Federated Anomaly Detection for Cybersecurity Threat Identification in Distributed Networks

Abstract

The increasing complexity of distributed computing environments has introduced substantial challenges for identifying sophisticated cybersecurity threats. Conventional intrusion detection systems often rely on centralized training, which can create data privacy concerns and limit adaptability across heterogeneous network environments. This paper proposes a federated anomaly detection framework that integrates self-supervised representation learning with adaptive model aggregation to identify malicious network activities without transferring raw traffic data. The proposed framework is evaluated in an illustrative setting using 8.4 million network traffic records collected from 26 distributed computing nodes, covering 12 categories of cyberattacks. Experimental results indicate that the framework achieves a detection accuracy of 95.8%, an F1-score of 0.934, and a false-positive rate of 2.7%. Compared with conventional federated learning baselines, the proposed method improves detection recall by 8.6 percentage points while reducing communication overhead by 31.4%. Additional experiments demonstrate consistent performance under heterogeneous data distributions and previously unseen attack patterns. These findings suggest that federated anomaly detection can enhance cybersecurity monitoring while supporting privacy-preserving collaborative threat analysis.