Abstract: The Network Intrusion Detection System (NIDS) plays a crucial role in network security defense. Traditional rule-based matching methods struggle to effectively detect unknown attacks. While deep learning enhances detection performance, it is constrained by the data privacy concerns associated with centralized training. Federated Learning (FL) enables collaborative learning while preserving data privacy through local training and parameter sharing, offering a promising solution for network intrusion detection. However, FL still faces challenges in NIDS applications, including the temporal dependency of network traffic and imbalanced data distribution, which hampers the federated model’s ability to detect minority-class attacks. To address these issues, we propose a hybrid framework that integrates a bidirectional recurrent neural network with a Federated Class Balancing (FedCB) algorithm, enhancing temporal modeling capabilities and optimizing the federated aggregation strategy. Experimental results on the NSL-KDD dataset demonstrate that the proposed method achieves superior performance in a five-class classification task. Compared with CNN-FL and FL-SEResNet, the proposed algorithm improves accuracy by 3.30 and 1.48 percentage points, respectively, highlighting its effectiveness in federated learning-based intrusion detection.

Key words: federated learning, intrusion detection, bidirectional recurrent neural network, class imbalance, privacy protection

摘要： 网络入侵检测系统(NIDS)在网络安全防御中发挥着关键作用。基于规则匹配的方法难以有效检测未知攻击，而深度学习虽提高了检测性能，但受限于集中式训练的数据隐私问题。联邦学习(FL)通过本地训练与参数共享，在保护数据隐私的同时实现协同学习，为网络入侵检测提供了一种可行的解决方案。然而，FL在NIDS应用中仍面临挑战，包括网络流量的时序依赖性和数据分布不均衡问题，导致联邦模型对少数类攻击检测能力不足。因此，提出一种结合双向循环神经网络与联邦类别平衡(FedCB)算法的混合框架，以增强时序建模能力并优化联邦聚合策略。实验结果表明，该算法在NSL-KDD数据集的五分类任务中取得了更优的检测性能，相比CNN-FL和FL-SEResNet，准确率分别提升3.30和1.48个百分点，表明该方法在联邦学习入侵检测任务中的有效性。

关键词: 联邦学习, 入侵检测, 双向循环神经网络, 类别不平衡, 隐私保护