International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 03 | Mar 2026 www.irjet.net p-ISSN: 2395-0072
StatAvg-Enhanced Federated Intrusion Detection System under NonIID Settings
Shruti Ipar1, Sanika Kondekar2 , Sakshi Kshirsagar3 , Sonal Kadam4
123Student, Dept. of Computer Science & Technology, Usha Mittal Institute of Technology, SNDT Women’s University, Mumbai, India
4Assistant Professor, Dept. of Computer Science & Technology, Usha Mittal Institute of Technology, SNDT Women’s University, Mumbai, India
Abstract - An Intrusion Detection Systems (IDS) are essential for protecting distributed networks, but traditional centralizedapproachescompromisedataprivacybyrequiring raw traffic sharing. Federated Learning (FL) enables collaborative model training without exchanging sensitive data;however,standardaggregationmethodssuchasFedAvg suffer performance degradation under non-IID client data distributions.Thisresearchproposesaprivacy-preservingFLbased IDS framework that comparatively evaluates three aggregation strategies: FedAvg, FedProx, and a proposed Statistical Averaging (StatAvg) method. While FedProx stabilizes local updates using proximal regularization, the proposed StatAvg mechanism incorporates global statistical normalization to improve aggregation robustness in heterogeneous environments. Comparative analysis shows that StatAvg enhances detection performance under non-IID conditions, making the system suitable for scalable and privacy-preserving enterprise cybersecurity applications
Key Words: Federated Learning, Intrusion Detection System, FedAvg, Fed Prox, StatAvg, Non-IID Data, Privacy Preservation.
1. INTRODUCTION
Intrusion Detection Systems (IDS) are fundamental componentsofmoderncybersecurityframeworks,enablingcontinuousmonitoringofnetworktrafficandtimelydetection ofmaliciousactivities.Withtherapidevolutionofcloud computing,IoTecosystems,anddistributedinfrastructures, ensuringsecureandprivacy-preservingthreatdetectionhas becomeincreasinglycritical[1][2].Traditionalcentralized IDSarchitecturescollectrawtrafficdataatacentralserver fortrainingandanalysis.Althougheffectiveincontrolled environments,suchsystemssufferfrommajorlimitationsincludingprivacyrisks,communicationoverhead,andscalabilityconstraintsinlarge-scaledeployments.
TheemergenceofFederatedLearning(FL)hasintroduced adecentralizedparadigmthatenablescollaborativemodel trainingwithoutsharingrawdata[6][10].InFL-based systems,clientslocallytrainmodelsontheirprivatedatasets andshareonlymodelparameterswithacentralaggregator.
This approach significantly enhances data confidentiality and aligns with modern privacy-preserving computing
architectures. FL has shown promising potent- ial in intrusion detection for distributed IoT and edge environments [3][5][7]. However, a critical challenge in federatedintrusiondetectionisthepresenceofnon-identical-ly andindependentlydistributed(non-IID)dataacrosscli-ents In real-world networks, traffic distributions and atta-ck patterns vary significantly between organizations and devices.StandardaggregationtechniquessuchasFederat-ed Averaging (FedAvg) often experience degraded convergence and reduced accuracy under such heterogeneous conditions [3][4]. Addressing this issue is essential to ensurereliableandscalablefederatedIDSdeployment.
Recentstudieshaveexploredstatisticalnormalizationstrategies to mitigate the impact of non-IID distributions in federated settings [4]. Motivated by these advancements, thisworkproposesaFederatedLearning-basedIDSframeworkthatcomparativelyevaluatesFedAvg,FedProx,anda StatisticalAveraging(StatAvg)aggregationmechanism.The proposed StatAvg method incorporates global statisti-cal normalization during model aggregation to better align clientupdatesand improvestabilityunderheterogeneous datadistributions.
Experimentsareconductedusingbenchmarkcybersecurity datasetssuchasCICIDS2017andCICIoT2023[8][9].The results demonstrate improved convergence stability and competitivedetectionperformancewhilepreservingprivacy acrossdistributedclients.
1.1 Problem Statement
ExistingFederatedLearning-basedIntrusionDetection Systems (FL-IDS) face challenges in dealing with heterogeneous data and Non-Independent and Identically Distributed (non-IID) data among clients. This may cause biasedlocalupdates,whichmaynegativelyimpactaccuracy andconvergenceofmodels.Thus,anefficient,precise, and scalable framework is required for an IDS, which can be achieved through the integration of StatAvg-based normalizationinFL-IDS.
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 03 | Mar 2026 www.irjet.net p-ISSN: 2395-0072
2. LITERATURE SURVEY
In[1],Goginenidiscussesconfidentialcomputingarchitectures that enhance data privacy using trusted execution environments. This work is relevant to federated and distributed learning systems where sensitive data must remainprotectedduringcomputation.
In[2],Chippagiripresentsasystematicreviewofserver lesscomputing,highlightingchallengesrelatedtoscalability, latency,security,andoptimizationstrategies.Althoughnot directlyfocusedonintrusiondetection,thestudyprovides architecturalinsightsusefulforscalableIDSdeployments.
In[3],Karimetal.provideacomprehensivesurveyoffederatedlearning-basedintrusiondetectionsystems,discussinglearningmodels,datasets,evaluationmetrics,and challengessuchasnon-IIDdataandcommunicationoverhead.
In [4], Li et al. investigate statistical normalization tech niquesforfederatedlearningundernon-IIDsettings.Their work demonstratesimprovedaggregationrobustnessand convergence,whichisdirectlyapplicabletoFL-basedIDS frameworks
In[5],NguyenandKimproposeafederatedlearningap proach combined with deep neural networks for IoT intrusiondetection,achievingimproveddetectionaccuracy whilepreservingdataprivacy.
In[6],ShokriandShmatikovintroduceprivacypreserving deep learning methods that enable collaborative training withoutsharingrawdata,formingthetheoreticalfoundation ofmodernfederatedlearningsystems.
In [7], Zhang et al. propose a blockchain-assisted federated learning framework for edge-based intrusion detection,im-provingtrustandrobustnessagainstmalicious participants.
In [8], The CICIDS2017 dataset is a widely used bench mark for evaluating intrusion detection systems with realisticnetworktrafficandattackscenarios.
In[9],TheCICIoT2023datasetprovideslarge-scaleIoT traffic data designed for modern intrusion detection researchinIoT-centricenvironments.
In[10],Bonawitzetal.discusssystemdesignchallenges and solutions for deploying federated learning at scale, includingsecureaggregationandcommunicationefficiency.
3. METHODOLOGY
ThissectionpresentstheproposedHybridFederatedLearning-basedIntrusionDetectionSystem(FL-IDS),whichis likelytoimprovetherobustnessoftheglobalmodeland
convergenceinnon-IIDscenarios.Weplantointegratethe FedProxregularizationmethodwiththeHybridFedAvgStatAvgaggregationmethodintheproposedsystem.
The proposed system is based on centralized federated learning architecture. The proposed system architecture consistsofthefollowingcomponents:
•Onecentralserver
•Severaldistributedclients
•Aunifiedglobalneuralnetwork
Eachclientisresponsiblefortrainingthemodellocally.The clientwillonlysendthemodelupdatetothecentralserver. Therawdata will not besentto theserver.Theproposed workflowoftheproposedsystemisasfollows:
1)Centralserverinitializestheglobalmodel.
2)Serverdistributesthemodeltoclients.
3)Clientstrainmodellocally
4)Clientssendupdatedweightstothecentralserver.
5)Serveraggregatesupdatesandupdatestheglobalmodel. Thisprocessrepeatsformultiplecommunicationrounds
3.1 Dataset Preprocessing
ThesystemisbasedonCIC-IDS2018dataset,abenchmark networkintrusiondetectiondatasetcontainingbenignand multipleattackcategories.
1)
DataProcessingSteps
Eachclient’sdatasetundergoesthepreprocessingstepsindependently.Thedatapreprocessingstepsinclude:
•Removalofirrelevantcolumns(ifapplicable)
•Labelextractionfromthefinalcolumn
•Conversionofcategoricallabelsintonumericvalues
•One-hotencodingofcategoricalfeatures
•Conversionoffeaturesto32-bitfloatingpoint
•Splitofdataintotrainingandtestingsets(80-20split)
Eachclient'sdatasetwillundergotheabovepreprocessing operationsindividually.
3.2 Global Model Design
The global model design for the proposed framework is a lightweightfullyconnectedneuralnetwork.
•InputLayer:Equaltoencodedfeaturedimension
• Hidden Layer: 128 neurons implemented using ReLU activation
•Output Layer: Binary classification (Benign vs Attack)
Mathematically:
h=ReLU(W1x+b1) (1)
ŷ=W2h+b2 (2)
Cross-EntropyLossisusedforoptimizationpurposes.The proposedmodelisintentionallydesignedtobelightweight to reduce communication overhead during federated training.
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 03 | Mar 2026 www.irjet.net p-ISSN: 2395-0072
3 3 Federated Learning Framework
ThefederatedlearningprocessoperatesforRcommunicationrounds.Eachroundinvolves:
•Globalbroadcast
•Localtraining
•Hybridaggregation
•Evaluation
3.4 Client-Side Training with FedProx
Toaddressclientheterogeneityandnon-IIDdatadistribution,FedProxregularizationisusedinlocaltraining.Each clientminimizes:
(3)
where LCE istheCross-EntropyLoss, w islocalmodelweights, wg isglobalmodelweights,and µ istheproximalcoefficient. The proximal term is used to prevent local updates from deviating significantly from global model updates. This is particularly effective in heterogeneous conditions. Local optimizationisdoneusingStochasticGradientDescent(SGD).
3 5 Hybrid Aggregation Strategy
UnliketraditionalfederatedlearningthatusesonlyFedAvg, theproposedmethodcombines:
•Dataset-sizeawareaggregation(FedAvg)
•Statisticalnormalization-basedaggregation(StatAvg)
1) FedAvgComponent
TheFedAvgaggregationcomputes:
(4)
where ni isthenumberofsamplesatclient i,and n isthe totalnumberofsamplesacrossclients.
2) StatAvg Component First compute the update difference:
∆i = wi wg (5)
ThenStatAvgaggregationiscomputedas:
(6)
This mechanism normalizes updates based on their statisticalcontribution.
3) Hybrid Global Update The final global model is computedasfollows:
(7)
This balanced strategy preserves fairness (FedAvg), reduces instability from non-IID updates (StatAvg), and improvesconvergencerobustness.
3.6 Model Evaluation
Aftereachcommunicationround,theupdatedglobalmodelis evaluatedonthefollowing:
•Aggregatedclienttestdatasets
•IndividualclienttestdatasetsAccuracyiscomputedas: CorrectPredictions
Accuracy= (8)
TotalSamples
Globalaccuracytrendsandper-clientaccuracyarerecorded.
3.7 Model Persistence and Monitoring
Atthecompletionoftraining:
• Thefinalglobalmodelisstoredfordeployment
• Accuracy trends are visualized across communicationrounds
• Per-client performance metrics are analyzed to measurefairness
3.8. Key Contributions of the Proposed Methodology
TheproposedFL-IDSframeworkcontributes:
• IntegrationofFedProxfornon-IIDstabilization
• HybridFedAvg–StatAvgaggregation
• Lightweightneuralarchitectureforcommunication efficiency
• Decentralizedintrusiondetectionframework
• Performance monitoring across heterogeneous clients
4. ALGORITHM AND WORKFLOW
4.1.
Step-by-Step Algorithm Description
StatAvg-FedProx: EnhancedFederatedLearningwith StatisticalNormalizationandProximalOptimization InitializationPhase
Step1: Serverinitializesglobalmodel w0,globalstatistics S0,andproximalparameter µ
Step2: Serverbroadcastsinitializationsignaltoall N clients
StatisticalNormalizationPhase
Step3: Eachclient i computeslocalstatistics:
Localmean
Localvariance
Step4: Eachclientsends(µi, σi2, ni)toserver
Step5: Servercomputesglobalstatistics:
Weightedglobalmean
Globalvariance
Step6: Serverbroadcasts(µG,σG2)toallclients
Step7: Eachclientnormalizeslocaldata:
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 03 | Mar 2026 www.irjet.net p-ISSN: 2395-0072
FederatedTrainingPhaseeachcommunicationround t =0 to T 1
Step8: Serverselectsrandomsubset St of K clients
Step9: Serversends(wt,St,µ)toselectedclients
Step10: Foreachclient k ∈ St inparallel
10.1: Receive(wt,St,µ)
10.2: Initializelocalmodel
10.3: For e =1to E localepochs
10.3.1: Samplebatch b from D k
10.3.2: Computeobjectivefunction µ > 0FedProxmode
FedAvgmode L= Fk(wkt;b)
10.3.3: Computegradient g =∇L
10.3.4: Updatemodel wkt = wkt ηg
10.4: Computeupdate∆wkt = wkt wt
10.5: Send∆wkt toserver
Step11:Serveraggregatesupdates:
FinalizationPhase
Step12: Serveroutputsfinalglobalmodel wT
Step13: Deploy wT forintrusiondetection
4.2. Flowchart Representation
Fig -1:WorkflowofStatAvg-FedProxEnhancedFederated LearningAlgorithm
4.3. Detailed Process Flow
1)Phase1:StatisticalNormalization(One-Time)
2)Phase2:FederatedTraining(Iterative)
3)Phase3:ModelDeployment
4.4. Algorithm Integration Summary
Table -1: Integrationofthreefederatedlearning approaches
Algorithm Component Contribution Implementation
StatAvg Handlesnon-IID datathrough statistical normalization
Globalstatistics computation,data normalization
FedProx Improves convergencewith proximal regularization Optionalproximal terminlocalobjective
FedAvg Efficientmodel aggregation Weightaveraging: wt+1=1P(wt +∆wkt) K k∈St
4.5. Key Process Characteristics
Table -2: Algorithmphasecharacteristics
Phase KeyOperations Communication Pattern
Statistical Normalization
Localstatistics computation, Globalaggregation, Datanormalization
Federated Training
Model Deployment
Clientselection, Localtraining(Fed Prox/FedAvg), Modelaggregation
Finalmodel distribution, Inference execution
4 6. Algorithm Parameters
One-to-many broadcast, Manyto-one aggregation
Selective communication, Parallel processing
One-time deployment,Local inference
Table-3: Keyalgorithmparametersandtheirroles
Parameter Symbol Description
Numberof Clients N Totalavailableclientsinthe federation
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 03 | Mar 2026 www.irjet.net p-ISSN: 2395-0072
Selected Clientsper Round K Numberofclients participatingineachround
TotalRounds T Maximumcommunication roundsfortraining
LocalEpochs E Numberoflocaltraining epochsperclient
LearningRate η StepsizeforlocalSGD updates
Proximal Parameter µ FedProxregularization strength(µ =0forstandard FedAvg, µ > 0forFedProx)
Global Statistics µG, σG2 Aggregatedmeanand varianceforStatAvg normalization
4.7. Key Advantages of the Combined Approach
• Non-IIDRobustness:StatAvgnormalizationmitigatesdata heterogeneityacrossclients
• PrivacyPreservation:Onlystatisticsandmodelupdates shared,notrawdata
• Flexibility:Configurableproximal parameter(µ)allows switchingbetweenFedAvgandFedProxmodes
• Scalability: Efficient FedAvg aggregation maintains low communicationoverhead
• Enhanced Accuracy and Convergence: The combined approach improves intrusion detection performance in heterogeneousenvironments.
5. EXPERIMENTAL SETUP
The experimental setup integrates essential hardware and software for effective development, training, and deployment
5 1 Hardware Specifications
• Server: 8+ CPU cores, 16 GB+ RAM, GPU acceleration(optional)
• Clients:3+CPUcores,8GB+RAMeach
• Storage:50GB+fordatasetsandmodelstorage
• Network: Stable internet connection for federated communication.
5.2. Software Requirements
• OperatingSystem:Ubuntu20.04+/Windows10+
• Python: 3.8+ with required libraries (TensorFlow, Flower,Streamlit)
• Frameworks:TensorFlowFederated,PyTorch (optional)
• DevelopmentEnvironment:JupyterNotebook, VSCode,Git
6. RESULTS AND ANALYSIS
6.1. Implementation
Fig -2:HomePage
Fig -3:ClientsPage Fig -4:Charts
Fig -5:Comparison
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 03 | Mar 2026 www.irjet.net p-ISSN: 2395-0072
6.2.
Evaluation Metrics
Evaluation Metrics demonstrates our Hybrid framework’s superior detection capabilities and operational efficiency. Table4presentsacomprehensivecomparisonofourHybrid frameworkagainsttheleadingsecuritystrategiesacrosskey evaluationmetrics.
Table-3: Evaluationmetricsoncic-ids-2018dataset
7. CONCLUSIONS
The proposed StatAvg-FedProx framework enhances federatedintrusiondetectionbyeffectivelyaddressingdata heterogeneity, privacy preservation, and scalability challenges in distributed environments. Through global statistical normalization and proximal optimization, the modelachievesimprovedconvergencestabilityandhigher detectionperformancecomparedtoconventionalFedAvgbasedmethods.Experimentalresultsdemonstratesuperior accuracy,F1-score,androbustnessundernon-IIDsettings whilemaintaininglowcommunicationoverhead.Overall,the framework provides a secure, scalable, and practically
deployable solution for modern distributed cyber defense systems
8. FUTURE WORK
TheproposedStatAvg-FedProxframeworkcanbeextended tofurtherenhancerobustnessandreal-worldapplicability. In the near term, integrating secure model exchange mechanisms such as blockchain-based verification and adversarialclientdetectioncanimprovetrustandresilience in collaborative environments. Supporting multi-modal securitydataandadaptivelearningratestrategiesmayalso enhance convergence stability under dynamic network conditions.
Inthelongterm,deployingtheframeworkinreal-worldIoT andenterpriseenvironmentsremainsakeyobjective.Future researchmayexplorefederatedtransferlearningtoenable cross-domainknowledgesharing,aswellasExplainableAI techniquestoimproveinterpretabilityofintrusiondetection decisions.Additionally,lightweightoptimizationstrategies andautomatedhyperparametertuningcanfurtherimprove scalabilityandpracticaldeploymentfeasibility.
REFERENCES
[1]A.Gogineni,“ConfidentialComputingArchitecturesfor EnhancedDataPrivacy,” InternationalJournalofScienceand AdvancedTechnology(IJSAT),vol.16,no.2,pp.45–52,Apr.–Jun.2025.
[2] S. Chippagiri, “The Rise of Serverless Computing: A Systematic Review of Challenges and Solutions with Optimization Strategies,” Journal of Cloud Computing, Jan. 2025.
[3] M. Karim, S. A. Chaudhry, and R. Kumar, “Federated Learning-basedIntrusionDetectionSystems:ASurveyand FutureDirections,” IEEE Access,vol.11,pp.15432–15450, 2023.
[4] H. Li, X. Jin, and J. Xu, “Statistical Normalization ApproachesforFederatedLearningUnderNon-IIDSettings,” arXiv preprint arXiv:2405.13062,May2024.
[5]T.NguyenandY.Kim,“EnhancingIoTIntrusionDetection UsingFederatedLearningandDeepNeuralNetworks,” IEEE InternetofThingsJournal,vol.10,no.8,pp.7221–7235,Apr. 2023
[6] R. Shokri and V. Shmatikov, “Privacy-Preserving Deep Learning,”in Proceedings of the ACM SIGSAC Conference,pp. 1310–1321,2023.
[7] Z. Zhang, F. Chen, and M. Yang, “Blockchain-Assisted TrustworthyFederatedLearningforEdge-BasedIntrusion Detection,” FutureGenerationComputerSystems,vol.152,pp. 95–108,2024.
Fig -6:FeatureMapforNetworkIntrusionDetection
International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 13 Issue: 03 | Mar 2026 www.irjet.net p-ISSN: 2395-0072
[8] Canadian Institute for Cybersecurity, “CICIDS2017 Dataset,”UniversityofNewBrunswick.[Online].Available: https://www.unb.ca/cic/datasets/ids-2017.html
[9] Canadian Institute for Cybersecurity, “CICIoT2023 Dataset.” [Online]. Available: https://www.unb.ca/cic/datasets/iotdataset-2023.html
[10] K. Bonawitz et al., “Towards Federated Learning at Scale: System Design,” in Proceedings of SysML, Stanford, USA,2023.
2026, IRJET | Impact Factor value: 8.315 | ISO 9001:2008