Privacy-preserving Network Intrusion Detection based on Cooperation game theory

Network intrusion detection must reduce false alarms while catching attacks, yet data privacy prevents pooling traffic across sites and models are heterogeneous. We present a privacy-preserving, score-level ensemble that fuses only class probabilities from multiple NIDS. For each class, we define utility as average precision and compute exact Shapley values over model coalitions to obtain a model×class weight matrix. The weighted probabilities yield a global decision and can be updated in a sliding window without sharing raw data or parameters. On a public dataset our method outperforms Equal and Static weighting. The approach amplifies specialization, suppresses redundancy, and aligns with operational constraints.