CC-FIDS: a federated intrusion detection system with low false negative rates via category consensus and hierarchical filtering

In federated intrusion detection, the non-independent and identically distributed (non-IID) nature of data leads to an imbalanced distribution of tail attack categories across edge devices. This imbalance amplifies category bias after global aggregation, resulting in missed detection of tail attack samples. This paper proposes CC-FIDS, a novel consensus-driven federated learning intrusion detection system. To mitigate local category bias, CC-FIDS introduces a Scale-Aware Meta Distillation (SAMD) mechanism. Within a meta-learning framework, SAMD employs a global consensus distillation loss to constrain local model updates and guide attention toward rare attack features. The mechanism adaptively adjusts distillation weights based on the sample size of each device, further reducing the impact of scale heterogeneity. To address local model bias caused by non-IID data, CC-FIDS designs an Adaptive Hierarchical Top-S Aggregation (AHTA) strategy. After adaptive clustering, AHTA hierarchically selects highly representative models for aggregation, thereby enhancing aggregation quality and detection performance. Extensive experiments on four public datasets demonstrate that under extreme heterogeneity conditions, CC-FIDS significantly reduces the missed detection rate. The Recall and F1 scores improve by up to 5.50 and 5.06 percentage points respectively compared to the best baseline methods, indicating improved detection performance compared to existing state-of-the-art federated learning approaches.