A personalized federated hypernetworks based aggregation approach for intrusion detection systems

Abstract

Abstract Traditional network intrusion detection systems (NIDS) face significant scalability challenges due to the vast amount of data generated by Internet of Things (IoT) devices, compounded by growing privacy concerns. Federated Learning (FL) has emerged as a promising solution, offering a distributed, privacy-preserving paradigm that enables Deep Learning (DL) models to be trained locally, thereby mitigating privacy risks associated with centralized data processing. However, conventional FL strategies come with inherent limitations. First, they require all clients to use the same model architecture, making personalized learning difficult particularly in Non-Independent and Identically Distributed (Non-IID) heterogeneous data settings. Second, the weight aggregation process in FL introduces significant communication overhead, potentially slowing down training. While encryption techniques such as homomorphic encryption and differential privacy enhance security, they also increase computational costs and can still reveal data distribution patterns if compromised. These challenges are further exacerbated in dynamic IoT environments, where evolving attack types continuously alter data distributions. To address these issues, we propose a Personalized Federated Hypernetworks-based aggregation strategy for Intrusion Detection Systems (PerFedHypID). Unlike conventional FL approaches that rely on weight-based aggregation, PerFedHypID utilizes embedding vectors, which are computationally lighter and enable enhanced personalization. Our method leverages personalized layers and hypernetwork-based aggregation to achieve both efficiency and adaptability. We extensively evaluate PerFedHypID on the CSE-CICIDS-2018 and UNSW-NB-15 datasets under various non-IID heterogeneous settings. The results demonstrate that our approach outperforms state-of-the-art personalized federated learning algorithms, offering robust performance and improved adaptability in dynamic IoT environments.