PaperlayerView exact revision on arXiv

Source-linked AI summary

BRFID: Toward Byzantine-Robust Federated Intrusion Detection

Asmah Muallem, Firdous Kausar, Sajid Hussain, Lei Qian

arXiv:2609.28599v1cs.CRcs.LG

TL;DR

This paper studies Byzantine label-flipping in federated intrusion detection, where client updates leave an unresolved trust problem. It evaluates a three-client CICIDS2017 system with non-IID attack subtypes using Federated Forest aggregation. The attacker’s own accuracy drops as poisoning increases while the global ensemble remains stable, and that self-degradation is presented as a detectable anomaly.

  • Problem

    Federated IDS literature has focused on privacy and accuracy with honest participants, leaving Byzantine poisoning scenarios unevaluated.

    Source: §I · p. 1

  • Method

    The study evaluates label flipping by one of three clients on CICIDS2017 with non-IID attack-subtype partitions and tree-concatenation Federated Forest aggregation.

    Source: §I · p. 1, A. Federated IDS Architecture · p. 2, C. Attack Model: Label-Flipping… · p. 3

  • Results

    At r = 0.60, C0’s own accuracy drops 15.63 percentage points, from 0.9996 to 0.8433, while the global ensemble remains stable across tested poison rates.

    Source: B. Model Poisoning Attack Impact · p. 3, §VI · p. 4

  • Takeaways & Limitations

    Attacker self-degradation is a server-observable anomaly that may support Byzantine client identification without access to local training data.

    Source: §V · p. 4

    The reported robustness is specific to Federated Forest’s ensemble aggregation and is not a general property of federated IDS security.

    Source: §V · p. 4

Abstract

from arXiv · show

Flipping 60\% of training labels from a single Byzantine client using label-flipping model poisoning self-degrades an attacker's own federated detection accuracy, $99.96\%$ (at no poisoning rate) to $84.33\%$ in a three-client federated IDS. Where the Federated global ensemble maintains stable accuracy across all tested poison rates, without a defense mechanism in place and without coordination between attackers. In this paper, we present empirical results quantifying the impact of label-flipping poisoning attacks on a three-client federated IDS trained on CICIDS2017 with non-IID attack subtype distributions across clients. We demonstrate that the signal of the adversarial self-compromise represents a detectable anomaly for exploitation for Byzantine client identification in the absence of target data exfiltration. We note that the aggregation step uses a Federated Forest (tree concatenation) rather than a parametric FedAvg; the results therefore measure the impact of poisoning on per-client performance under ensemble aggregation, and extension to genuine FedAvg with a parametric classifier is planned for future work.

I. INTRODUCTION

Federated IDS preserves raw-data locality, but client-controlled updates leave a trust deficit that Byzantine participants can exploit. This study evaluates label flipping under Federated Forest aggregation and examines whether attacker self-degradation is detectable.

I. INTRODUCTION

  • Client-controlled updates preserve data locality but leave a naive aggregator without a principled way to distinguish poisoned updates from honest ones.Byzantine clients can submit poisoned updates designed to degrade the global detector without appearing as statistical outliers.Source: §I · p. 1
  • Label flipping reverses a fraction of local labels without requiring cryptographic capability, global-architecture knowledge, or coordination between compromised participants.Under standard FedAvg, a single Byzantine client can diminish collective detection performance beyond its own local scope.Source: §I · p. 1
  • The study asks how a 1-of-3 Byzantine client affects the global ensemble and whether self-degradation supplies a detectable anomaly signal.It evaluates four poison rates on CICIDS2017.Source: §I · p. 1
  • Adversarial self-degradation increases monotonically with poison rate and is measurable at the server without direct client telemetry.The study examines non-IID attack-type distributions and characterizes self-degradation as a server-observable Byzantine detection signal.Source: §I · p. 2

II. BACKGROUND AND RELATED WORK

FedAvg averages client updates under an honest-participant assumption, while prior work documents Byzantine label-flipping and attacks on robust aggregation methods.

A. Federated Learning and FedAvg

  • FedAvg aggregates client updates by dataset-size-weighted averaging, but provides no built-in mechanism to detect or discount adversarial updates.It assumes honest clients despite heterogeneous, non-identically distributed data.Source: A. Federated Learning and FedAvg · p. 2

B. Byzantine Model Poisoning in Federated Learning

  • A minority Byzantine client can degrade federated models through label flipping without knowing the aggregation strategy.The degradation can arise through statistical noise rather than customized targeting.Source: B. Byzantine Model Poisoning in… · p. 2
  • Optimized attacks have circumvented Krum and coordinate-wise Median under certain conditions, motivating IDS-specific robustness analysis.The passage cautions against directly transplanting general-purpose FL defenses into network security.Source: B. Byzantine Model Poisoning in… · p. 2

C. Adversarial Machine Learning in Intrusion Detection

Related work documents adversarial degradation and evaluation concerns in intrusion detection, while this study uses a tree-concatenated federated ensemble and reserves parametric FedAvg for future work.

C. Adversarial Machine Learning in Intrusion Detection

  • Prior work found adversarial attacks degrade machine-learning IDS classifiers across benchmark datasets and classifier families.Evaluation bias can also lead security studies to overestimate production performance.Source: C. Adversarial Machine Learning in… · p. 2
  • Related FL-IDS work on CICIDS2017 used IID assumptions and did not examine adversarial self-degradation, while the review identifies non-IID Byzantine robustness as an open gap.The passage contrasts this study's focus on non-IID attack-subtype distributions and a server-observable self-degradation signal.Source: C. Adversarial Machine Learning in… · p. 2

A. Federated IDS Architecture

  • The three-client architecture concatenates local Random Forest estimators into a global Federated Forest evaluated on a shared held-out test set.Each client trains a 100-tree classifier; the global ensemble uses majority voting across |C|·T trees.Source: A. Federated IDS Architecture · p. 2
  • Extension to parametric FedAvg, where gradient averaging propagates poison to honest clients, is planned for future work.Source: A. Federated IDS Architecture · p. 2

B. Dataset

The evaluation uses CICIDS2017, partitioned across three simulated clients with non-IID attack-subtype distributions.

B. Dataset

  • CICIDS2017 contains traffic across 15 attack categories alongside benign traffic, with attack types varying substantially by type and time window.Attack traffic comprises roughly 20% of total volume overall.Source: B. Dataset · p. 2
  • The dataset is partitioned non-overlappingly across three clients using a stratified non-IID partition.Source: B. Dataset · p. 2
  • Each client receives a different primary attack-subtype mix, with 60% of each attack type routed to one primary client and 40% shared.Every client retains at least 10% attack traffic, enabling all local classifiers to learn the attack class.Source: B. Dataset · p. 3

C. Attack Model: Label-Flipping Poisoning

The attack has one partially informed Byzantine client randomly flip a fraction of its own local training labels while two clients remain honest. The experiment evaluates how this label corruption affects the attacker’s model and the Federated Forest ensemble.

C. Attack Model: Label-Flipping Poisoning

  • Client 0 reverses labels for a randomly selected fraction r of its local training examples, without access to global parameters, the aggregation strategy, or peers’ data.The attacker has full access to its own local training data.Source: C. Attack Model: Label-Flipping… · p. 3
  • The availability attack targets detection of the attack class overall, not a narrowly targeted misclassification, and teaches the attacker’s local model that attack traffic is benign.The adversary’s label corruption contributes 100 corrupted trees to the global ensemble.Source: C. Attack Model: Label-Flipping… · p. 3
  • The experiment tests poison rates 0.0, 0.2, 0.4, and 0.6, with 100 corrupted trees and 200 honest trees; Clients C1 and C2 stay honest.The attack models an insider or supply-chain-compromised node and requires no cryptographic capability or knowledge of the FL system’s internal design.Source: C. Attack Model: Label-Flipping… · p. 3

A. FL-IDS Baseline Performance (No Attack)

Without an attack, all three clients perform strongly on their local test sets. The local-test federated average and shared-held-out global ensemble also provide distinct baseline measurements.

A. FL-IDS Baseline Performance (No Attack)

B. Model Poisoning Attack Impact

Under label-flipping poisoning, the attacker’s own accuracy declines as the poison rate rises, while the global Federated Forest ensemble remains stable. The self-degradation is measurable without access to client data and is presented as a signal for Byzantine identification.

B. Model Poisoning Attack Impact

  • Federated accuracy varies by at most 0.02 pp because 200 honest trees outvote 100 poisoned trees in the 300-tree majority-vote ensemble.The global ensemble remains stable across all tested poison rates.Source: B. Model Poisoning Attack Impact · p. 3
  • The attacker’s self-degradation increases monotonically with poison rate and is measurable at the server without access to client data.The paper identifies this anomalous signal as a potential basis for Byzantine client identification.Source: B. Model Poisoning Attack Impact · p. 3
  • At r = 60%, C0’s accuracy falls from 0.9996 to 0.8433, a 15.63 pp drop, while global federated accuracy remains stable.The figure reports one Byzantine client among three, Federated Forest aggregation, no defense, and CICIDS2017 with non-IID attack subtype partitioning.Source: B. Model Poisoning Attack Impact · p. 3, Figure 2 · p. 4

V. DISCUSSION

In this three-client ensemble setting, label-flipping leaves honest-client voting stable but damages the Byzantine client’s own accuracy. That self-damage can be monitored on a shared validation set to flag anomalous clients without access to their local data.

V. DISCUSSION

  • The Federated Forest global ensemble remains robust in the three-client setting because the 2:1 honest-to-Byzantine tree ratio preserves honest majority voting.This is an aggregation-scheme property, not a general property of federated IDS security; parametric FedAvg is expected to show measurable degradation.Source: §V · p. 4
  • At r = 0.60, C0’s own accuracy drops by 15.63 pp, with self-damage increasing monotonically with poison rate and observable server-side if a shared validation set is maintained.Source: §V · p. 4
  • At r ≥0.40, a server-side detector using a shared held-out set would flag C0 as anomalous against the honest-client baseline.The malicious local model’s validation accuracy diverges precipitously from the honest clients’ baseline.Source: §V · p. 4
  • The self-damage signal supports Byzantine identification without access to clients’ local training data.The source passage describes this as enabling detection without local-data access.Source: §V · p. 4

VI. CONCLUSION AND FUTURE WORK

The study characterizes label-flipping in a three-client Federated Forest IDS on CICIDS2017 with non-IID attack subtype partitions. The global ensemble remains stable, while the Byzantine client’s own accuracy falls by 15.63 percentage points at a 60% poison rate; multi-seed evaluation and genuine parametric FedAvg are left for future work.

VI. CONCLUSION AND FUTURE WORK

  • 15.63 pp at r = 0.60: the Byzantine client’s accuracy falls from 0.9996 to 0.8433 while the global ensemble remains stable under a 2:1 honest-to-Byzantine tree ratio.The reported results are from ensemble aggregation, not genuine parametric FedAvg.Source: §VI · p. 4
  • The empirical characterization evaluates label-flipping poisoning in a three-client Federated Forest IDS on CICIDS2017 with non-IID attack subtype partitioning across three simulated network segments.The attacker does not need knowledge of the model architecture, aggregation strategy, or other clients’ data.Source: §VI · p. 4
  • Results are based on a single experimental simulation; multi-seed evaluation with confidence intervals and genuine parametric FedAvg are planned for future work.The planned FedAvg evaluation includes logistic regression or MLP and defenses including Krum and coordinate-wise Median.Source: §VI · p. 4
Loading 2609.28599v1…