FROST-IDS: Federated Robust Optimized Secure Threat Detection via Mixture-of-Experts with FPR-Constrained Threshold Calibration

Network intrusion detection systems (IDS) trained on heterogeneous, institutionally siloed traffic data-such as the UNSW-NB15 benchmark comprising 277,673 labelled flow records across nine attack categories-face two irreconcilable deployment pressures: sustaining high attack sensitivity while keeping false-positive rates (FPR) below operational thresholds that today's SOC workloads can sustain. Existing federated learning (FL) methods optimize aggregate accuracy without defining, let alone enforcing, a specific FPR budget. We propose Frost-IDS (Federated Robust Optimized Secure Threat Intrusion Detection System), a federated IDS framework uniquely architected around deployment-oriented FPR enforcement rather than unconstrained aggregate performance. The system integrates three coordinated components: (i) a three-expert Mixture-of-Experts (MoE) classifier with structurally distinct focal-loss objectives governed by Gumbel-Softmax temperature annealing; (ii) a performance-and-size-weighted FedAvg aggregator with FPR compliance bonuses; and (iii) a binary-search threshold calibration protocol with a 25% distribution-shift safety margin and a 99.5th-percentile quantile guard. On UNSW-NB15, Frost-IDS achieves accuracy$=\mathbf{8 4. 6 \%} \pm \mathbf{0. 8 \%}$, recall$=\mathbf{7 2. 9 \%} \pm \mathbf{1. 5 \%}, \mathbf{F P R} \boldsymbol{=} \mathbf{0. 9 7} \boldsymbol{\%} \pm \mathbf{0. 0 6} \boldsymbol{\%}$, and$\mathbf{A U C}-\mathbf{R O C} \boldsymbol{=} \mathbf{0. 9 6 0} \pm \mathbf{0. 0 0 1}$across seven random seeds, with$\text{FPR} \leq \mathbf{1} {\%}$compliance in 5/7 seeds (vs. 3/7 for FedAvg) and 4/4 seeds under severe non-IID stress$(\alpha=0.1$, vs. 3/4 for FedAvg), demonstrating that coordinated calibration, routing specialization, and performance-weighted aggregation are jointly necessary for risk-budgeted, deploymentoriented federated IDS.