Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Federated Intrusion Detection System Based on Unsupervised Machine Learning

Maxime Gourceyraud, Rim Ben Salem, Christopher Neal, Frédéric Cuppens, Nora Boulahia Cuppens

TL;DR

This work proposes an IDS architecture that utilizes unsupervised learning to reduce the need for labeling, and introduces an innovative federated K-means++ initialization technique to enhance privacy beyond what current federated clustering models offer.

Abstract

Recent Intrusion Detection System (IDS) research has increasingly moved towards the adoption of machine learning methods. However, most of these systems rely on supervised learning approaches, necessitating a fully labeled training set. In the realm of network intrusion detection, the requirement for extensive labeling can become impractically burdensome. Moreover, while IDS training could benefit from inter-company knowledge sharing, the sensitive nature of cybersecurity data often precludes such cooperation. To address these challenges, we propose an IDS architecture that utilizes unsupervised learning to reduce the need for labeling. We further facilitate collaborative learning through the implementation of a federated learning framework. To enhance privacy beyond what current federated clustering models offer, we introduce an innovative federated K-means++ initialization technique. Our findings indicate that transitioning from a centralized to a federated setup does not significantly diminish performance.

Federated Intrusion Detection System Based on Unsupervised Machine Learning

TL;DR

This work proposes an IDS architecture that utilizes unsupervised learning to reduce the need for labeling, and introduces an innovative federated K-means++ initialization technique to enhance privacy beyond what current federated clustering models offer.

Abstract

Recent Intrusion Detection System (IDS) research has increasingly moved towards the adoption of machine learning methods. However, most of these systems rely on supervised learning approaches, necessitating a fully labeled training set. In the realm of network intrusion detection, the requirement for extensive labeling can become impractically burdensome. Moreover, while IDS training could benefit from inter-company knowledge sharing, the sensitive nature of cybersecurity data often precludes such cooperation. To address these challenges, we propose an IDS architecture that utilizes unsupervised learning to reduce the need for labeling. We further facilitate collaborative learning through the implementation of a federated learning framework. To enhance privacy beyond what current federated clustering models offer, we introduce an innovative federated K-means++ initialization technique. Our findings indicate that transitioning from a centralized to a federated setup does not significantly diminish performance.

Paper Structure

This paper contains 34 sections, 6 equations, 3 figures, 3 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Related Work
  3. Clustering Algorithms
  4. Client Clustering.
  5. Federated Clustering.
  6. Unsupervised IDS
  7. Centralized IDS.
  8. Federated IDS.
  9. Methodology
  10. IDS architecture
  11. Federated Clustering
  12. K-Means Properties.
  13. Federated K-Means++ Initialization.
  14. Federated Simplified Silhouette
  15. Binary Classification
  16. ...and 19 more sections

Figures (3)

  • Figure 1: Representation of the proposed IDS
  • Figure 2: Evolution of the average silhouette score as a function of the number of clusters (fed. K-Means with fed. K-Means++ init.).
  • Figure 3: Evolution of the average $F_1$ score as a function of the number of clusters (fed. K-Means with fed. K-Means++ init.).