Abstract:With the rapid development of the Internet, network security and data privacy are increasingly valued. Although classical Network Intrusion Detection System (NIDS) based on Deep Learning (DL) models can provide good detection accuracy, but collecting samples for centralized training brings the huge risk of data privacy leakage. Furthermore, the training of supervised deep learning models requires a large number of labeled samples, which is usually cumbersome. The "black-box" problem also makes the DL models of NIDS untrustworthy. In this paper, we propose a trusted Federated Learning (FL) Traffic IDS method called FL-TIDS to address the above-mentioned problems. In FL-TIDS, we design an unsupervised intrusion detection model based on autoencoders that alleviates the reliance on marked samples. At the same time, we use FL for model training to protect data privacy. In addition, we design an improved SHAP interpretable method based on chi-square test to perform interpretable analysis of the trained model. We conducted several experiments to evaluate the proposed FL-TIDS. We first determine experimentally the structure and the number of neurons of the unsupervised AE model. Secondly, we evaluated the proposed method using the UNSW-NB15 and CICIDS2017 datasets. The experimental results show that the unsupervised AE model has better performance than the other 7 intrusion detection models in terms of precision, recall and f1-score. Then, federated learning is used to train the intrusion detection model. The experimental results indicate that the model is more accurate than the local learning model. Finally, we use an improved SHAP explainability method based on Chi-square test to analyze the explainability. The analysis results show that the identification characteristics of the model are consistent with the attack characteristics, and the model is reliable.

Deep-Forest-Based Encrypted Malicious Traffic Detection

Low-rate DoS Attack Detection Method Based on Hybrid Deep Neural Networks.

Detecting Anomalies In Encrypted Traffic Via Deep Dictionary Learning

A Survey of Encrypted Malicious Traffic Detection*

Drpsd: An Novel Method Of Identifying Ssl/Tls Traffic

Deep Forest with LRRS Feature for Fine-grained Website Fingerprinting with Encrypted SSL/TLS

Malicious Encrypted Traffic Identification Based on Four-Tuple Feature and Deep Learning

Analysis of Encrypted Network Traffic for Enhancing Cyber-security in Dynamic Environments

An Novel Hybrid Method for Effectively Classifying Encrypted Traffic

Deep Neural Decision Forest (DNDF): A Novel Approach for Enhancing Intrusion Detection Systems in Network Traffic Analysis

Detection of Android Malware Based on Deep Forest and Feature Enhancement

Trusted encrypted traffic intrusion detection method based on federated learning and autoencoder

THS-IDPC: A three-stage hierarchical sampling method based on improved density peaks clustering algorithm for encrypted malicious traffic detection

A method based on hierarchical spatiotemporal features for trojan traffic detection

TLS-MHSA: An Efficient Detection Model for Encrypted Malicious Traffic based on Multi-Head Self-Attention Mechanism

A Novel Malware Encrypted Traffic Detection Framework Based on Ensemble Learning

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

Detecting Unbalanced Network Traffic Intrusions With Deep Learning

Graph based Encrypted Malicious Traffic Detection with Hybrid Analysis of Multi-view Features

Feature Mining for Encrypted Malicious Traffic Detection with Deep Learning and Other Machine Learning Algorithms

Adversarial Malicious Encrypted Traffic Detection Based on Refined Session Analysis