International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
PRIVACY-PRESERVING NETWORK INTRUSION IDENTIFICATION THROUGH FEDERATED LEARNING WITH ADAPTIVE CROSS-NODE PARAMETER FUSION
KM Shrishti Sharma1, Mrs. Arifa Khan2
1Master of Technology, Computer Science and Engineering, Lucknow Institute of Technology, Lucknow, India 2Assistant Professor, Department of Computer Science and Engineering, Lucknow Institute of Technology, Lucknow, India ***
Abstract - The rapid evolution of distributed network infrastructures,includingcloudcomputing,InternetofThings (IoT), and edge environments, has significantly increased the complexityofcybersecuritymanagement.Traditionalnetwork intrusion detection systems (NIDS) rely on centralized data collection, which raises critical concerns related to data privacy,scalability,andcommunicationoverhead.Toaddress these challenges, this study proposes a privacy-preserving intrusion detection framework based on federated learning (FL)enhancedwithadaptive cross-nodeparameterfusion. In the proposed approach, multiple distributed nodes collaboratively train a global intrusion detection model without sharing raw network traffic data, thereby ensuring data confidentiality. Unlike conventional FL methods that employ static aggregation techniques such as Federated Averaging (FedAvg), the proposed adaptive fusion strategy dynamically assigns weights to node updates based on data quality, node reliability, and local model performance. The framework isevaluated using benchmark datasets, including NSL-KDD and CICIDS2017, within a simulated distributed environment. Experimental results demonstrate that the proposed method achieves higher detection accuracy, improved F1-score, reduced false positive rates, and faster convergence compared to standard FL-based models. Additionally,theapproachreducescommunicationoverhead and energy consumption, making it suitable for large-scale, privacy-sensitive network environments. The findings highlight the effectiveness of adaptive parameter fusion in enhancing both the performance and efficiency of federated intrusion detection systems.
Key Words: Federated Learning; Network Intrusion Detection System; Privacy Preservation; Adaptive Parameter Fusion; Distributed Cybersecurity; Non-IID Data; Communication Efficiency; Energy-Efficient Learning
1. INTRODUCTION
Therapiddigitaltransformationofmoderninfrastructures hasledtothewidespreadadoptionofdistributedcomputing paradigms, including cloud platforms, Internet of Things (IoT)ecosystems,andedgecomputingenvironments.While these technologies enhance scalability and real-time data processingcapabilities,theyalsointroducecomplexsecurity
challengesduetoincreasedconnectivityanddataexchange. Networkintrusiondetectionsystems(NIDS)playavitalrole inidentifyingmaliciousactivitiesandsafeguardingnetwork integrity;however,traditionalapproachesareincreasingly inadequate in handling the scale, diversity, and privacy requirements of modern network environments. Consequently, there is a growing need for intelligent, scalable, and privacy-preserving intrusion detection mechanismsthatcanoperateeffectivelyacrossdistributed systems.
1.1 Background and Motivation
TheproliferationofIoTdevices,cloud-basedservices,and distributed network architectures has fundamentally reshapedhowdataisgenerated,processed,andtransmitted. These environments involve large-scale, heterogeneous systems where data flows continuously across multiple nodes, increasing both operational efficiency and vulnerability to cyber threats. The complexity of such systemsmakesitchallengingtomonitornetworkbehavior using conventional security mechanisms. As a result, advancedintrusiondetectionsystemscapableofanalyzing largevolumesofnetworktrafficandidentifyinganomaliesin real time have become essential for maintaining cybersecurityinmoderninfrastructures(Stallings,2018).
1.1.1 Growth of IoT, Cloud, and Distributed Networks
The expansion of IoT and cloud computing has led to the creationofhighlyinterconnectedanddecentralizednetwork environments. IoT devices generate massive amounts of data, often with limited computational and security capabilities, making them attractive targets for cyber attackers.Similarly,cloudinfrastructuresenableflexibleand scalableservicesbutintroducerisksrelatedtomulti-tenancy andremotedataaccess.Thesedistributedsystemsoperate acrossdiversegeographicallocations,furthercomplicating centralized monitoring and control. This evolution necessitatesdistributedandcollaborativesecuritysolutions thatcaneffectivelyhandlelarge-scale,heterogeneousdata sources(Kairouzetal.,2021).
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
1.1.2 Increasing Cybersecurity Threats
As network infrastructures expand, the frequency and sophisticationofcyberattackscontinuetorise.Threatssuch as Distributed Denial-of-Service (DDoS) attacks, malware propagation, phishing, and unauthorized access attempts exploit vulnerabilities across distributed systems. These attacks often occur simultaneously across multiple nodes, makingdetectionmorechallengingfortraditionalsystems. Thedynamicnatureofmodernthreatsrequiresintelligent detection mechanisms that can adapt to evolving attack patternsandidentifypreviouslyunseenanomalies(Buczak andGuven,2016).
1.1.3 Need for Intelligent Network Intrusion Detection Systems
Traditionalintrusiondetectionsystems,particularlythose basedonsignaturematching,arelimitedintheirabilityto detectnovelorzero-dayattacks.Thishasledtotheadoption ofmachinelearninganddeeplearningtechniquesthatcan automatically learn patterns from network traffic data. Intelligent NIDS leverage these techniques to identify anomalous behavior, improving detection accuracy and adaptability. However, these systems often require large amountsofcentralizeddata,whichintroducesprivacyand scalabilityconcernsindistributedenvironments(Sommer andPaxson,2010).
1.2 Limitations of Existing Approaches
Despiteadvancementsinintrusiondetectiontechnologies, existing approaches face several critical limitations when appliedtomoderndistributednetworkenvironments.These challenges stem from the reliance on centralized architectures,data-sharingconstraints,andtheinabilityto effectivelyhandleheterogeneousdatadistributionsacross nodes.
1.2.1 Centralized Intrusion Detection Systems
Centralized IDS architectures collect network traffic data frommultiplesourcesintoasinglerepositoryforanalysis. Whilethisapproachsimplifiesdataprocessing,itintroduces significant privacy and security risks, as sensitive informationisexposedtopotentialbreaches.Additionally, centralizedsystemssufferfromscalabilityissuesduetothe high volume of data generated in distributed networks, leading to increased communication overhead and processingdelays(ShokriandShmatikov,2015).
1.2.2 Limitations of Traditional Machine Learning Approaches
Machine learning-based intrusion detection systems typically rely on centralized datasets for training. In distributed environments, sharing raw data across organizations or nodes is often restricted due to privacy regulations and confidentiality concerns. This limits the
availability of diverse training data and reduces the effectiveness of traditional machine learning models. Furthermore, centralized training approaches may not generalizewelltoheterogeneousnetworkconditionswhere data distributions vary significantly across nodes (Dwork andRoth,2014).
1.2.3 Limitations of Standard Federated Learning (FedAvg)
Federatedlearninghasemergedasapromisingsolutionfor privacy-preservingdistributedlearning;however,standard aggregation techniques such as Federated Averaging (FedAvg)assumethatdataacrossnodesareindependently and identically distributed (IID). In real-world scenarios, networktrafficdataisoftennon-IID,leadingtoperformance degradation when using simple averaging methods. This limitation highlights the need for more advanced aggregation strategies that can effectively handle data heterogeneity(Lietal.,2020).
1.3 Problem Statement
The primary challenge addressed in this research is the developmentofanefficientandprivacy-preservingintrusion detection framework suitable for distributed network environments. Existing federated learning approaches struggle with inefficient parameter aggregation in heterogeneous settings, where variations in data quality, node reliability, and traffic patterns affect model performance. Additionally, there is an inherent trade-off between maintaining data privacy and achieving high detectionaccuracy,asstricterprivacyconstraintscanlimit the availability of useful training information. Therefore, thereisaneedforarobustframeworkthatbalancesprivacy preservationwitheffectiveintrusiondetectionperformance infederatedenvironments.
1.4 Proposed Solution
Toaddresstheidentifiedchallenges,thisstudyproposesa federated learning-based intrusion detection framework enhancedwithadaptivecross-nodeparameterfusion.Inthis approach, multiple distributed nodes train local models using their own network data and share only model parameters with a central aggregation server. Unlike conventional methods, the proposed adaptive fusion strategydynamicallyassignsweightstonodeupdatesbased on factors such as data quality, node reliability, and local model performance. This ensures that high-quality contributionshaveagreaterinfluenceontheglobalmodel, improvingaccuracyandrobustnesswhilepreservingdata privacy.
2. RELATED WORK
The field of network intrusion detection and privacypreserving machine learning has witnessed significant
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
advancements in recentyears.Researchershave explored various techniques ranging from traditional rule-based systems to modern distributed learning frameworks. This section critically reviews existing literature on intrusion detection systems (IDS), privacy-preserving methods, federated learning applications in cybersecurity, and aggregation strategies, while highlighting the gaps that motivatetheproposedresearch.
2.1 Network Intrusion Detection Systems
NetworkIntrusionDetectionSystems(NIDS)areessential components of cybersecurity frameworks, designed to monitor network traffic and identify malicious activities. Over time, IDS techniques have evolved from static rulebasedapproachestointelligentsystemscapableoflearning complexattackpatterns.
2.1.1 Signature-Based vs Anomaly-Based Detection
Signature-based intrusion detection relies on predefined patterns or known attack signatures to identify malicious activities.Whileeffectiveindetectingknownthreats,itfails torecognizeneworevolvingattacks.Incontrast,anomalybased detection systems establish a baseline of normal networkbehaviorandflagdeviationsaspotentialintrusions. Although anomaly-based methods can detect zero-day attacks, they often suffer from higher false positive rates, makingthemlessreliableincertainscenarios(Buczakand Guven,2016).
2.1.2 Machine Learning and Deep Learning-Based IDS
Theintegrationofmachinelearning(ML)anddeeplearning (DL)techniqueshassignificantlyenhancedthecapabilities ofintrusiondetectionsystems.Supervisedlearningmodels, suchasSupportVectorMachinesandRandomForests,are widely used for classification tasks, while deep learning models like Convolutional Neural Networks (CNN) and Recurrent Neural Networks (RNN) can capture complex spatial and temporal patterns in network traffic. These approaches improve detection accuracy and adaptability; however,they typicallyrequirelargecentralizeddatasets, whichraisesprivacyandscalabilityconcernsindistributed environments(Kimetal.,2016).
2.2 Privacy-Preserving Machine Learning
Privacy-preserving machine learning techniques aim to enablecollaborativedataanalysiswithoutexposingsensitive information. These methods are particularly important in domains like cybersecurity, where data confidentiality is critical.
2.2.1 Differential Privacy
Differentialprivacyintroducescontrollednoiseintodatasets ormodeloutputstopreventtheidentificationofindividual data records. This technique ensures thatthe inclusion or
exclusionofasingledatapointdoesnotsignificantlyaffect the model’s outcome, thereby protecting user privacy. It provides strong theoretical guarantees but may reduce model accuracy due to the added noise (Dwork and Roth, 2014).
2.2.2 Homomorphic Encryption
Homomorphic encryption allows computations to be performeddirectlyonencrypteddatawithoutdecryptingit. This enables secure data processing in untrusted environments,assensitiveinformationremainsencrypted throughout the computation process. Although highly secure,thismethodiscomputationallyexpensiveandmay notbesuitableforreal-timeintrusiondetectionscenarios.
2.2.3 Secure Multiparty Computation (SMPC)
Securemultipartycomputationenablesmultiplepartiesto collaborativelycomputeafunctionovertheirprivateinputs without revealing the actual data. This approach ensures data confidentialitywhileallowingjointmodel training or analysis.However,SMPCofteninvolvescomplexprotocols and high communication overhead, which can limit its scalability in large distributed systems (Bonawitz et al., 2017).
2.3 Federated Learning in Cybersecurity
Federated learning (FL) has emerged as a promising paradigm for privacy-preserving machine learning in distributed environments, including cybersecurity applications.
2.3.1 FL-Based Intrusion Detection Frameworks
FL-basedIDSframeworksallowmultiplenetworknodesto collaboratively train a global intrusion detection model withoutsharingrawdata.Eachnodeperformslocaltraining and shares only model updates with a central server for aggregation. This approach enhances privacy while leveraging diverse data sources to improve detection performance. Several studies have demonstrated that FLbasedIDScanachievecomparableaccuracytocentralized modelswhilereducingprivacyrisks(McMahanetal.,2017).
2.3.2 Advantages and Limitations
Federatedlearningofferssignificantadvantages,including data privacy preservation, reduced communication overhead, and scalability across distributed systems. However,italsofaceschallengessuchasdataheterogeneity (non-IID data), communication inefficiency, and vulnerability to unreliable or malicious nodes. These limitations can negatively impact model convergence and overall performance, particularly in complex network environments(Yangetal.,2019).
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
2.4 Aggregation Techniques in Federated Learning
Aggregationplaysacriticalroleinfederatedlearning,asit determineshowlocalmodel updatesfromdifferentnodes arecombinedtoformaglobalmodel.
2.4.1
Federated Averaging (FedAvg)
FederatedAveraging(FedAvg)isthemostcommonlyused aggregationmethodinFL.Itcomputesaweightedaverageof local model parameters based on the size of each node’s dataset. While simple and efficient, FedAvg assumes that dataacrossnodesisidenticallydistributed,whichisrarely thecaseinreal-worldapplications.
2.4.2
Weighted Aggregation Methods
To address some limitations of FedAvg, weighted aggregation techniques have been proposed, where node contributionsareadjustedbasedonfactorssuchasdataset sizeortrainingperformance.Thesemethodsaimtoimprove modelaccuracyandconvergence;however,theystillrelyon staticweightingschemesthatmaynotfullycapturedynamic variationsindataqualityornodereliability.
2.4.3
Limitations in Non-IID Data Environments
Inpracticalscenarios,dataacrossnodesisoftennon-IIDdue todifferencesinnetworkconfigurations,userbehavior,and attackpatterns.Standardaggregationmethodsstruggleto handle such heterogeneity, leading to degraded model performance and slower convergence. This limitation highlightstheneedforadaptiveaggregationstrategiesthat candynamicallyadjusttovaryingdatadistributions(Lietal., 2020).
2.5 Adaptive Parameter Fusion Methods
Adaptiveparameterfusionhasbeenintroducedtoenhance the effectiveness of federated learning by dynamically combiningmodelupdatesfromdifferentnodes.
2.5.1
Existing Adaptive Aggregation Approaches
Recent studies have proposed adaptive aggregation techniques that assign weights to node updates based on performance metrics, data quality, or reliability. These methodsaimtoprioritizehigh-qualitycontributionswhile minimizing the impact of noisy or unreliable nodes. By considering node-specific characteristics, adaptive fusion improves global model accuracy and robustness in heterogeneousenvironments.
2.5.2
Research Gaps in Adaptive Fusion
Despitetheseadvancements,existingadaptiveaggregation methods are still limited in their application to intrusion detectionsystems.Most studiesfocus on general machine learningtasksanddonotfullyaddresstheuniquechallenges
of network security, such as real-time detection, highdimensionaldata,andevolvingattackpatterns.Additionally, manyapproachesdonotconsidersystemefficiencymetrics suchascommunicationoverheadandenergyconsumption.
2.6 Research Gap
Although significant progress has been made in intrusion detection and federated learning, several critical gaps remain. First, there is a lack of adaptive parameter fusion techniques specifically designed for intrusion detection systems operating in distributed environments. Second, existing methods struggle to effectively handle heterogeneous and non-IID data across nodes, leading to suboptimaldetectionperformance.Finally,limitedattention hasbeengiventooptimizingsystemefficiency,particularly in terms of communication overhead and energy consumption. These gaps highlight the need for a comprehensiveframeworkthatintegratesadaptivefusion withprivacy-preservingfederatedlearningtoimproveboth performance and efficiency in modern network intrusion detectionsystems.
3. PROPOSED METHODOLOGY
This section presents the proposed methodology for developingaprivacy-preservingnetworkintrusiondetection system (NIDS) using federated learning enhanced with adaptivecross-nodeparameterfusion.Themethodologyis designed to address the challenges of data privacy, heterogeneity, and scalability in distributed network environments. It integrates local model training at distributed nodes with an intelligent global aggregation mechanism to achieve efficient and accurate intrusion detection.
3.1 System Overview
Theproposedsystemisbasedonafederatedlearning(FL) architectureintegratedwithanetworkintrusiondetection system. The framework consists of multiple distributed nodes and a central aggregation server. Each node representsanindependentnetworkentitythatcollectsand processeslocaltrafficdata.Insteadoftransmittingrawdata, nodestrainlocalmodelsandsendonlymodelparametersto thecentralserver.Theserveraggregatestheseparameters to form a global intrusion detection model, which is then sharedbackwiththenodesforfurthertraining.
Theoverallarchitectureincludesthreemaincomponents:(i) local nodes for data processing and training, (ii) a communication layer for secure parameter exchange, and (iii) a central server for adaptive aggregation. This design ensures scalability, privacy preservation, and efficient collaborativelearningindistributedenvironments.
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
3.2 Federated Learning Framework
The federated learning framework enables collaborative modeltrainingwithoutrequiringcentralizeddatastorage.It operates through iterative communication between local nodesandthecentralserver.
3.2.1
Local Training at Nodes
Eachnodeindependentlytrainsalocalintrusiondetection modelusingitsowndataset.Thetrainingprocessinvolves preprocessing network traffic data, extracting relevant features,andupdatingmodelparametersusingoptimization techniques. This localized training ensures that sensitive data remains within the node, reducing the risk of data leakageandcomplyingwithprivacyregulations.
3.2.2
Global Aggregation Process
After local training, nodes transmit their updated model parameters to the central server. The server aggregates these updates to construct a global model that captures knowledge from all participating nodes. This process is repeatediterativelyacrossmultiplecommunicationrounds, allowingtheglobalmodeltoimproveprogressively.Unlike traditional centralized learning, this approach reduces communicationoverheadandenhancesscalability.
3.3
Adaptive Cross-Node Parameter Fusion (Core
Novelty)
The core contribution of this research lies in the adaptive cross-node parameter fusion mechanism, which improves theaggregationprocessinfederatedlearning.
3.3.1
Weight Calculation Strategy
In the proposed method, each node’s contribution to the global model is dynamically weighted based on multiple factors:
Data Quality: Nodeswithcleaner,morerepresentative dataareassignedhigherweights.
Node Reliability: Nodeswithstableperformanceand consistentupdatesareprioritized.
Local Accuracy: Nodes achieving higher local model accuracy contribute more significantly to the global model.
Thisadaptiveweightingensuresthathigh-qualityupdates have a greater influence, improving overall model performance.
3.4
Node-Level Model Design
Ateachnode,amachinelearningordeeplearningmodelis employedforintrusiondetection.
3.4.1 Model Selection
Theproposedframeworksupportsbothtraditionalmachine learning models and deep learning architectures. MultiLayer Perceptrons (MLP) are used for structured featurebaseddatasets,whileConvolutionalNeuralNetworks(CNN) canbe appliedforcapturing complex patternsinnetwork traffic.Thesemodelsarechosenfortheirbalancebetween computationalefficiencyanddetectionaccuracy.
3.4.2 Loss Function and Optimization
Thetrainingprocessusesappropriatelossfunctions,suchas categoricalcross-entropyforclassificationtasks,tomeasure prediction errors. Optimization algorithms like Adam or StochasticGradientDescent(SGD)areemployedtoupdate modelparameters.Hyperparameterssuchaslearningrate, batch size, and number of epochs are carefully tuned to ensureefficientconvergenceandpreventoverfitting.
3.5 Privacy-Preserving Mechanism
Privacy preservation is a fundamental aspect of the proposedframework.
3.5.1 No Raw Data Sharing
The system ensures that raw network traffic data never leavesthelocalnodes.Alltrainingisperformedlocally,and only model parameters or gradients are shared with the central server. This significantly reduces the risk of data exposureandcomplieswithprivacyregulations.
3.5.2 Secure Parameter Exchange
To enhance security, parameter exchange between nodes andtheserverisconductedthroughsecurecommunication protocols. Techniques such as encryption and secure aggregation can be incorporated to prevent unauthorized accessorinterceptionofmodelupdates.Thisensuresthat even shared parameters do not compromise sensitive information.
4. EXPERIMENTAL SETUP
This section describes the experimental setup used to evaluate the proposed privacy-preserving federated learning-based intrusion detection system. The setup is designed to simulate a realistic distributed network environment, incorporating standard datasets, preprocessing techniques, machine learning frameworks, and evaluation metrics. The goal is to ensure that the proposedframeworkisrigorouslytestedforbothdetection performanceandsystemefficiency.
4.1 Datasets
Theselectionofappropriatedatasetsiscriticalforvalidating the effectiveness of intrusion detection systems. In this
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
study, widely recognized benchmark datasets are used to ensure reliability, comparability, and reproducibility of results.
4.1.1
NSL-KDD Dataset
TheNSL-KDDdatasetisanimprovedversionoftheoriginal KDD’99 dataset, designed to eliminate redundant records and reduce bias in model evaluation. It contains labeled network traffic data categorized into normal and various attack types, including Denial-of-Service (DoS), Probe, Remote-to-Local(R2L),andUser-to-Root(U2R)attacks.The dataset is balanced and structured, making it suitable for training and evaluating machine learning models in intrusion detection research. Its reduced redundancy ensures that models are not biased toward frequent patterns,leadingtomoreaccurateperformanceassessment.
4.1.2
CICIDS2017 Dataset
TheCICIDS2017datasetrepresentsmodernnetworktraffic scenarios and includes a wide range of contemporary cyberattackssuchasDistributedDenial-of-Service(DDoS), bruteforceattacks,portscanning,andweb-basedattacks.It containsrealistictrafficpatternscollectedfromasimulated network environment, making it highly suitable for evaluating intrusion detection systems in current cybersecurity contexts. The diversity and scale of this datasetallowforrobusttestingoftheproposed federated learningframeworkundercomplexanddynamicconditions.
4.2 Data Preprocessing
Data preprocessing is an essential step to prepare raw networktrafficdataforeffectivemodeltraining.Itensures consistency, improves data quality, and enhances the learningcapabilityofmachinelearningmodels.
4.2.1
Normalization
Normalizationisappliedtoscalenumericalfeaturesintoa uniform range, typically between 0 and 1. This process prevents features with larger values from dominating the learning process and ensures faster convergence during model training. It also improves the stability and performance of optimization algorithms used in machine learningmodels.
4.2.2
Encoding
Networkdatasetsoftencontaincategoricalfeaturessuchas protocoltype,service,andconnectionflags.Thesefeatures are transformed into numerical representations using encoding techniques such as one-hot encoding or label encoding. This conversion is necessary because machine learninganddeeplearningmodelsrequirenumericalinputs forprocessing.
4.2.3 Feature Selection
Featureselectioninvolvesidentifyingandretainingthemost relevant attributes from the dataset while eliminating redundant or irrelevant features. This reduces dimensionality, lowers computational complexity, and improvesmodelaccuracy.Keyfeaturessuchasconnection duration, source and destination bytes, and packet counts are selected to effectively represent network behavior for intrusiondetection.
4.3
Simulation Environment
The experimental evaluation is conducted in a simulated distributed environment that mimics real-world network conditions.Thissetupenablestestingoffederatedlearning undercontrolledyetrealisticscenarios.
4.3.1
Programming and Machine Learning Frameworks
The implementation is carried out using Python as the primaryprogramminglanguageduetoitsextensivesupport fordataanalysisandmachinelearning.Frameworkssuchas TensorFlowandPyTorchareusedforbuildingandtraining the local intrusion detection models. These frameworks provideefficienttoolsformodeldevelopment,optimization, andevaluation.
4.3.2 Federated Learning Framework
To implement federated learning, specialized frameworks such as Flower or PySyft are utilized. These frameworks facilitatecommunicationbetweendistributednodesandthe central server, enabling efficient orchestration of local training and global aggregation. They also support customization of aggregation strategies, allowing the integration of the proposed adaptive parameter fusion method.
4.3.3
Multi-Node Simulation Setup
The system simulates multiple distributed nodes, each representing an independent network entity with its own local dataset. These nodes perform local training and periodicallysharemodelupdateswithacentralserver.The multi-nodesetupallowsevaluationoftheframeworkunder heterogeneous data distributions and varying node conditions,reflectingreal-worlddistributedenvironments.
4.4 Evaluation Metrics
Tocomprehensivelyassesstheperformanceoftheproposed system, both detection accuracy and system efficiency metricsareconsidered.
4.4.1
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
Detection Performance Metrics
Detection performance is evaluated using standard classification metrics. Accuracy measures the overall correctness of predictions, while precision indicates the proportion of correctly identified attacks among all predictedattacks.Recallreflectstheabilityofthemodelto detectactualattacks,andtheF1-scoreprovidesabalanced measure combining precision and recall. These metrics collectively provide a detailed evaluation of the intrusion detectioncapabilityofthemodel.
4.4.2 False Positive Rate
The false positive rate (FPR) measures the proportion of normal network traffic incorrectly classified as malicious. Thismetricisparticularlyimportantinintrusiondetection systems,ashighfalsepositiveratescanleadtounnecessary alertsandincreasedworkloadforsystemadministrators.A lowerFPRindicatesamorereliableandpracticaldetection system.
4.4.3
System Efficiency Metrics
In addition to detection performance, system efficiency is evaluated using metrics such as communication overhead andconvergencetime.Communicationoverheadmeasures the amount of data exchanged between nodes and the central serverduringtraining.Convergence timerefers to thenumberofcommunicationroundsrequiredfortheglobal model to achieve stable performance. These metrics are critical for assessing the scalability and practicality of the federatedlearningframework.
4.5 Baselines for Comparison
Tovalidatetheeffectivenessoftheproposedapproach,its performance is compared against established baseline models.
4.5.1 Centralized Intrusion Detection System
ThecentralizedIDSservesasatraditionalbaseline,where allnetworkdataisaggregatedatacentralserverfortraining andanalysis.Whilethisapproachcanachievehighaccuracy duetoaccesstocompletedata,itsuffersfromprivacyrisks, highcommunicationoverhead,andscalabilitylimitations.
4.5.2 Standard Federated Learning (FedAvg)
The standard federated learning model using Federated Averaging(FedAvg)isusedasadistributedbaseline.Inthis approach,allnodescontributeequallytotheglobalmodel through simple averaging of parameters. Although it preserves privacy better than centralized systems, it does notaccountfordataheterogeneityacrossnodes,whichcan lead to reduced performance. Comparing the proposed adaptive fusion method with FedAvg highlights the improvementsinaccuracy,efficiency,androbustness.
5. RESULTS AND ANALYSIS
This section presents a comprehensive evaluation of the proposed federated learning-based network intrusion detection system with adaptive cross-node parameter fusion. The results are analyzed in terms of detection performance, misclassification behavior, node-level contribution,communicationefficiency,convergencespeed, and energy sustainability. Comparative analysis with baselinemodelsfurtherhighlightstheeffectivenessofthe proposedapproach.
5.1 Detection Performance
The detection performance of the proposed model is evaluated using standard classification metrics, including accuracy, precision, recall, and F1-score. These metrics collectively measure the effectiveness of the system in correctly identifying both normal and malicious network traffic.
5.1.1 Accuracy Comparison
Accuracyrepresentstheoverallcorrectnessofthemodel’s predictions.Theproposedadaptivefusionmodelachieves higher accuracy compared to conventional federated learning (FedAvg) and centralized intrusion detection systems. This improvement is attributed to the intelligent weightingofnodecontributions,whichenhancesthequality oftheglobalmodel.
5.1.2 Precision, Recall, and F1-Score
Precision measures the correctness of predicted attacks, while recall evaluates the model’s ability to detect actual attacks. The F1-score provides a balanced assessment of bothmetrics.Theproposedmethoddemonstratessuperior performanceacrossallthesemetrics,indicatingimproved detectioncapabilityandrobustness.
Table 1: Detection Performance Comparison
5.2 Misclassification Analysis
Misclassification analysis is essential to understand the reliabilityoftheintrusiondetectionsystem,particularlyin minimizingincorrectpredictions.
International
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
5.2.1 False Positives and False Negatives
False positives occur when normal traffic is incorrectly classified as malicious, while false negatives represent undetected attacks. The proposed model significantly reduces both types of errors by prioritizing high-quality node updates during aggregation. This results in a more balancedandreliabledetectionsystem.
Table 2: Misclassification Analysis
5.4 Communication Efficiency
Communication efficiency is critical in federated learning systems,asfrequentdataexchangebetweennodesandthe centralservercanincreasenetworkoverhead.
5.4.1 Reduced Communication Overhead
The proposed adaptive fusion approach reduces communicationoverheadbylimitingtheinfluenceoflowimpactupdatesandprioritizinghigh-qualitycontributions. This reduces the total volume of data transmitted during training.
5.4.2 Fewer Transmissions
By selectively weighting node updates, the framework reducesthenumberofrequiredtransmissionspertraining round. This improves scalability and makes the system suitableforbandwidth-constrainedenvironments.
Table 4: Communication Efficiency
5.3 Node-Level Analysis
Node-level analysis examines how individual nodes contributetotheglobalmodel,particularlyinheterogeneous environmentswheredatadistributionsvary.
5.3.1
Contribution of Heterogeneous Nodes
Intheproposedframework,nodeswithhigherdataquality and better local model performance are assigned greater weightsduringaggregation.Thisensuresthatreliablenodes have a stronger influence on the global model, while less reliablenodeshavealimitedimpact.Asaresult,thesystem effectively handles non-IID data and improves overall performance.
Table 3: Node-Level Contribution Analysis
5.5 Convergence Analysis
Convergence analysis evaluates how quickly the global modelreachesoptimalperformanceduringtraining.
5.5.1 Faster Training Rounds
The proposed adaptive fusion method accelerates convergence by emphasizing high-quality updates and reducing the influence of noisy data. This leads to fewer training rounds required to achieve stable performance comparedtostandardFLapproaches.
Table 5: Convergence Performance
Convergence Rounds Remarks
Fasterandmore efficient
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
5.6 Energy and Carbon Efficiency
Energy efficiency and environmental sustainability are increasinglyimportantinlarge-scaledistributedsystems.
5.6.1 Energy Consumption Comparison
The proposed model reduces energy consumption by minimizingunnecessarycomputationsandcommunication overhead. Efficient aggregation ensures fewer training roundsandoptimizedresourceutilization.
5.6.2 CO₂ Emission Reduction
Lower energy consumption directly translates to reduced carbon emissions. The proposed approach demonstrates significantenvironmentalbenefitscomparedtocentralized andstandardfederatedlearningsystems.
Table 6: Energy and Carbon Efficiency
6. CONCLUSION
This research presented a privacy-preserving network intrusiondetectionframeworkbasedonfederatedlearning with adaptive cross-node parameter fusion. The study addressedkeylimitationsoftraditionalintrusiondetection systems, including centralized data dependency, privacy risks,andscalabilitychallengesindistributedenvironments. Byleveragingfederatedlearning,theproposedframework enablescollaborativemodeltrainingacrossmultiplenodes withoutsharingrawnetworktrafficdata,therebyensuring data confidentiality and compliance with privacy requirements.
Amajorcontributionofthisworkisthedevelopmentofan adaptive parameter fusion mechanism that dynamically assignsweightstonodeupdatesbasedondataquality,node reliability, and local model performance. This approach effectively handles heterogeneous and non-IID data distributions,improvingtherobustnessandgeneralization oftheglobalmodel.Experimentalresultsdemonstratedthat theproposedmethodoutperformsconventionalcentralized and standard federated learning approaches in terms of
accuracy,precision,recall,andF1-score,whilesignificantly reducingfalsepositiveandfalsenegativerates.
Additionally, the framework achieved improved communicationefficiency,fasterconvergence,andreduced energy consumption, highlighting its suitability for largescale and resource-constrained network environments. Overall,theproposedapproachprovidesascalable,efficient, and privacy-aware solution for modern cybersecurity challenges, contributing to the advancement of intelligent intrusiondetectionsystemsindistributedinfrastructures.
7. FUTURE SCOPE OF RESEARCH
Futureresearchcanextendthisworkbyimplementingthe proposedframeworkinreal-worldnetworkenvironmentsto validateitspracticalapplicabilityandscalability.Integration with advanced privacy-preserving techniques such as differential privacy and secure aggregation can further enhance data protection. Additionally, incorporating blockchain technology may improve trust and security in federated systems. Exploring more sophisticated deep learningarchitecturesandadaptiveoptimizationstrategies couldfurtherimprovedetectionaccuracy.Finally,optimizing theframeworkforlarge-scaleIoTecosystemsandreal-time intrusion detection remains an important direction for futureinvestigation.
REFERENCES
1. Buczak, A.L. and Guven, E., 2016. A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications Surveys&Tutorials,18(2),pp.1153–1176.
2. Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan,H.B.,Patel,S.,Ramage,D.,Segal,A.andSeth, K., 2017. Practical secure aggregation for privacypreserving machine learning. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and CommunicationsSecurity,pp.1175–1191.
3. Dwork, C. and Roth, A., 2014. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science, 9(3–4), pp.211–407.
4. Kairouz,P.,McMahan,H.B.,Avent,B.,Bellet,A.,Bennis, M.,Bhagoji,A.N.,Bonawitz,K.,Charles,Z.,Cormode,G., Cummings, R. and others, 2021. Advances and open problems in federated learning. Foundations and TrendsinMachineLearning,14(1–2),pp.1–210.
5. Kim, G., Lee, S. and Kim, S., 2016. A novel hybrid intrusion detection method integrating anomaly detectionwithmisusedetection.ExpertSystemswith Applications,41(4),pp.1690–1700.
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072
6. Li, T., Sahu, A.K., Talwalkar, A. and Smith, V., 2020. Federated learning: Challenges, methods, and future directions. IEEE Signal Processing Magazine, 37(3), pp.50–60.
7. McMahan,H.B.,Moore,E.,Ramage,D.,Hampson,S.and Arcas,B.A.Y.,2017.Communication-efficientlearningof deepnetworksfromdecentralizeddata.In:Proceedings of the 20th International Conference on Artificial IntelligenceandStatistics(AISTATS),pp.1273–1282.
8. Shokri,R.andShmatikov,V.,2015.Privacy-preserving deeplearning.In:Proceedingsofthe22ndACMSIGSAC ConferenceonComputerandCommunicationsSecurity, pp.1310–1321.
9. Sommer, R. and Paxson, V., 2010. Outside the closed world: On using machine learning for network intrusion detection. In: Proceedings of the IEEE SymposiumonSecurityandPrivacy,pp.305–316.
10. Stallings, W., 2018. Network security essentials: Applicationsandstandards.6thed.Pearson.
11. Albanbay,N.,Tursynbek,Y.,Graffi,K.,Uskenbayeva,R., Kalpeyeva,Z.andAyapov,Y.,2025.Federatedlearningbased intrusion detection in IoT networks: Performanceevaluationanddatascalingstudy.Journal ofSensorandActuatorNetworks,14(4),p.78.
12. Buyuktanir,B.,Altinkaya,Ş.,Baydogmus,G.K.andYildiz, K., 2025. Federated learning in intrusion detection: Advancements, applications, and future directions. ClusterComputing,28,p.473.
13. Liang,Y.andLuo,M.,2025.Optimizationofdistributed networkintrusiondetectionsystembasedonInternet ofThingsandfederatedlearning.DiscoverInternetof Things,6(3),pp.1–15.
14. Fedorchenko,E.,Novikova,E.andShulepov,A.,2022. Comparative review of intrusion detection systems based on federated learning: Advantages and open challenges.Algorithms,15(7),p.247.
15. Feng, S., Gao, L. and Shi, L., 2025. CGFL: A robust federated learning approach for intrusion detection systems based on data generation. Applied Sciences, 15(5),p.2416.
16. Friha, O., Ferrag, M.A. and Shu, L., 2022. FELIDS: Federated learning-based intrusion detection system foragriculturalIoT.JournalofParallelandDistributed Computing,165,pp.17–31.
17. Hei, X., Yin, X., Wang, Y. and others, 2020. A trusted featureaggregatorforfederatedlearningindistributed attackdetection.Computers&Security,99,p.102033.
18. Anwar, R.W., Abrar, M., Salam, A. and Ullah, F., 2025. FederatedlearningwithLSTMforintrusiondetection inIoT-basedwirelesssensornetworks:Amulti-dataset analysis.PeerJComputerScience,11,e2751.
19. Yang,H.etal.,2025.Federatedlearningforsustainable intrusion detection systems: A review of green computingstrategiesandfuturedirections.Internetof Things,34,p.101730.
20. Wang, C., Zhang, Y., Gao, N. and Luo, Q., 2025. Differential privacy personalized federated learning basedondynamicallysparsifiedclientupdates.Future GenerationComputerSystems.
21. Wu, X., Zhang, Y., Shi, M., Li, P. and Xiong, N.N., 2022. Adaptive federated learning scheme with differential privacy preserving. Future Generation Computer Systems,127,pp.362–372.
22. Marfo, W., Tosh, D.K. and Moore, S.V., 2023. Network anomaly detection using federated learning. arXiv preprintarXiv:2303.07452.
23. Hossain, M.A. and Islam, M.S., 2025. Towards decentralized cybersecurity: A privacy-preserving federated learning approach for botnet attack detection.Blockchain:ResearchandApplications.
24. Popli, M.S., Singh, R.P., Popli, N.K. and Mamun, M.A., 2025. A federated learning framework for enhanced data security and cyber intrusion detection in distributed networks. IEEE Access, 13, pp.12634–12646.
25. Izadi, S. and Ahmadi, M., 2026. Adaptive metaaggregationfederatedlearningforintrusiondetection inheterogeneousIoT.arXivpreprintarXiv:2602.12541.