FL-IIDS: A novel federated learning-based incremental intrusion detection system

With the advantage of analyzing data of multiple work sites comprehensively while ensuring data privacy, federated learning-based intrusion detection systems (IDS) are emerging as a distributed intrusion detection paradigm. Most of these IDS are assumed to work on static data. However, in the actual network environment, the practice of setting data as static will lead to the phenomenon known as catastrophic forgetting, where old classes that have already appeared would be forgotten. In this paper, we propose a novel IDS framework called FL-IIDS to effectively address the catastrophic forgetting problem. Firstly, a new loss function is synthetically designed for local model training. With the new function, the class gradient balance loss function assigns different learning weights to data of the new and old classes so that the learning rate of the new classes would decrease and the memory of the overall old classes would be deepened. Moreover, the sample label smoothing loss function leverages the knowledge distillation method to enhance the local model memory for every specific class of old classes. Secondly, the relay client fusing sample reconstruction is employed to mitigate the spread of catastrophic forgetting globally without compromising data privacy. Extensive experimental results on the UNSW-NB15 dataset and the CICIDS2018 dataset show that our proposed framework improves the memory capability for old classes substantially without affecting the detection effectiveness of the IDS for new classes.