Efficient and Privacy-Preserving Network Intrusion Detection Based on Federated Learning in SDN-Enabled IIoT Network

Modern decentralized deep learning methods for network intrusion detection in software-defined networking (SDN)-enabled Industrial Internet of Things (IIoT) environments encounter significant challenges, particularly for IIoT data heterogeneity and privacy leakage. To this end, we propose a novel framework for network intrusion detection, dubbed SFLNID, that improves federated learning (FL) to ensure both efficient training and privacy preservation in SDN-enabled IIoT. Specifically, we first design joint optimization mechanism for unbalanced and nonindependent and identically distributed (non-IID) data, which introduces a Focal loss as the loss function, and leverages the Wasserstein distance between global and local models as the regularization term. In addition, we improve adaptive differential privacy with dynamic gradient clipping techniques, adjusting the clip-threshold based on Holt exponential smoothing to achieve privacy protection during the local model training. Moreover, we develop a customized convolutional neural network (CNN)-gated recurrent unit (GRU) model tailored for FL-based network intrusion detection to make a tradeoff between model accuracy and overheads. Theoretical analysis confirms the convergence and privacy guarantees of SFLNID. Extensive experiments, conducted on well-known IIoT datasets, including ToN-IoT, RT-IoT and Edge-IIoT, demonstrate that SFLNID outperforms the state-of-the-art methods in terms of detection accuracy, communication overhead, and cooperative privacy preservation.