Federated IoV IDS · 2023 · Cybersecurity · Distributed ML
Share what the model learns.
An intrusion-detection study exploring how separate devices can learn together while keeping their raw training records local.
Local records. Shared learning.
The study addresses class imbalance with SMOTE, filters outliers, and tunes model hyperparameters.
Benchmark architecture, not a connected fleet. Model sharing is not by itself a formal privacy guarantee.
Evidence from the paper
- Experimental topology
- 2 + 1
Two virtual edge devices and a central server.
- Traffic classes
- 7
The study’s CIC-IDS 2017 subset includes benign traffic and attack classes.
- Benchmark datasets
- 3
CIC-IDS 2017, KDD-Cup 99, and UNSW-NB-15.
Source: arXiv:2311.13800, methodology and evaluation. These are benchmark experiments, not a deployed vehicle fleet. Local records reduce data centralisation; model sharing alone does not provide a formal privacy guarantee.
The rare event is the important one
Intrusion data is uneven. In the selected CIC-IDS subset, the paper lists 22,728 benign records but only 36 infiltration records. SMOTE, outlier filtering, and hyperparameter tuning were part of the pipeline for dealing with that imbalance.
Train locally, combine centrally
The experiment uses two virtual edge devices, CatBoost classifiers, and a central ensemble. Each edge works on its own portion of the data. The architecture figure shows where records stay and how local model updates feed the combined model.
The combined model is not automatically better
The paper reports that the central model was slightly less accurate than the individual edge models. That trade-off matters: distributed learning has to be judged on detection quality as well as where data is held. The study also compares performance on KDD-Cup 99 and UNSW-NB-15.