An Adaptive and Interpretable Federated Deep Learning Architecture for Privacy-Aware Network Threat Classification

Abstract

The increasing distribution of enterprise computing across cloud platforms, edge devices, branch networks, and Internet-of-Things environments has made the collection and centralized analysis of network telemetry increasingly difficult. Conventional deep-learning intrusion detection approaches commonly require the movement of traffic records to a common training repository, which can expose sensitive operational information and create substantial communication and storage demands. This study introduces AX-FDL, an adaptive and interpretable federated deep-learning architecture designed to classify network traffic while retaining the underlying records at participating sites. The proposed architecture combines dimensionality reduction, decentralized model optimization, and post-training feature attribution. An ensemble-based selection procedure reduces the original 79 CIC-IDS2017 flow attributes to 20 attributes before model training. Under the experimental configuration reported in this study, this reduction corresponds to a 74.68% decrease in model-update communication overhead. The resulting classifier is evaluated using centralized, federated IID, federated non-IID, and label-poisoning scenarios. With IID data, the framework records 99.89% accuracy, a 0.9988 macro F1-score, and a 0.9997 ROC-AUC. Under a Dirichlet non-IID configuration with α = 0.5, accuracy remains 99.54%. When 20% of participating clients are subjected to label-flipping poisoning, the reported accuracy is 98.12%. SHAP-based attribution is additionally used to identify the flow characteristics that contribute to individual predictions and aggregate model behavior. The findings indicate that the combination of feature reduction, federated optimization, and model interpretation can provide a communication-conscious approach to distributed network threat classification.