FedKSam*: A Two-Phase Federated Learning Intrusion Detection Algorithm

Federated learning, as a widely recognized distributed machine learning technology with secure and reliable characteristics, has gradually found applications in the field of intrusion detection. However, intrusion detection techniques based on federated learning often face challenges related to data heterogeneity and class-imbalanced. To address these issues, based on the concept of decoupled representation and classifier, this paper proposes a two-phase federated learning algorithm: FedKSam*. In the first phase, we focus on mitigating the impact of non-independent and identically distributed (Non-iid) data by employing Sharpness Aware Minimization (SAM) optimizer and knowledge distillation techniques. This effectively coordinates the alleviation of global and local drift, resulting in robust representation capabilities. In the second phase, we re-optimize the decision boundaries of the classifier, significantly enhancing the model’s detection capabilities. Experimental results validate the outstanding performance of our algorithm in long-tailed and Non-iid environments.