Adaptive and Proximal Federated Optimization for Transferable Network Intrusion Detection
Proximal federated optimization beat FedAvg for transferable intrusion detection on CIC-IDS 2017, showing a depth-versus-breadth trade-off.
The paper tests whether federated optimizers other than FedAvg improve transfer of network intrusion detectors to unseen attack classes. On CIC-IDS 2017 with 11 clients and 10 hyperparameter settings, a strongly regularized proximal optimizer produced 48 client pairs above 70% transferred accuracy, versus 42 for FedAvg and 46 for an adaptive optimizer with a high server learning rate. SMOTE raised accuracy on individual pairs compared with bootstrapping but reduced how many pairs transferred, a depth-versus-breadth trade-off. The authors conclude that how client updates are regularized and aggregated materially affects federated NIDS transferability.
- Eleven-client CIC-IDS 2017 study compared FedAvg, adaptive, and proximal optimizers.
- Strong proximal regularization yielded 48 transferable pairs versus 42 for FedAvg.
- An aggressive adaptive server learning rate reached 46 pairs.
- SMOTE improved pair accuracy but covered fewer clients than bootstrapping.
From the original article
1 min read at arxiv.orgNetwork Intrusion Detection Systems (NIDS) based on deep learning often fail to detect attack classes that are absent from training data, limiting their robustness against zero-day threats. This property called transferability across attack classes, remains underexplored especially in federated learning (FL) settings where data heterogeneity and client drift pose additional challenges.
By Rezwan Islam Salvi · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.