further optimize the effect of global model aggregation and reduce the impact of the dispersion degree and information difference in client data on model aggregation. In addition, extensive experiments on intrusion detection datasets show that compared to SOTA methods, the proposed Fed-UGI method has a good detection effect on the three metrics of F1-score, G-mean and AUC, the training time of the model is reduced by 51.76%-92.58%, especially in highly class imbalance situation.