 |
Even with credit evaluation, low-rate coordinated attacks may be weak at any single node but strong globally. This motivates federated learning.
Each edge node maintains a local dataset, where the features are compressed behavior features and the labels indicate normal or attack derived from local rules and credit histories.
We use a lightweight model and train collaboratively using FedAvg. Each round, selected nodes perform local updates and send model parameters to the controller, which aggregates them. Raw traffic never leaves local nodes, preserving privacy and reducing coordination overhead.
In our experiments, the detector is a two-layer fully connected neural network with 32 hidden units and ReLU activation. Each selected node runs 3 local epochs with learning rate 0.01, and we perform 20 aggregation rounds.
The federated learning output is used as an auxiliary signal to adjust credit: if the global model consistently assigns high anomaly scores to an entity across multiple domains, we scale down its instantaneous credit before smoothing, accelerating its transition toward high-risk or malicious classification.
So federated learning helps us detect cross-domain patterns that local-only credit evaluation might miss. |
IEEE/ICACT20260343 Slide.21
[Big Slide]
[YouTube]