[Paper Review] FLAD: Adaptive Federated Learning for DDoS Attack Detection

Roberto Doriguzzi-Corin, Domenico Siracusa|arXiv (Cornell University)|May 13, 2022

Network Security and Intrusion Detection10 citations

TL;DR

FLAD is a novel adaptive federated learning framework for DDoS attack detection that enables convergence monitoring without sharing test data by leveraging clients' local validation accuracy. It dynamically allocates more training rounds to clients with harder-to-learn attack profiles, achieving faster convergence and higher accuracy than state-of-the-art FL methods on unbalanced, non-i.i.d. DDoS datasets.

ABSTRACT

Federated Learning (FL) has been recently receiving increasing consideration from the cybersecurity community as a way to collaboratively train deep learning models with distributed profiles of cyber threats, with no disclosure of training data. Nevertheless, the adoption of FL in cybersecurity is still in its infancy, and a range of practical aspects have not been properly addressed yet. Indeed, the Federated Averaging algorithm at the core of the FL concept requires the availability of test data to control the FL process. Although this might be feasible in some domains, test network traffic of newly discovered attacks cannot be always shared without disclosing sensitive information. In this paper, we address the convergence of the FL process in dynamic cybersecurity scenarios, where the trained model must be frequently updated with new recent attack profiles to empower all members of the federation with the latest detection features. To this aim, we propose FLAD (adaptive Federated Learning Approach to DDoS attack detection), an FL solution for cybersecurity applications based on an adaptive mechanism that orchestrates the FL process by dynamically assigning more computation to those members whose attacks profiles are harder to learn, without the need of sharing any test data to monitor the performance of the trained model. Using a recent dataset of DDoS attacks, we demonstrate that FLAD outperforms state-of-the-art FL algorithms in terms of convergence time and accuracy across a range of unbalanced datasets of heterogeneous DDoS attacks. We also show the robustness of our approach in a realistic scenario, where we retrain the deep learning model multiple times to introduce the profiles of new attacks on a pre-trained model.

Motivation & Objective

• To address the challenge of monitoring model convergence in federated learning for cybersecurity without requiring shared test data.
• To enable efficient and adaptive training in dynamic environments where new DDoS attack profiles emerge frequently.
• To reduce convergence time and improve detection accuracy in unbalanced, non-i.i.d. datasets common in network intrusion detection.
• To support real-time updates of intrusion detection systems with new attack profiles across a federation of clients.
• To provide a scalable, privacy-preserving solution for collaborative DDoS detection without exposing sensitive network traffic data.

Proposed method

• FLAD uses local validation sets on clients to estimate global model accuracy without transmitting any data to the server.
• The server dynamically assigns more training rounds to clients whose local models show lower accuracy, indicating harder-to-learn attack profiles.
• This adaptive mechanism is based on a feedback loop where clients report their validation accuracy after each round, enabling early stopping and load balancing.
• The approach avoids reliance on Federated Averaging’s requirement for a central test set by using client-side performance metrics as a proxy for global model quality.
• FLAD integrates an early-stopping strategy based on local accuracy trends, reducing unnecessary training iterations.
• The method maintains data privacy by ensuring no training or validation data is exchanged between clients and server, preserving confidentiality of attack traffic.

Experimental results

Research questions

• RQ1 How can federated learning converge effectively in dynamic cybersecurity settings where new attack profiles emerge and test data cannot be shared?
• RQ2 Can model convergence be monitored and optimized without central access to test data in federated intrusion detection?
• RQ3 How does adaptive allocation of training rounds based on client-level accuracy improve convergence speed and detection accuracy?
• RQ4 What is the performance of FLAD compared to FEDAVG and other state-of-the-art FL algorithms on unbalanced, non-i.i.d. DDoS datasets?
• RQ5 Can FLAD be effectively applied to real-world scenarios involving incremental learning of new attack types?

Key findings

• FLAD significantly reduces convergence time compared to state-of-the-art FL methods on unbalanced, non-i.i.d. DDoS datasets.
• FLAD achieves higher classification accuracy than FEDAVG and other baseline FL algorithms across diverse attack profiles.
• The adaptive mechanism successfully identifies and prioritizes clients with harder-to-learn attack profiles, improving overall model robustness.
• FLAD maintains high performance even when retraining the model multiple times to incorporate new attack types, demonstrating strong adaptability.
• The approach enables effective early stopping and load balancing without sharing any sensitive data, preserving privacy.
• FLAD outperforms FEDAVG in scenarios where test data is unavailable at the server, proving its viability in real-world privacy-constrained environments.