Federated Forest for Network Anomaly Detection

Abstract

This study presents a federated learning framework for anomaly detection in network traffic data, using Random Forest Classifier models trained on two datasets of clients with distinct characteristics. The framework addresses class imbalance through SMOTE oversampling and class weighting, achieving a global federated model accuracy of $\mathbf{9 5 . 0 9 %}$ and an F1 score of $\mathbf{9 7 . 3 4 %}$ for anomaly detection. Client 1, with a smaller dataset consisting of 6,546 instances, shows inadequate performance with normal instances ($F 1=8.07 %$). In contrast, Client 2, which has a significantly larger dataset of $\mathbf{6 2 5, 7 8 3}$ instances, performs well ($\mathbf{F 1} \boldsymbol{=} \mathbf{9 5 . 9 4 %}$ for anomalies and $\mathbf{6 1 . 1 0 %}$ for normal cases). The federated model combines the predictions from clients using F1 score-based weights, ensuring a proper balance in contributions. Comprehensive evaluations, including confusion matrices, ROC curves, and SHAP analyses, highlight feature importance and model interpretability; however, issues with SHAP computation for Client 1 indicate areas for improvement. The results demonstrate that federated learning has considerable potential for cooperative anomaly detection. However, they also demonstrate that smaller clients require more effective methods for data collection and that computing efficiency must be optimized for scalability.