Toward data efficient anomaly detection in heterogeneous edge–cloud environments using clustered federated learning

Abstract

Anomaly detection in edge–cloud scenarios stands as a critical means to ensure the security of network environment. Federated learning (FL)-based anomaly detection combines multiple data sources and ensures data privacy, making it a promising distributed detection method. However, FL-based anomaly detection system is usually affected by data heterogeneity and data bias, resulting in the inefficiency of data used for FL and the decline of detection performance. We propose an iterative federated clustering ensemble algorithm named IFCEA, in which we (1) establish a committee on the devices, and select the optimal participation for each device based on the evaluations of committee; (2) filter the clusters based on committee results, and exclude the biased clusters; (3) design an aggregation weight that reflects the degree of local distribution balance; (4) present a novel cluster initialization method, OneBiPartition, which adapts to the number of clusters and commences clustering federated task efficiently. IFCEA enhances the data quality used in FL-based anomaly detection system from two perspectives: device selection and participation weights, effectively addressing the issues of data heterogeneity and data bias faced during the FL training phase. Extensive experimental results on five network traffic datasets (the UNSW-NB15, CIC-IDS2017, CIC-IDS2018, CIC-DDoS2019 and BCCC-DDoS2024 datasets) demonstrate that our proposed framework outperforms in terms of detection metrics and convergence performance.