On the fog’s frontline: a federated machine learning approach for industrial network threat detection and intrusion prevention
Basharat Ali
Abstract
Abstract The rapidly increasing field of industrial network security has led to the rapid growth of interconnecting devices, significantly enlarging attack surfaces and exposing flaws that older intrusion detection systems (IDS) cannot even handle due to scalability and privacy constraints. This work addresses the shortcomings by presenting an advanced federated framework for machine learning tailored toward intrusion detection in industrial networks. Using the detailed UNSW-NB15 dataset, known to represent realistic network traffic, we have analysed numerous machine learning methods in great detail to build a robust, adaptive, and privacy-preserving model for network protection. In a decentralized federated machine learning (FML) approach, the edge devices could train local models on their own and send aggregated parameters to a central server while keeping the data private. Our model, with differential privacy and secure aggregation, achieved an accuracy of 99.98% using the Random Forest Classifier and differentiated very well between benign and malicious traffic. Advanced feature engineering and interpretability tools, such as SHAP analysis, were used to identify critical detection features. The model was tested through iterative training and in-depth testing across distributed devices with remarkable resilience and efficiency in resource-limited environments. This research is therefore the shift in industrial cybersecurity toward the integration of federated learning with privacy-centric protocols in order to create a new effective, scalable, and resilient defense mechanism than the traditional IDS, which may offer a new standard for industrial network protection against evolving cyber threats.