FedGAT-ID: Federated Graph Attention Network with Client Drift-Aware Aggregation for Distributed Cyber Threat Detection

Cyber threat detection in distributed environments presents significant challenges due to data privacy constraints, non-identical data distributions across clients, and the dynamic nature of attacks. This paper introduces FedGAT-ID, a federated intrusion detection framework that integrates Graph Attention Networks (GATs) with a drift-aware aggregation strategy. The proposed method enables clients to model complex flow-level interactions using attention-based graph learning while collaboratively updating a global model without sharing raw data. To address client heterogeneity and drift, a divergence-aware weighting mechanism is employed during aggregation to stabilize learning and improve accuracy. Extensive experiments conducted on the UNSW-NB15 dataset and a synthetic federated dataset demonstrate that FedGAT-ID consistently outperforms conventional centralized models, federated baselines, and graph-based alternatives across accuracy, F1-score, AUC-ROC, and communication efficiency. The results confirm the effectiveness of combining graph-based representation learning with adaptive model aggregation for privacy-preserving and scalable cyber threat detection.