Multi-Model-Based Federated Learning to Overcome Local Class Imbalance Issues

Federated learning (FL) is gaining much popularity in designing Intrusion Detection Systems (IDS) due to its ability to maintain data privacy and reduce communication costs. Existing FL-based IDS are generally tested with balanced class distribution for all clients where each client has data with all attack traffic categories. This is a very strong assumption. In reality, we often encounter a local class imbalance issue, which means that each client only has traffic with a few number of attack types. This issue creates a critical challenge in FL by leading to poor model performance and convergence. Several studies have made efforts to solve this issue through the clustering of local model parameters. However, their methods are costly and require either prior knowledge or training to select the number of clusters. In this work, we propose a Multi-Model-based Federated Learning (MMFL) framework, which automatically groups the local models of clients having similar class distribution, and a novel data augmentation method to add instances with unknown attack types to the datasets of local devices. Our extensive experiments with two large latest intrusion detection datasets show that MMFL outperforms the five baselines on the intrusion detection task.