Cloud deployments spread traffic across many nodes, which makes intrusion detection harder to run from a single central analyzer. Sending all traffic to one point also creates privacy and bandwidth costs. In this study, data stay on the local node and only model updates are shared. The detector is a binary model that combines a convolutional neural network with a bidirectional long short-term memory network and is trained with federated averaging over 50 virtual clients for 50 communication rounds. Client heterogeneity is introduced with a Dirichlet split ( \(\alpha = 0.3\) ), and 10 clients are sampled in each round. SHAP was applied to the final global model to examine the features behind its predictions. Across four random seeds, the model reached 97.67% ± 0.24% accuracy, 96.55% F1, and 2.82% false-positive rate on CICIDS2017. On UNSW-NB15, it reached 90.49% ± 1.88% accuracy, 91.48% F1, and 12.20% false-positive rate. The ablation results showed that each major component of the pipeline mattered: removing the CNN block, the BiLSTM block, SMOTE, or RFE produced statistically significant differences under McNemar’s test ( \(p < 0.05\) ). SHAP assigned the highest importance to Flow Duration, Protocol, and Backward Inter-Arrival-Time Total on CICIDS2017, and to source TTL, destination TTL, and TCP source window on UNSW-NB15. We also observed that the id field in UNSW-NB15 inflated accuracy by about eight percentage points despite being only a row identifier; all reported results therefore use the corrected pipeline with this field removed.
