Leveraging Federated Learning and Variational Autoencoders for an Enhanced Anomaly Detection System

Traditional Machine Learning (ML)-based Intrusion Detection Systems (IDS) are convenient for detecting cyber-attacks like Distributed Denial of Service (DDoS) attacks but have some drawbacks, such as privacy risks and high communication overhead as all traffic data has to be forwarded to a central entity which runs the ML model for classification. Federated Learning (FL), as a decentralized ML approach, provides a promising solution to this issue by allowing clients to train models locally and only exchange model parameters with a central entity, thus enhancing privacy and reducing communication overhead. Despite its benefits, FL-based IDS systems also face challenges such as handling imbalanced and non-IID traffic data and the need for continuous model retraining. This paper introduces an advanced FL-based IDS which integrates several components such as Variational Autoencoders (VAEs), Federated Averaging with Momentum (FedAvgM) model parameter aggregation, client sampling and retraining mechanisms to overcome these challenges. Our evaluation which includes comparisons to non-FL IDS setups, shows significant improvements of our FL-based IDS with regard to detection accuracy and adaptability.