Enabling Privacy-Preserving Network Anomaly Detection Through Federated Learning: A Comparative Study

Machine learning (ML)-based network anomaly detection methods are proven to provide automated network protection from traffic misbehavior and authorized system access through data monitoring and analysis. However, conventional centralized methods present risks for data privacy and breaches. By facilitating distributed model training over a number of network nodes, Federated Learning (FL) emerges as a key enabler for effective anomaly detection yet while preserving the privacy of the data. This paper studies FL-based detection approaches under two different Deep Learning models, CNN and MLP. We use XGBoost for feature selection and the two UNSWNB15 and CICDDoS2019 datasets for assessing the effectiveness of each model through the evaluation of standard performance metric criteria, namely the recall, precision, accuracy, and F1score metrics. Our experimental findings indicate that integrating XGBoost-based feature selection with the CNN model yields superior performance on the UNSW-NB15 dataset, whereas the MLP model benefits more from the same integration when applied to the CICDDoS2019 dataset.