FLNET2023: Realistic Network Intrusion Detection Dataset for Federated Learning
Pratyay Kumar, Jiefei Liu, Abu Saleh Md Tayeen, Satyajayant Misra, Huiping Cao, Jayashree Harikumar, Oscar Perez‐Concha
Abstract
Developing new defensive mechanisms to respond to evolving security threats is crucial for enforcing network security. Recently, defenses leveraging Federated Learning (FL) have become prominent in Intrusion Detection Systems (IDS) to incorporate the surging growth and distributed nature of the network infrastructure. To evaluate these FL-based IDSes and to achieve better detection performance, researchers commonly perform equal and balanced partitions of the existing popular datasets, such as NSL-KDD, UNSW-NB15, and CICDDoS2019, among clients. However, partitions of these datasets are not representative of the class-imbalanced scenarios found in real-world networks where each client may possess different categories of attack traffic with an uneven number of instances in their dataset. Moreover, they overlook the fundamental data distribution property in a network environment where data must be associated with individual IP addresses, particularly the destination IPs that are identifiable as FL clients. To fill these gaps, we introduce a novel dataset, Federated Learning for Networks (FLNET2023), which is strategically generated by gathering data from network traffic across ten unique routers within a real-world network topology emulated using the CORE tool. We also evaluate the FLNET2023 using two FL aggregation algorithms and compare its performance against the latest intrusion detection dataset, CICDDoS2019, with traditional partitions to demonstrate the challenges of FL-based IDSes on realistic datasets.