Systems and methods for intrusion detection using federated learning

A method comprising:

• generating, by a central server, an initial security model trained on training data characterizing a plurality of different computer security threats;
• distributing, by the central server, the initial security model to a plurality of edge nodes, wherein each edge node comprises at least one processor configured for executing an intrusion detection system using the initial security model, wherein the plurality of edge nodes comprises:
• a first subset of edge nodes each of which is configured for training a respective local security model using captured security data during live operation;
• and
• a second subset of edge nodes each of which is not configured for training a local security model;
• training, by at least a first fog node being on a communications path between at least one edge node and the central server, a respective local security model for one or more of the edge nodes from the second subset of edge nodes;
• and
• updating, by the central server, the intrusion detection systems of the edge nodes by:
• collecting the local security models from the first subset of edge nodes and the first fog node;
• selecting a first local security model from the collected local security models to replace the initial security model;
• and
• distributing the first local security model to the edge nodes, causing each of the edge nodes to execute the intrusion detection system using the first local security model.

A system for intrusion detection using federated learning, the system comprising:

• a central server configured for:
• generating an initial security model trained on training data characterizing a plurality of different computer security threats;
• and
• distributing the initial security model to a plurality of edge nodes, wherein each edge node comprises at least one processor configured for executing an intrusion detection system using the initial security model;
• at least one fog node on a communications path between at least one edge node and the central server, wherein the fog node comprises a processor configured for training a respective local security model for one or more of the edge nodes;
• wherein the central server is configured for updating the intrusion detection systems of the edge nodes by:
• collecting local security models from at least a first edge node and the fog node;
• selecting a first local security model from the collected local security models to replace the initial security model;
• and
• distributing the first local security model to the edge nodes, causing each of the edge nodes to execute the intrusion detection system using the first local security model.