AnomLocal: A hybrid local-global anomaly detection model for network security using federated learning

Abstract

Securing distributed network infrastructures has become a major priority in modern cybersecurity, where diverse data sources and increasingly sophisticated attacks challenge the reliability of traditional anomaly detection systems. Centralised and local-only detection models often fail to balance environment-specific accuracy with cross-network generalisation, leading to reduced performance and privacy risks. This study presents AnomLocal, a hybrid anomaly detection framework that combines local learning with global federated aggregation to deliver scalable, privacy-preserving, and adaptive network protection. Each client node independently trains a neural model on its local data and shares only model parameters for aggregation through an enhanced FedAvg mechanism, ensuring global learning without exposing sensitive information. Experimental evaluation on the UNSW-NB15 dataset shows that AnomLocal achieves 93.5% accuracy, 92.8% precision, and 91.5% recall, outperforming both centralised and standalone local models. The framework also reduces detection latency by 25%, supporting real-time operation in large-scale distributed environments. By effectively unifying local sensitivity with global adaptability, AnomLocal provides a robust, interpretable, and efficient solution for next-generation distributed intrusion detection systems.