Backdoor-Resilient Federated Learning
for Network Intrusion Detection

Federated Learning for NIDS

Federated Learning enables collaborative model training across distributed organisations without sharing raw network traffic data, preserving privacy while building powerful intrusion detection models. FL requires continuous training with distributed data from heterogeneous network environments.

Backdoor Attacks in FL

In a backdoor attack, malicious clients inject poisoned model updates into the federated aggregation process. A carefully crafted "trigger" in network traffic causes the global model to misclassify targeted malicious traffic as benign — while maintaining normal accuracy on clean samples. "Trust becomes the vulnerability."

Byzantine-Robust Aggregation

Existing defences include FedAvg (no defence), Median, Trimmed Mean, Krum, Multi-Krum, and FLAME. Our evaluation shows all existing SOTA methods fail against the sophisticated PFedBA attacker — with FLAME reaching up to 100% ASR in Non-IID settings.

Non-IID Network Environments

Real-world federated NIDS deployments face heterogeneous (Non-IID) data distributions across clients. We model this using Dirichlet distributions (α = 100 for IID, α = 0.5 and α = 0.1 for increasing heterogeneity), reflecting realistic scenarios where different organisations see different traffic patterns.

Model Poisoning & Replacement

Train a backdoored model locally, compute the model update, and scale it with a large factor (λ) to replace the global model in a single round. Easily detected by large update norms.

Geometric Camouflage

"Ninja logic" — the attacker measures the magnitude of honest updates and caps the malicious update norm at the median of honest clients using L2 projection. Bypasses norm-based filters while maintaining high ASR.

Proxy Federated Backdoor Attack

The most sophisticated threat model. Uses Shadow Training to simulate clean update directions, then applies a Gradient Alignment Penalty in the loss function — forcing malicious updates to mimic benign ones. Bypasses FLAME (SOTA).

The attacker maintains a shadow model trained on a proxy dataset that approximates the global data distribution. This lets them predict clean update directions — disguising the malicious update to mimic benign gradient behaviour.

A custom loss term minimises cosine distance between the malicious and simulated clean gradient — forcing the malicious update to align directionally with honest clients, evading cosine-similarity filters like FLAME.

The attacker caps their update's L2 norm to match the median of honest clients. Combined with gradient alignment, PFedBA updates are statistically indistinguishable from benign ones in both magnitude and direction.

FLAME uses HDBSCAN on cosine similarities to detect malicious clients. PFedBA's gradient alignment forces the attacker into the same cluster as honest clients, completely neutralising FLAME. Under Non-IID (α=0.1), FLAME reaches 90.3% ASR.

• ◆Network intrusion benchmark dataset
• ◆Binary classification: Normal vs. Attack
• ◆Feature set: 71 input features
• ◆Partitioned across 10 federated clients

• ◆10 total clients per experiment
• ◆3 malicious clients (30%) — baseline
• ◆4 malicious clients (40%) — stress test
• ◆Round-based FedAvg coordination

• ◆4-layer Fully Connected Neural Network (FCNN)
• ◆71 → 128 → 64 → 32 → 2
• ◆Binary cross-entropy loss
• ◆Adam optimizer

• ◆IID: Dirichlet α = 100 (homogeneous)
• ◆Non-IID moderate: α = 0.5
• ◆Non-IID extreme: α = 0.1 (high imbalance)
• ◆Formula: (p₁ₖ,…,pₙₖ) ~ Dir(α)

Accuracy ≠ Security

A model at 93% Main Task Accuracy still suffered 99.95% Attack Success Rate under PFedBA — shattering the assumption that accuracy implies safety.

SENTINEL Dominates

SENTINEL reduces ASR to ≈0% in IID settings and 10.5% under Non-IID (α=0.5) — a 9× improvement over FLAME (SOTA) at 60.4%.

Extreme Heterogeneity Challenge

At α=0.1, even SENTINEL struggles against PFedBA (ASR≈30%), exposing a critical open problem in highly heterogeneous FL-NIDS environments.

SENTINEL Defense Algorithm

A novel backdoor-resilient federated aggregation algorithm combining L2 norm anomaly scoring, Sybil similarity detection, IQR-based filtering, and coordinate-wise trimmed median aggregation — with optional Differential Privacy.

Accuracy ≠ Security

We formally demonstrated that a model with 93% main-task accuracy can simultaneously achieve 99.95% Attack Success Rate — proving accuracy is a dangerously insufficient metric for evaluating FL-NIDS security.

Comprehensive FL-NIDS Benchmark

A systematic evaluation of 7 aggregation strategies (FedAvg, Median, Trimmed Mean, Krum, Multi-Krum, FLAME, SENTINEL) against 3 attack generations across IID and Non-IID data distributions.