Preferred Name
Abraham J. Reines
Creative Commons License
This work is licensed under a Creative Commons Attribution-NonCommercial-No Derivative Works 4.0 International License.
Date of Graduation
5-14-2026
Semester of Graduation
Spring
Degree Name
Master of Science (MS)
Department
Department of Computer Science
First Advisor
Brett Tjaden
Second Advisor
Adeen Ayub
Third Advisor
Hossain Heydari
Abstract
Intrusion Detection Systems represent a cornerstone of modern network defense, yet their traditional centralized training paradigm presents challenges including Byzantine attacks, data heterogeneity across organizational silos, and scalability constraints. Federated Learning offers a promising alternative by enabling organizations to collaboratively train models without sharing raw data. Applying FL to IDS introduces specific challenges including highly non-independent and identically distributed (non-IID or heterogeneous) client data reflecting diverse network environments, vulnerability to Byzantine participants who poison or manipulate model updates, and the difficulty of distinguishing malicious updates from legitimate organizational diversity.
This thesis investigates robust federated learning under heterogeneous data for intrusion detection. The research integrates resilient aggregation strategies including Krum, Bulyan, and coordinate-wise median to tolerate adversarial updates, while employing heterogeneity mitigation techniques such as FedProx to address client drift under extreme non-IID conditions. The work systematically evaluates these mechanisms across benchmark IDS datasets including CIC-IDS2017, UNSW-NB15, and Edge-IIoTset, partitioned to simulate IID and non-IID distributions characteristic of cross-organizational deployments.
The methodology implements the federated pipeline using the Flower framework while integrating robust aggregation rules and heterogeneity optimization. The evaluation measures Byzantine resilience through poisoning attack scenarios, detection performance via macro-F1 and per-class metrics ensuring balanced coverage across attack families, and convergence characteristics under adversarial conditions. This research advances collaborative, Byzantine-resilient IDS under heterogeneous conditions by connecting theoretical federated learning guarantees with practical deployment requirements in adversarial network environments.
