Federated learning-powered real-time behavioral intrusion detection leveraging LSTM, attention, GANs, and large language models

Authors:
Top Cited Papers
Open Access
Publisher website
Google Scholar
Abstract
A novel behavior-based intrusion detection framework, the Federated Intrusion Detection and Mitigation Framework (FIDMF), is proposed to address critical challenges in modern intrusion detection, including data privacy, scalability, severe class imbalance, and the critical need for semantic understanding and explainability. FIDMF integrates federated learning for privacy-preserving collaborative training with an Attention-Long Short-Term Memory (LSTM) core for robust temporal pattern detection. To substantially enhance the framework’s intelligence and transparency, FIDMF innovatively pioneers a multi-faceted integration of open-source Large Language Models (LLMs) for: 1) Contextual Feature Enrichment from raw network logs; 2) Semantic Data Augmentation, guided by LLMs to inform Generative Adversarial Networks (GANs) for generating semantically coherent and novel attack patterns; and 3) Explainable AI (XAI) for human-readable explanations. This holistic approach, further supported by the Synthetic Minority Over-sampling Technique (SMOTE) for class balancing, results in a robust, scalable, privacy-preserving, and highly explainable Intrusion Detection System (IDS). A rigorous evaluation across the NSL-KDD, CIC-IDS2017, and UNSW-NB15 datasets demonstrates FIDMF’s superior performance. On NSL-KDD, the full FIDMF framework achieved an outstanding overall accuracy of 99.40% and an F1-score of 99.38%. Critically, for the challenging minority attack class, it attained an F1-score of 99.70%, significantly outperforming prior configurations without LLM guidance. Furthermore, FIDMF maintained high accuracy on CIC-IDS2017 (99.65%) and UNSW-NB15 (98.05%), confirming its strong generalizability. An in-depth ablation study validates the crucial contribution of each component, particularly the semantic intelligence provided by the LLMs. FIDMF proves its potential as a superior, intelligent, and transparent solution for real-world intrusion detection scenarios.

This publication has 29 references indexed in Scilit: