Socially-Aware Decentralized Learning for Intrusion Detection Systems With Imbalanced Non-IID Data

The increasing diversification of network attacks has posed many security threats. Even within a local area network, different hosts may encounter distinct attacks. Leveraging the intrusion data dispersed across various hosts is crucial to achieving more comprehensive intrusion detection. Decentralized learning has emerged as a promising solution by enabling hosts to share information in a peer-to-peer manner. However, the imbalanced nature of intrusion data and varying data distributions between hosts can significantly impact model performance. To address the challenges of imbalanced and non-IID data, we propose a Decentralized Learning-based Intrusion Detection System (DLIDS). It rebalances training data to mitigate the model's bias towards the majority class and periodically substitutes the training model to facilitate knowledge acquisition. Moreover, the ensemble method is incorporated to integrate diverse perspectives and generate unbiased predictions. Finally, the experiment results on CSE-CIC-IDS2018 dataset show that the proposed method performs well even under imbalanced and non-IID data conditions.