CAFNet: Compressed Autoencoder-based Federated Network for Anomaly Detection

Federated Learning (FL) is a promising collaborative training paradigm that utilizes decentralized on-device data. Using supervised learning approaches in FL-based network intrusion detection systems often leads to poor classification performance because of the highly imbalanced data with limited labeled network traffic anomalies from data collected by edge devices. Furthermore, detecting zero-day anomalies/attacks without a priori knowledge is difficult. Due to these constraints, unsupervised learning-based methods, such as autoencoders, which only use benign traffic to build the detection model, appear to be the desired choice to identify anomalous network traffic. In this work, we propose a Compressed Autoencoder-based Federated Network (CAFNet) framework for network anomaly detection to deal with the labeled data scarcity issue while preserving data owner’s privacy and reducing communication overhead. Our framework leverages the latent representation of autoencoders to capture important information in the input features of the distributed network devices and eliminate the transmission of redundant information (weights) during federated training. Our extensive experimental results with three publicly available network intrusion detection datasets show that our proposed framework can significantly lower communication cost up to 65% of the state-of-the-art model compression strategies used in traditional FL as well as achieves attack detection performance comparable to conventional FL framework.