# US 12,603,898 B2 · Systems and methods for intrusion detection using federated learning > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,898 B2 - Document ID: US12603898B2 - Status: Granted - Kind: B2 - Application number: 18/411,856 - Filed: 2024-01-12 - Published: 2024-07-18 - Granted: 2026-04-14 - Earliest claimed: 2023-01-12 - Assignees: North Carolina Agricultural and Technical State University - Applicants: North Carolina Agricultural and Technical State University - Inventors: Kaushik Roy; Zhipeng Liu; Xiaohong Yuan; David Johnson - Web page: https://patentgrep.com/patent/US12603898B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 41/16: using machine learning or artificial intelligence - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods and systems for intrusion detection using federated learning. In some examples, a system includes a central server configured for generating an initial security model and distributing the initial security model to edge nodes. Each edge node is configured for executing an intrusion detection system. The system includes a first subset of edge nodes each of which is configured for training a respective local security model using captured security data during live operation. The system includes a second subset of edge nodes each of which is not configured for training a local security model. The system includes fog nodes, each fog node being on a communications path between at least one edge node and the central server. At least a first fog node is configured for training a respective local security model for one or more of the edge nodes from the second subset of edge nodes. ## Claims ### Claim 1 A system comprising: a central server configured for: generating an initial security model trained on training data characterizing a plurality of different computer security threats; and distributing the initial security model to a plurality of edge nodes; the plurality of edge nodes, wherein each edge node comprises at least one processor configured for executing an intrusion detection system using the initial security model, wherein the plurality of edge nodes comprises: a first subset of edge nodes each of which is configured for training a respective local security model using captured security data during live operation; and a second subset of edge nodes each of which is not configured for training a local security model; a plurality of fog nodes, each fog node being on a communications path between at least one edge node and the central server, wherein at least a first fog node comprises a processor configured for training a respective local security model for one or more of the edge nodes from the second subset of edge nodes; wherein the central server is configured for updating the intrusion detection systems of the edge nodes by: collecting the local security models from the first subset of edge nodes and the first fog node; selecting a first local security model from the collected local security models to replace the initial security model; and distributing the first local security model to the edge nodes, causing each of the edge nodes to execute the intrusion detection system using the first local security model. ### Claim 2 (depends on 1) The system of claim 1, wherein at least one of the central server and the first fog node is configured for determining that the one or more of the edge nodes from the second subset of edge nodes lacks at least one computing resource and, in response, configuring the first fog node for training the respective local security model for the one or more of the edge nodes from the second subset of edge nodes. ### Claim 3 (depends on 2) The system of claim 2, wherein determining that the one or more of the edge nodes from the second subset of edge nodes lacks at least one computing resource comprises determining that the one or more of the edge nodes from the second subset of edge nodes lacks one or more of: sufficient processing resources, sufficient memory resources, or sufficient communications resources for training and transmitting a local security model within a specified timeframe. ### Claim 4 (depends on 2) The system of claim 2, wherein determining that the one or more of the edge nodes from the second subset of edge nodes lacks at least one computing resource comprises determining that the one or more of the edge nodes from the second subset of edge nodes has an inconsistent connection to a data communications network connecting to the central server. ### Claim 5 (depends on 2) The system of claim 2, wherein determining that the one or more of the edge nodes from the second subset of edge nodes lacks at least one computing resource comprises querying the one or more of the edge nodes from the second subset of edge nodes. ### Claim 6 (depends on 1) The system of claim 1, wherein the at least one fog node is configured for receiving captured security data during live operation from the one or more of the edge nodes from the second subset of edge nodes. ### Claim 7 (depends on 1) The system of claim 1, wherein collecting the local security models from the first subset of edge nodes and the first fog node comprises periodically querying the first subset of edge nodes for the local security models. ### Claim 8 (depends on 1) The system of claim 1, wherein the captured security data comprises one or more of: global positioning system (GPS) location, internet protocol (IP) address, and user metadata. ### Claim 9 (depends on 1) The system of claim 1, wherein selecting a first local security model from the collected local security models to replace the initial security model comprises selecting the first local security model based on one or more of: detection accuracy, computation runtime, resource usage rate, and recall score. ### Claim 10 (depends on 1) The system of claim 1, wherein generating the initial security model comprises generating a plurality of adversarial examples using a generative adversarial network and injecting the adversarial examples into the training data. ### Claim 11 A method comprising: generating, by a central server, an initial security model trained on training data characterizing a plurality of different computer security threats; distributing, by the central server, the initial security model to a plurality of edge nodes, wherein each edge node comprises at least one processor configured for executing an intrusion detection system using the initial security model, wherein the plurality of edge nodes comprises: a first subset of edge nodes each of which is configured for training a respective local security model using captured security data during live operation; and a second subset of edge nodes each of which is not configured for training a local security model; training, by at least a first fog node being on a communications path between at least one edge node and the central server, a respective local security model for one or more of the edge nodes from the second subset of edge nodes; and updating, by the central server, the intrusion detection systems of the edge nodes by: collecting the local security models from the first subset of edge nodes and the first fog node; selecting a first local security model from the collected local security models to replace the initial security model; and distributing the first local security model to the edge nodes, causing each of the edge nodes to execute the intrusion detection system using the first local security model. ### Claim 12 (depends on 11) The method of claim 11, wherein at least one of the central server and the first fog node is configured for determining that the one or more of the edge nodes from the second subset of edge nodes lacks at least one computing resource and, in response, configuring the first fog node for training the respective local security model for the one or more of the edge nodes from the second subset of edge nodes. ### Claim 13 (depends on 12) The method of claim 12, wherein determining that the one or more of the edge nodes from the second subset of edge nodes lacks at least one computing resource comprises determining that the one or more of the edge nodes from the second subset of edge nodes lacks one or more of: sufficient processing resources, sufficient memory resources, or sufficient communications resources for training and transmitting a local security model within a specified timeframe. ### Claim 14 (depends on 12) The method of claim 12, wherein determining that the one or more of the edge nodes from the second subset of edge nodes lacks at least one computing resource comprises determining that the one or more of the edge nodes from the second subset of edge nodes has an inconsistent connection to a data communications network connecting to the central server. ### Claim 15 (depends on 12) The method of claim 12, wherein determining that the one or more of the edge nodes from the second subset of edge nodes lacks at least one computing resource comprises querying the one or more of the edge nodes from the second subset of edge nodes. ### Claim 16 (depends on 11) The method of claim 11, wherein the at least a first fog node is configured for receiving captured security data during live operation from the one or more of the edge nodes from the second subset of edge nodes. ### Claim 17 (depends on 11) The method of claim 11, wherein collecting the local security models from the first subset of edge nodes and the first fog node comprises periodically querying the first subset of edge nodes for the local security models. ### Claim 18 (depends on 11) The method of claim 11, wherein the captured security data comprises one or more of: global positioning system (GPS) location, internet protocol (IP) address, and user metadata. ### Claim 19 (depends on 11) The method of claim 11, wherein selecting a first local security model from the collected local security models to replace the initial security model comprises selecting the first local security model based on one or more of: detection accuracy, computation runtime, resource usage rate, and recall score. ### Claim 20 (depends on 11) The method of claim 11, wherein generating the initial security model comprises generating a plurality of adversarial examples using a generative adversarial network and injecting the adversarial examples into the training data. ### Claim 21 (depends on 11) The method of claim 11, wherein applying compression to the collected local security models from the first subset of edge nodes and the first fog node comprises periodically querying the first subset of edge nodes for the local security models. ### Claim 22 (depends on 11) The method of claim 11, wherein applying compression to the replaced initial security model trained on the second set of fog nodes comprises periodically querying the second subset of edge nodes for updating the local security model on the central server. ### Claim 23 (depends on 11) The method of claim 11, wherein the first and second fog nodes perform local security model updates using collected local security model updates from the edge nodes. ### Claim 24 (depends on 11) The method of claim 11, wherein the first and second fog nodes perform aggregation of local security model updates using collected local security model updates from the edge nodes. ### Claim 25 (depends on 11) The method of claim 11, wherein the first and second fog nodes perform aggregation of local security model updates using generated local security model updates on the at least a first fog node. ### Claim 26 A system for intrusion detection using federated learning, the system comprising: a central server configured for: generating an initial security model trained on training data characterizing a plurality of different computer security threats; and distributing the initial security model to a plurality of edge nodes, wherein each edge node comprises at least one processor configured for executing an intrusion detection system using the initial security model; at least one fog node on a communications path between at least one edge node and the central server, wherein the fog node comprises a processor configured for training a respective local security model for one or more of the edge nodes; wherein the central server is configured for updating the intrusion detection systems of the edge nodes by: collecting local security models from at least a first edge node and the fog node; selecting a first local security model from the collected local security models to replace the initial security model; and distributing the first local security model to the edge nodes, causing each of the edge nodes to execute the intrusion detection system using the first local security model.