Federated Intrusion Detection via Unidirectional Serialization and Multi-Scale 1D Convolutions with Attention Reweighting

Deployed in distributed organizations and edge networks, contemporary intrusion detection increasingly requires high-performing models without centralizing sensitive traffic logs. This study presents a lightweight federated intrusion detection framework that integrates (i) unidirectional serialization to convert tabular flow records into short sequences, (ii) multi-scale one-dimensional convolutions to capture heterogeneous temporal–statistical patterns at different receptive fields, and (iii) an attention-based reweighting module that emphasizes informative feature channels prior to classification. A sample-size-weighted FedAvg aggregation protocol is used to train a global detector without transferring raw data. Experiments on three widely used benchmarks (UNSW-NB15, KDD Cup 99, and NSL-KDD) under multiple client configurations report consistently high detection effectiveness, with peak accuracies of 99.38% (UNSW-NB15), 99.86% (KDD Cup 99), and 99.02% (NSL-KDD), alongside strong precision, recall, and F1 scores. In addition, the proposed framework is quantitatively benchmarked on UNSW-NB15 against two recent federated intrusion detection baselines, FedMSP-SPEC and a multi-view federated CAE-NSVM model, demonstrating improvements of more than 10 percentage points in macro F1-score while retaining a compact architecture. The manuscript further specifies a concrete threat model, clarifies the client data partitioning strategy and Non-IID quantification, and provides a reproducibility protocol (hyperparameters, random seeds, and evaluation procedures) to facilitate independent verification.