A Federated Learning-Based Intrusion Detection System for Satellite-Terrestrial Integrated Networks

The emergence of Satellite-Terrestrial Integrated Networks (STIN) has significantly expanded terrestrial network coverage but introduced new security threats. Current Intrusion Detection Systems (IDSs) for STIN mostly consider the distributed nature of satellites, overlooking the computational limits of single satellites and the effect of satellite mobility on IDS generalization, where accuracy and adaptability may drop in dynamic environments. To address this, we propose an unsupervised IDS for STIN based on Federated Learning (FL) named STIN-IDS. We deploy IDS in a cross-layer distributed manner, distributing data processing tasks across multiple Low Earth Orbit (LEO) satellites, while Geostationary Earth Orbit (GEO) satellites act as FL clients responsible for anomaly detection, thereby alleviating the computational load on single satellites. Furthermore, to address changes in user regions and traffic patterns due to satellite mobility, FL clients use dynamic data from different LEO regions for collaborative training, improving adaptability to dynamic environments. Experiments across four datasets with varying network conditions show that STIN-IDS achieves strong generalization and outperforms similar methods.