Enhancing Federated Intrusion Detection with Class-Specific Dynamic Sampling

Federated Learning (FL) presents a promising approach for collaborative intrusion detection while preserving data privacy. However, current FL frameworks face challenges with non-independent and identically distributed (non-IID) data and class imbalances in network security contexts. This paper introduces Dynamic Sampling-FedIDS (DS-FedIDS), a novel framework that enhances federated intrusion detection through adaptive sampling and personalization. DS-FedIDS extends the Federated Learning with Personalization Layers (FedPer) architecture by incorporating dynamic up/down sampling to address class imbalance issues in network security datasets. The framework maintains a global model for shared attack detection while enabling client-specific adaptation through personalized layers. Our approach effectively handles heterogeneous network environments, including Content Delivery Networks, Internet of Things, and industrial systems, each with distinct traffic patterns and attack profiles. Experimental results demonstrate that DS-FedIDS outperforms baseline FedPer in accuracy and efficiency, achieving superior detection rates across diverse attack classes while maintaining reasonable training overhead. Notably, DS-FedIDS excels in detecting minority attack classes and adapting to client-specific normal traffic patterns, making it ideal for real-world intrusion detection scenarios with inherently imbalanced and heterogeneous data distributions.