Abstract

The proliferation of distributed networks and IoT devices has expanded the sophistication of cyberattacks exponentially. Traditional intrusion detection systems are weak because their centralized design creates tension between privacy, scalability and single points of failure. In this paper, the authors create a federated intrusion detection system focused on privacy preservation that will enable an increased number of organizations to implement intrusion detection with no exchange of sensitive network data, only detection models. Federated learning is combined with differential privacy and secure aggregation to achieve strong, measurable privacy guarantees. We compared CNN and LSTM models trained using the FedAvg protocol on CICIDS2017 and UNSW-NB15. The results indicate that CNN performs much better, achieving a success rate of 93% and 89% for CICIDS2017 and UNSW-NB15 respectively, with F1-scores of 89% and 86%, but at very low false positive rates (3% and 4.5%). Most importantly, under strict privacy restrictions (ε = 0.1), this system maintains 92% accuracy, demonstrating the possibility of co-existence of utility and privacy. Evaluation under eight different client numbers and privacy budget configurations tests scalability and robustness, addressing the major need for privacy-preserving distributed collaborative defense in practical networks.