FL-IIDS: Federated Learning for Incremental Intrusion Detection System

Overview

FL-IIDS is a research project that applies Federated Learning to the problem of network intrusion detection. It leverages the Flower framework for orchestrating federated learning and uses the UNSW_NB15 dataset as the benchmark for evaluating intrusion detection performance. The core model is a simple neural network implemented in TensorFlow/Keras, with support for advanced continual learning techniques such as Dynamic Example Memory (DEM) and Label Gradient Balancing (LGB/LLS). This project follows the methodology described in:

Jin, Z., Zhou, J., Li, B., Wu, X., & Duan, C. (2024). FL-IIDS: A novel federated learning-based incremental intrusion detection system. Future Generation Computer Systems, 151, 57-70.

Features

• Federated Learning: Distributed training across multiple simulated clients.
• Continual Learning: Supports incremental learning with memory replay and knowledge distillation.
• Configurable Modes: Easily switch between baseline, DEM, and full (DEM + LGB/LLS) modes.
• Result Visualization: Plot accuracy and loss curves for different modes.

Setup & Installation

1. Clone the repository and navigate to the project directory.

   git clone https://github.com/Neit272/FL-IIDS.git
   cd FL-IIDS

2. Install dependencies (preferably in a virtual environment):

   pip install -r requirements.txt

3. Download the UNSW_NB15 dataset:

   • Download UNSW_NB15_training-set.csv and UNSW_NB15_testing-set.csv from the official source.
   • Place both files in the data/ folder inside the project directory.

Running the Project

You can run FL-IIDS in several ways:

1. Manual Federated Learning

• Start the server:

  python server.py

• Start each client in a separate terminal (at least 3 clients are required):

  CLIENT_ID=client_1 python client.py

  Note: The server listens on port 8080 by default. If you wish to use a different port, update the server_address in server.py and client.py.

2. Automated Simulation

• Run the simulation script (spawns server and clients automatically):

  python simulation.py --mode baseline --clients 3 --rounds 3

  • --mode: Choose from baseline, dem, or full.
  • --clients: Number of simulated clients (default: 3).
  • --rounds: Number of federated learning rounds (default: 3).

3. One-Command Orchestration

• Use the provided runner to launch both server and clients:

  python run_fliids.py --mode full --clients 3

  • This will start the server and the specified number of clients in separate processes.

Visualizing Results

After training, you can visualize accuracy and loss curves for all modes:

python plot_result.py

This will generate comparison plots in the logs directory.

Project Structure

• client.py & server.py: Main entry points for federated learning.
• simulation.py: Script for automated simulation.
• run_fliids.py: Orchestrates server and clients for quick experiments.
• utils/: Helper modules for data loading, model definition, memory, and losses.
• logs/: Stores training results and plots.
• data/: Place your dataset files here.

Configuration

• Switch between modes (baseline, dem, full) using the --mode argument or by editing config.py.
• Adjust federated learning parameters (rounds, clients, batch size) via command-line arguments.

Citation

If you use this project for research, please cite the original UNSW_NB15 dataset, the Flower framework, and the following paper:

Jin, Z., Zhou, J., Li, B., Wu, X., & Duan, C. (2024). FL-IIDS: A novel federated learning-based incremental intrusion detection system. Future Generation Computer Systems, 151, 57-70.

---

For questions or contributions, please open an issue or pull request on the repository.