Federated Learning for Privacy-Preserving Network Anomaly Detection: A High-Performance Convolutional Framework with Differential Privacy

Federated Learning for Privacy-Preserving Network Anomaly Detection: A High-Performance Convolutional Framework with Differential Privacy | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article Federated Learning for Privacy-Preserving Network Anomaly Detection: A High-Performance Convolutional Framework with Differential Privacy Salah Eldin Olaymi This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-8714544/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract Federated learning (FL) has emerged as a promising paradigm for privacy-preserving collaborative machine learning, enabling multiple organizations to train shared models without exchanging sensitive data. This study presents a comprehensive investigation of FL for network anomaly detection using the NSL-KDD dataset, incorporating real-world experimental evaluations across centralized baselines, IID and non-IID federated settings, differential privacy mechanisms, and robust optimization strategies such as FedProx. The results show that FL is feasible and efficient for distributed cybersecurity applications but exhibits sensitivity to data heterogeneity and privacy constraints. Centralized models achieved near-perfect detection performance, whereas FL under IID conditions demonstrated competitive accuracy and stable convergence. Under label-skew and quantity-skew non-IID conditions, FedAvg performance declined, while FedProx significantly improved stability and accuracy. Differential privacy introduced predictable accuracy degradation, with moderate budgets (ε = 10, 5) maintaining operational viability. System profiling revealed low communication overhead and rapid round execution, confirming practical deployability on CPU-based nodes. This work provides a rigorous experimental foundation for integrating federated learning into distributed intrusion detection systems and identifies key challenges related to privacy, heterogeneity, and model robustness that must be addressed to ensure reliable real-world adoption. Federated learning network anomaly detection privacy-preserving machine learning intrusion detection systems differential privacy distributed cybersecurity FedAvg FedProx non-IID data communication efficiency Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-8714544","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":587817938,"identity":"4951ee07-5a14-4652-893a-660780681653","order_by":0,"name":"Salah Eldin Olaymi","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA+klEQVRIiWNgGAWjYFAC5gYgISHHwMDYxsAIYjMkENICViZhzEOqFobEHgYGNuK0yLc3Nn7mzbFI389+uO3Bzx2HGfjZcwwYf9Tg1mJw5mCzNO82idwensR2w94zhxkke94YMPMcw6NFIrEBooUhsU2Ct+0wg8GNHANmoCNxO2xGYvNvoJZ0Hv6HbZJ/gVrsb4Ac9g+PZ24ktoFsSeCRADFAtkjkGDDwtuH1S5vl3G0Shj03HrYby7al80iceVZwmLcPj8Pamw/feLutTp69P/3Zw7dt1nL87ckbH/74hsdhQMDEg8QBsw/g1wCMzB+EVIyCUTAKRsHIBgB1jVEkKQ+QywAAAABJRU5ErkJggg==","orcid":"","institution":"Taibah University","correspondingAuthor":true,"prefix":"","firstName":"Salah","middleName":"Eldin","lastName":"Olaymi","suffix":""}],"badges":[],"createdAt":"2026-01-27 22:08:31","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-8714544/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-8714544/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":102995875,"identity":"11db3ba8-8060-4a8a-9646-557306823f75","added_by":"auto","created_at":"2026-02-19 12:11:47","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":794639,"visible":true,"origin":"","legend":"","description":"","filename":"FederatedLearningforPrivacyPreservingnetworkanamoly.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8714544/v1_covered_60242b5e-7b7d-44d5-a7fd-8adcc0a27181.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"Federated Learning for Privacy-Preserving Network Anomaly Detection: A High-Performance Convolutional Framework with Differential Privacy","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"Federated learning, network anomaly detection, privacy-preserving machine learning, intrusion detection systems, differential privacy, distributed cybersecurity, FedAvg, FedProx, non-IID data, communication efficiency","lastPublishedDoi":"10.21203/rs.3.rs-8714544/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-8714544/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eFederated learning (FL) has emerged as a promising paradigm for privacy-preserving collaborative machine learning, enabling multiple organizations to train shared models without exchanging sensitive data. This study presents a comprehensive investigation of FL for network anomaly detection using the NSL-KDD dataset, incorporating real-world experimental evaluations across centralized baselines, IID and non-IID federated settings, differential privacy mechanisms, and robust optimization strategies such as FedProx. The results show that FL is feasible and efficient for distributed cybersecurity applications but exhibits sensitivity to data heterogeneity and privacy constraints. Centralized models achieved near-perfect detection performance, whereas FL under IID conditions demonstrated competitive accuracy and stable convergence. Under label-skew and quantity-skew non-IID conditions, FedAvg performance declined, while FedProx significantly improved stability and accuracy. Differential privacy introduced predictable accuracy degradation, with moderate budgets (ε\u0026thinsp;=\u0026thinsp;10, 5) maintaining operational viability. System profiling revealed low communication overhead and rapid round execution, confirming practical deployability on CPU-based nodes. This work provides a rigorous experimental foundation for integrating federated learning into distributed intrusion detection systems and identifies key challenges related to privacy, heterogeneity, and model robustness that must be addressed to ensure reliable real-world adoption.\u003c/p\u003e","manuscriptTitle":"Federated Learning for Privacy-Preserving Network Anomaly Detection: A High-Performance Convolutional Framework with Differential Privacy","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-02-09 18:55:24","doi":"10.21203/rs.3.rs-8714544/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"8a7228dc-52e4-43d1-aa3c-5a2faa92350e","owner":[],"postedDate":"February 9th, 2026","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[],"tags":[],"updatedAt":"2026-03-09T08:33:53+00:00","versionOfRecord":[],"versionCreatedAt":"2026-02-09 18:55:24","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-8714544","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-8714544","identity":"rs-8714544","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}