Network intrusion detection based on hybrid sequence model and federated class balance algorithm

doi:10.11772/j.issn.1001-9081.2025030296

Journal of Computer Applications ›› 2026, Vol. 46 ›› Issue (3): 857-866.DOI: 10.11772/j.issn.1001-9081.2025030296

• Cyber security • Previous Articles Next Articles

Network intrusion detection based on hybrid sequence model and federated class balance algorithm

Kaiguang MA¹^,²^,³, Xuebin CHEN¹^,²^,³(), Yinlong JIAN¹^,²^,³, Liu WANG¹^,²^,³, Yuan GAO¹^,²^,³

^1.College of Sciences，North China University of Science and Technology，Tangshan Hebei 063210，China
^2.Hebei Provincial Key Laboratory of Data Science and Application （North China University of Science and Technology），Tangshan Hebei 063210，China
^3.Tangshan Key Laboratory of Data Science （North China University of Science and Technology），Tangshan Hebei 063210，China

Received:2025-03-24 Revised:2025-07-20 Accepted:2025-07-23 Online:2025-09-28 Published:2026-03-10
Contact: Xuebin CHEN
About author:MA Kaiguang， born in 1999， M. S. candidate. His research interests include federated learning， network security.
JIAN Yinlong， born in 2001， M. S. candidate. His research interests include data security， privacy protection.
WANG Liu， born in 1999， M. S. candidate. Her research interests include data analysis.
GAO Yuan， born in 2000， M. S. candidate. Her research interests include data security， privacy protection.
Supported by:
National Natural Science Foundation of China(U20A20179)

基于混合序列模型与联邦类平衡算法的网络入侵检测

马凯光¹^,²^,³, 陈学斌¹^,²^,³(), 菅银龙¹^,²^,³, 王柳¹^,²^,³, 高远¹^,²^,³

^1.华北理工大学理学院，河北唐山 063210
^2.河北省数据科学与应用重点实验室（华北理工大学），河北唐山 063210
^3.唐山市数据科学重点实验室（华北理工大学），河北唐山 063210

通讯作者: 陈学斌
作者简介:马凯光（1999—），男，河北张家口人，硕士研究生，CCF会员，主要研究方向：联邦学习、网络安全
菅银龙（2001—），男，河南商丘人，硕士研究生，CCF会员，主要研究方向：数据安全、隐私保护
王柳（1999—），女，河北保定人，硕士研究生，CCF会员，主要研究方向：数据分析
高远（2000—），女，山东德州人，硕士研究生，CCF会员，主要研究方向：数据安全、隐私保护。
基金资助:
国家自然科学基金资助项目(U20A20179)

Abstract

Abstract:

Network Intrusion Detection System （NIDS） plays a crucial role in network security defense. Traditional rule-based matching methods struggle to detect unknown attacks effectively， while deep learning enhances detection performance， but is constrained by the data privacy issue caused by centralized training. In this context， federated learning enables collaborative learning while preserving data privacy through local training and parameter sharing， offering a feasible solution for network intrusion detection. However， federated learning still faces challenges in NIDS applications， including the temporal dependency of network traffic and imbalanced data distribution， which limits the federated model’s ability to detect minority-class attacks. Therefore， a hybrid framework that integrates bidirectional Recurrent Neural Network （RNN） parallel architecture with Federated Class Balancing （FedCB） algorithm was proposed， so as to enhance the temporal modeling capabilities and optimize the federated aggregation strategy. Experimental results on the NSL-KDD dataset demonstrate that the proposed algorithm achieves superior performance in a five-class classification task. Compared with the intrusion detection model combining federated learning and convolutional neural networks — CNN-FL and FL-SEResNet （Federation Learning Squeeze-and-Excitation network ResNet）， the proposed algorithm improves the accuracy by 3.30 and 1.48 percentage points， respectively， highlighting the effectiveness of the proposed method in federated learning-based intrusion detection.

Key words: federated learning, intrusion detection, bidirectional Recurrent Neural Network (RNN), class imbalance, privacy protection

摘要：

网络入侵检测系统（NIDS）在网络安全防御中发挥着关键作用。传统基于规则匹配的方法难以有效检测未知攻击，深度学习虽提高了检测性能，但受限于集中式训练造成的数据隐私问题。在此背景下，联邦学习通过本地训练与参数共享，在保护数据隐私的同时实现协同学习，为网络入侵检测提供了一种可行的解决方案。然而，联邦学习在NIDS应用中仍面临挑战，包括网络流量的时序依赖性和数据分布的不均衡，这导致联邦模型对少数类攻击的检测能力不足。因此，提出一种结合双向循环神经网络（RNN）并行结构与联邦类别平衡（FedCB）算法的混合框架，以增强时序建模能力并优化联邦聚合策略。实验结果表明，该算法在NSL-KDD数据集上的五分类任务中取得了更优的检测性能，相较于结合联邦学习与卷积神经网络的入侵检测模型CNN-FL和FL-SEResNet（Federation Learning Squeeze-and-Excitation network ResNet），准确率分别提升了3.30和1.48个百分点，说明该方法在联邦学习入侵检测任务中的有效性。

关键词: 联邦学习, 入侵检测, 双向循环神经网络, 类别不平衡, 隐私保护

CLC Number:

TP309.2

Kaiguang MA, Xuebin CHEN, Yinlong JIAN, Liu WANG, Yuan GAO. Network intrusion detection based on hybrid sequence model and federated class balance algorithm[J]. Journal of Computer Applications, 2026, 46(3): 857-866.

马凯光, 陈学斌, 菅银龙, 王柳, 高远. 基于混合序列模型与联邦类平衡算法的网络入侵检测[J]. 《计算机应用》唯一官方网站, 2026, 46(3): 857-866.

Figures/Tables 12

References 32

[1]	ZIPPERLE M， ZHANG Y， CHANG E， et al. PARGMF： a provenance-enabled automated rule generation and matching framework with multi-level attack description model ［J］. Journal of Information Security and Applications， 2024， 81： No.103682.
[2]	TULBURE A A， TULBURE A A， DULF E H. A review on modern defect detection models using DCNNs — deep convolutional neural networks［J］. Journal of Advanced Research， 2022， 35： 33-48.
[3]	FALLAH A， MOKHTARI A， OZDAGLAR A. Personalized federated learning with theoretical guarantees： a model-agnostic meta-learning approach［C］// Proceedings of the 34th International Conference on Neural Information Processing Systems. Red Hook： Curran Associates Inc.， 2020： 3557-3568.
[4]	SHANG X， LU Y， HUANG G， et al. Federated learning on heterogeneous and long-tailed data via classifier re-training with federated features［C］// Proceedings of the 31st International Joint Conference on Artificial Intelligence. California： ijcai.org， 2022： 2218-2224.
[5]	SUN H， CHEN M， WENG J， et al. Anomaly detection for in-vehicle network using CNN-LSTM with attention mechanism［J］. IEEE Transactions on Vehicular Technology， 2021， 70（10）： 10880-10893.
[6]	刘拥民，杨钰津，罗皓懿，等. 基于双向循环生成对抗网络的无线传感网入侵检测方法［J］. 计算机应用， 2023， 43（1）： 160-168.
	LIU Y M， YANG Y J， LUO H Y， et al. Intrusion detection method for wireless sensor network based on bidirectional circulation generative adversarial network［J］. Journal of Computer Applications， 2023， 43（1）： 160-168.
[7]	DING Z， ZHONG G， QIN X， et al. MF-Net： multi-frequency intrusion detection network for Internet traffic data［J］. Pattern Recognition， 2024， 146： No.109999.
[8]	AL-HUTHAIFI R， LI T， HUANG W， et al. Federated learning in smart cities： privacy and security survey ［J］. Information Sciences， 2023， 632： 833-857.
[9]	KHRAISAT A， ALAZAB A， SINGH S， et al. Survey on federated learning for intrusion detection system： concept， architectures， aggregation strategies， challenges， and future directions ［J］. ACM Computing Surveys， 2025， 57（1）： No.7.
[10]	ZHANG Z， MA S， YANG Z， et al. Robust semisupervised federated learning for images automatic recognition in Internet of Drones［J］. IEEE Internet of Things Journal， 2023， 10（7）： 5733-5746.
[11]	赵英，王丽宝，陈骏君，等. 基于联邦学习的网络异常检测［J］. 北京化工大学学报（自然科学版）， 2021， 48（2）： 92-99.
	ZHAO Y， WANG L B， CHEN J J， et al. Network anomaly detection based on federated learning［J］. Journal of Beijing University of Chemical Technology （Natural Science Edition）， 2021， 48（2）： 92-99.
[12]	郑超，邬悦婷，肖珂. 基于联邦学习和深度残差网络的入侵检测［J］. 计算机应用， 2023， 43（S1）： 133-138.
	ZHENG C， WU Y T， XIAO K. Intrusion detection based on federated learning and deep residual network［J］. Journal of Computer Applications， 2023， 43（S1）： 133-138.
[13]	JIN Z， ZHOU J， LI B， et al. FL-IIDS： a novel federated learning-based incremental intrusion detection system［J］. Future Generation Computer Systems， 2024， 151： 57-70.
[14]	LIU S， YU Y， ZONG Y， et al. Delay and energy-efficient asynchronous federated learning for intrusion detection in heterogeneous industrial internet of things［J］. IEEE Internet of Things Journal， 2024， 11（8）： 14739-14754.
[15]	LI T， SAHU A K， ZAHEER M， et al. Federated optimization in heterogeneous networks［EB/OL］. ［2024-12-24］..
[16]	KARIMIREDDY S P， KALE S， MOHRI M， et al. SCAFFOLD： stochastic controlled averaging for federated learning［C］// Proceedings of the 37th International Conference on Machine Learning. New York： JMLR.org， 2020： 5132-5143.
[17]	WANG J， LIU Q， LIANG H， et al. Tackling the objective inconsistency problem in heterogeneous federated optimization［C］// Proceedings of the 34th International Conference on Neural Information Processing Systems. Red Hook： Curran Associates Inc.， 2020： 7611-7623.
[18]	DING H， SUN Y， HUANG N， et al. TMG-GAN： generative adversarial networks-based imbalanced learning for network intrusion detection［J］. IEEE Transactions on Information Forensics and Security， 2024， 19： 1156-1167.
[19]	LIN T Y， GOYAL P， GIRSHICK R， et al. Focal loss for dense object detection［C］// Proceedings of the 2017 IEEE International Conference on Computer Vision. Piscataway： IEEE， 2017： 2999-3007.
[20]	ANDRESINI G， APPICE A， DE ROSE L， et al. GAN augmentation to deal with imbalance in imaging-based intrusion detection［J］. Future Generation Computer Systems， 2021， 123： 108-127.
[21]	MA X， SHI W. AESMOTE： adversarial reinforcement learning with smote for anomaly detection［J］. IEEE Transactions on Network Science and Engineering， 2021， 8（2）： 943-956.
[22]	尹梓诺，马海龙，胡涛. 基于联合注意力机制和一维卷积神经网络-双向长短期记忆网络模型的流量异常检测方法［J］. 电子与信息学报， 2023， 45（10）： 3719-3728.
	YIN Z N， MA H L， HU T. A traffic anomaly detection method based on the joint model of attention mechanism and one-dimensional convolutional neural network-bidirectional long short term memory［J］. Journal of Electronics and Information Technology， 2023， 45（10）： 3719-3728.
[23]	TSOGBAATAR E， BHUYAN M H， TAENAKA Y， et al. DeL-IoT： a deep ensemble learning approach to uncover anomalies in IoT［J］. Internet of Things， 2021， 14： No.100391.
[24]	DUAN M， LIU D， CHEN X， et al. Astraea： self-balancing federated learning for improving classification accuracy of mobile deep learning applications［C］// Proceedings of the IEEE 37th International Conference on Computer Design. Piscataway： IEEE， 2019： 246-254.
[25]	HOCHREITER S， SCHMIDHUBER J. Long short-term memory［J］. Neural Computation， 1997， 9（8）： 1735-1780.
[26]	CHO K， VAN MERRIËNBOER B， GULCEHRE C， et al. Learning phrase representations using RNN encoder-decoder for statistical machine translation［C］// Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing. Stroudsburg： ACL， 2014： 1724-1734.
[27]	McMAHAN H B， MOORE E， RAMAGE D， et al. Communication-efficient learning of deep networks from decentralized data［C］// Proceedings of the 20th Artificial Intelligence and Statistics. New York： JMLR.org， 2017： 1273-1282.
[28]	REVATHI S， MALATHI A. A detailed analysis on NSL-KDD dataset using various machine learning techniques for intrusion detection［J］. International Journal of Engineering Research and Technology， 2013， 2（12）： 1848-1853.
[29]	TAVALLAEE M， BAGHERI E， LU W， et al. A detailed analysis of the KDD CUP 99 data set［C］// Proceedings of the 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications. Piscataway： IEEE， 2009： 1-6.
[30]	VINAYAKUMAR R， ALAZAB M， SOMAN K P， et al. Deep learning approach for intelligent intrusion detection system［J］. IEEE Access， 2019， 7： 41525-41550.
[31]	DONG S， XIA Y， WANG T. Network abnormal traffic detection framework based on deep reinforcement learning［J］. IEEE Wireless Communications， 2024， 31（3）： 185-193.
[32]	CHOWDHURY R， ROY A， SAHA B， et al. A step forward to revolutionize intrusion detection system using deep convolutional neural network［C］// Data driven approach towards disruptive technologies： proceedings of MIDAS 2020， SADIC. Singapore： Springer， 2021： 337-352.

类别	KDDTrain+	KDDTest+
总计	125 973	22 544
DoS	45 927	7 636
Probe	11 656	2 423
R2L	995	2 574
U2R	52	200
Normal	67 343	9 711

类别	KDDTrain+	KDDTest+
总计	125 973	22 544
DoS	45 927	7 636
Probe	11 656	2 423
R2L	995	2 574
U2R	52	200
Normal	67 343	9 711

模型	准确率	精确率	召回率	F1分数
SVM	0.788 8	0.820 8	0.788 8	0.774 8
RF	0.763 1	0.813 8	0.763 1	0.727 7
CNN	0.825 3	0.835 2	0.825 3	0.826 4
DNN^［30］	0.785 0	0.810 0	0.785 0	0.765 0
A3CAD^［31］	0.841 3	0.843 5	0.841 3	0.840 0
CNN-IDS^［32］	0.832 9	0.860 0	0.830 0	0.830 0
本文模型	0.878 3	0.877 6	0.878 3	0.876 3

模型	准确率	精确率	召回率	F1分数
SVM	0.788 8	0.820 8	0.788 8	0.774 8
RF	0.763 1	0.813 8	0.763 1	0.727 7
CNN	0.825 3	0.835 2	0.825 3	0.826 4
DNN^［30］	0.785 0	0.810 0	0.785 0	0.765 0
A3CAD^［31］	0.841 3	0.843 5	0.841 3	0.840 0
CNN-IDS^［32］	0.832 9	0.860 0	0.830 0	0.830 0
本文模型	0.878 3	0.877 6	0.878 3	0.876 3

模型	准确率	精确率	召回率	F1分数
本文模型	0.878 3	0.877 6	0.878 3	0.876 3
去除BiGRU	0.866 0	0.873 3	0.866 0	0.867 4
去除BiLSTM	0.867 5	0.876 7	0.867 5	0.869 3

Network intrusion detection based on hybrid sequence model and federated class balance algorithm

基于混合序列模型与联邦类平衡算法的网络入侵检测

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 12

References 32

Related Articles 15

Recommended Articles

Metrics

Dropout率	准确率	精确率	召回率	F1分数
0.2	0.867 4	0.870 0	0.867 4	0.864 6
0.3	0.878 3	0.877 6	0.878 3	0.876 3
0.5	0.864 8	0.867 3	0.864 7	0.860 3

类别	精确度		召回率		F1分数
类别	FedCB	FedAvg	FedCB	FedAvg	FedCB	FedAvg
DoS	0.922 9	0.898 2	0.868 9	0.828 3	0.895 1	0.861 8
Normal	0.882 6	0.747 4	0.923 6	0.923 4	0.902 6	0.826 1
Probe	0.698 8	0.778 9	0.832 0	0.840 3	0.759 6	0.808 4
R2L	0.956 1	0.901 1	0.591 7	0.311 6	0.731 0	0.463 0
U2R	0.249 0	0.000 0	0.890 0	0.000 0	0.389 1	0.000 0

[1]	Huan PING, Zhanguo XIA, Sicheng LIU, Qihan LIU, Chunlei LI. Terminal data privacy-preserving scheme based on hierarchical federated learning [J]. Journal of Computer Applications, 2026, 46(3): 830-838.
[2]	Lei WANG, Wenxuan ZHOU, Ninghui JIA, Zhihao QU. Federated learning with two-pass communication compression for privacy-sensitive IoT data [J]. Journal of Computer Applications, 2026, 46(3): 887-898.
[3]	Enkang XI, Jing FAN, Yadong JIN, Hua DONG, Hao YU, Yihang SUN. Review of threats faced by federated learning in privacy and security field [J]. Journal of Computer Applications, 2026, 46(3): 798-808.
[4]	Lili HE, Xinru GUAN, Lei ZHANG, Sheng JIANG, Chengjie JIANG. Panorama and future of location privacy protection in internet of vehicles [J]. Journal of Computer Applications, 2026, 46(3): 809-820.
[5]	Jie CAO, Lingfeng XIE, Bingjin WANG, Changhe ZHANG, Zidong YU, Chao DENG. Adolescent scoliosis screening method considering class imbalance and background diversity [J]. Journal of Computer Applications, 2026, 46(2): 630-639.
[6]	Qi ZHONG, Shufen ZHANG, Zhenbo ZHANG, Yinlong JIAN, Zhongrui JING. Detection and defense mechanism for poisoning attacks to federated learning [J]. Journal of Computer Applications, 2026, 46(2): 445-457.
[7]	Kejia ZHANG, Zhijun FANG, Nanrun ZHOU, Zhicai SHI. Personalized federated learning method based on model pre-assignment and self-distillation [J]. Journal of Computer Applications, 2026, 46(1): 10-20.
[8]	Yinlong JIAN, Xuebin CHEN, Zhongrui JING, Qi ZHONG, Zhenbo ZHANG. Data augmentation scheme based on conditional generative adversarial network in federated learning [J]. Journal of Computer Applications, 2026, 46(1): 21-32.
[9]	Na FAN, Chuang LUO, Zehui ZHANG, Mengyao ZHANG, Ding MU. Semantic privacy protection mechanism of vehicle trajectory based on improved generative adversarial network [J]. Journal of Computer Applications, 2026, 46(1): 169-180.
[10]	Hao YU, Jing FAN, Yihang SUN, Yadong JIN, Enkang XI, Hua DONG. Federated split learning optimization method under edge heterogeneity [J]. Journal of Computer Applications, 2026, 46(1): 33-42.
[11]	Sheping ZHAI, Pengju ZHU, Rui YANG, Jiayiteng LIU. Blockchain-based identity management system for internet of things [J]. Journal of Computer Applications, 2025, 45(9): 2873-2881.
[12]	Bohan ZHANG, Le LYU, Junchang JING, Dong LIU. Genetic algorithm-based community hiding method in attribute networks [J]. Journal of Computer Applications, 2025, 45(9): 2817-2826.
[13]	Hao YU, Jing FAN, Yihang SUN, Hua DONG, Enkang XI. Survey of statistical heterogeneity in federated learning [J]. Journal of Computer Applications, 2025, 45(9): 2737-2746.
[14]	Jintao SU, Lina GE, Liguang XIAO, Jing ZOU, Zhe WANG. Detection and defense scheme for backdoor attacks in federated learning [J]. Journal of Computer Applications, 2025, 45(8): 2399-2408.
[15]	Lina GE, Mingyu WANG, Lei TIAN. Review of research on efficiency of federated learning [J]. Journal of Computer Applications, 2025, 45(8): 2387-2398.