Federated learning and autoencoder-based hybrid framework for DDoS detection

Abstract Distributed Denial-of-Service (DDoS) attacks can overwhelm network resources and disrupt the availability of cloud services, enterprise systems, and critical infrastructure. Machine-learning-based intrusion detection can help identify malicious traffic from network-flow characteristics. However, conventional centralized training requires data from multiple environments to be collected and stored in a central location, which can be challenging when organizations face confidentiality and data-sharing restrictions. This study presents a hybrid federated framework for DDoS detection that combines a Federated Averaging (FedAvg) multilayer perceptron (MLP) with an autoencoder trained on benign traffic. Traffic from the CICIDS2017 and CICDDoS2019 datasets is cleaned, deduplicated, and aligned using common flow-level features before being distributed across federated clients. The FedAvg MLP acts as the primary classifier, while the autoencoder provides additional anomaly information through reconstruction error. A confidence-gated cascading mechanism activates the autoencoder only when the MLP predicts benign traffic with low confidence, particularly for samples close to the decision boundary. This enables potentially missed attacks to be reassessed without unnecessarily altering confident predictions. The proposed framework is evaluated against a centralized MLP baseline using standard detection metrics, along with an analysis of recovered attacks and additional false positives. Because raw traffic remains on the participating clients, the framework supports collaborative DDoS detection across distributed network environments without requiring organizations to directly share their underlying traffic data.