Scholarlink

<p>A novel behavior-based intrusion detection framework, the Federated Intrusion Detection and Mitigation Framework (FIDMF), is proposed to address critical challenges in modern intrusion detection, including data privacy, scalability, severe class imbalance, and the critical need for semantic understanding and explainability. FIDMF integrates federated learning for privacy-preserving collaborative training with an Attention-Long Short-Term Memory (LSTM) core for robust temporal pattern detection. To substantially enhance the framework’s intelligence and transparency, FIDMF innovatively pioneers a multi-faceted integration of open-source Large Language Models (LLMs) for: 1) Contextual Feature Enrichment from raw network logs; 2) Semantic Data Augmentation, guided by LLMs to inform Generative Adversarial Networks (GANs) for generating semantically coherent and novel attack patterns; and 3) Explainable AI (XAI) for human-readable explanations. This holistic approach, further supported by the Synthetic Minority Over-sampling Technique (SMOTE) for class balancing, results in a robust, scalable, privacy-preserving, and highly explainable Intrusion Detection System (IDS). A rigorous evaluation across the NSL-KDD, CIC-IDS2017, and UNSW-NB15 datasets demonstrates FIDMF’s superior performance. On NSL-KDD, the full FIDMF framework achieved an outstanding overall accuracy of 99.40% and an F1-score of 99.38%. Critically, for the challenging minority attack class, it attained an F1-score of 99.70%, significantly outperforming prior configurations without LLM guidance. Furthermore, FIDMF maintained high accuracy on CIC-IDS2017 (99.65%) and UNSW-NB15 (98.05%), confirming its strong generalizability. An in-depth ablation study validates the crucial contribution of each component, particularly the semantic intelligence provided by the LLMs. FIDMF proves its potential as a superior, intelligent, and transparent solution for real-world intrusion detection scenarios.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Federated learning-powered real-time behavioral intrusion detection leveraging LSTM, attention, GANs, and large language models

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年2月22日

查看全文
  • Abdullah AlHayan,
  • Jalal Al-Muhtadi

摘要

A novel behavior-based intrusion detection framework, the Federated Intrusion Detection and Mitigation Framework (FIDMF), is proposed to address critical challenges in modern intrusion detection, including data privacy, scalability, severe class imbalance, and the critical need for semantic understanding and explainability. FIDMF integrates federated learning for privacy-preserving collaborative training with an Attention-Long Short-Term Memory (LSTM) core for robust temporal pattern detection. To substantially enhance the framework’s intelligence and transparency, FIDMF innovatively pioneers a multi-faceted integration of open-source Large Language Models (LLMs) for: 1) Contextual Feature Enrichment from raw network logs; 2) Semantic Data Augmentation, guided by LLMs to inform Generative Adversarial Networks (GANs) for generating semantically coherent and novel attack patterns; and 3) Explainable AI (XAI) for human-readable explanations. This holistic approach, further supported by the Synthetic Minority Over-sampling Technique (SMOTE) for class balancing, results in a robust, scalable, privacy-preserving, and highly explainable Intrusion Detection System (IDS). A rigorous evaluation across the NSL-KDD, CIC-IDS2017, and UNSW-NB15 datasets demonstrates FIDMF’s superior performance. On NSL-KDD, the full FIDMF framework achieved an outstanding overall accuracy of 99.40% and an F1-score of 99.38%. Critically, for the challenging minority attack class, it attained an F1-score of 99.70%, significantly outperforming prior configurations without LLM guidance. Furthermore, FIDMF maintained high accuracy on CIC-IDS2017 (99.65%) and UNSW-NB15 (98.05%), confirming its strong generalizability. An in-depth ablation study validates the crucial contribution of each component, particularly the semantic intelligence provided by the LLMs. FIDMF proves its potential as a superior, intelligent, and transparent solution for real-world intrusion detection scenarios.