HFL-AD: A Hierarchical Federated Learning Framework for Solving Data Contamination in DDoS Detection

Distributed denial-of-service (DDoS) attacks can cause significant damage to network applications. A crucial step in combating these attacks lies in promptly and accurately detecting DDoS attack traffic. However, due to data insufficiency (imbalance) and contamination, existing solutions fail to yield satisfactory results for DDoS detection. Furthermore, current methods typically require access to raw data for training, posing a significant privacy risk. To tackle these challenges, we propose HFL-AD, a hierarchical federated learning framework specifically designed for detecting DDoS attack traffic. In our approach, a federation of lower layer clients train local anomaly detection models using diverse raw data. A selected few clients, possessing a small supplementary dataset, serve as upper layer clients, responsible for excluding model updates trained on contaminated datasets. Experimental results demonstrate that HFL-AD outperforms baseline solutions in DDoS detection, particularly when some training datasets are contaminated.