Enhancing intrusion detection with privacy-preserving federated learning: Differential privacy and incremental learning integrating

In cybersecurity, Intrusion detection systems (IDS) are crucial in scanning networks and systems to detect malicious activities and help to identify the threats before sensitive data is compromised. The introduction of machine learning (ML) has enhanced IDS by providing mechanisms for automated and intelligent threat detection. However, the training of ML models in such distributed settings, e.g., in Federated Learning (FL), may be an issue for training and may still expose sensitive information through model parameters analysis. FL mitigates certain privacy issues by localizing the data, however, it is not sufficient for genuine privacy protection and requires improvement. Specifically, Incremental Learning (IL) improves IDS providing the ability models adjusting to new cybersecurity threats without the need for retraining from scratch. This keeps it computationally inexpensive and allows it to quickly adapt to novel attack behaviours. In particular, we propose Federated Differential Privacy Enhanced Model Aggregation, a method targeted towards enhancing both privacy and accuracy in federated ML context. It uses a server-client architecture, where a global model is initialized and further improved with client-side training, while updates are securely aggregated. We also used a multi-layer perceptron trained with the DP-SGD optimizer which drops noise into the gradients to achieve better data privacy. We evaluated the performance, the experimental results show that the accuracy of class incremental learning in our proposed approach can reach 92.4% and feature incremental learning can reach 99.4%, they demonstrate that the learning can match the new data well. The procedure remains privacy-preserving and efficient and has good performance over diverse dataset types, so we believe it to be a valid candidate for intrusion detection systems (IDS) in modernity.