Privacy-Preserving Federated Learning Framework for Network Intrusion Detection

Abstract

Detecting network intrusions while preserving data privacy has become a major challenge in modern cybersecurity environments. Federated Learning (FL) enables collaborative model training without sharing raw network traffic data and likewise preserving client privacy. However, FL-based intrusion detection systems often face challenges due to heterogeneous client data distributions and privacy constraints. This study proposes a privacy-preserving federated learning framework for network intrusion detection and evaluates three deep learning architectures: Multi-Layer Perceptron (MLP), Deep Neural Network (DNN) and Temporal Convolutional Network (TCN). Experiments were conducted using the CICIDS2017 and CICIDS2018 datasets under both centralized and federated settings. Multiple aggregation strategies, including FedAvg, FedAdam, FedYogi and FedProx, were investigated. Differential Privacy (DP) was also incorporated to analyze the privacy-utility tradeoff. The results show that TCN consistently outperformed MLP and DNN across all evaluation settings. Among the aggregation strategies, FedProx achieved the highest accuracy of 98.15%. TCN attained the highest accuracy during cross-dataset evaluation on CICIDS2018. The study jointly evaluates deep learning architectures, aggregation strategies, differential privacy mechanisms and cross-dataset generalization within a unified federated intrusion detection framework. The findings demonstrate that the combination of TCN and FedProx provides an effective solution for privacy-preserving intrusion detection in heterogeneous federated environments.