An Improved K‐Means Clustering Intrusion Detection Algorithm for Wireless Networks Based on Federated Learning

Abstract

The existing wireless network intrusion detection algorithms based on supervised learning confront many challenges, such as high false detection rate, difficulty in finding unknown attack behaviors, and high cost in obtaining labeled training data sets. This paper presents an improved k -means clustering algorithm for detecting intrusions on wireless networks based on Federated Learning. The proposed algorithm allows multiple participants to train a global model without sharing their private data and can expand the amount of data in the training model and protect the local data of each participant. Furthermore, the cosine distance of multiple perspectives is introduced in the algorithm to measure the similarity between network data objects in the improved k -means clustering process, making the clustering results more reasonable and the judgment of network data behavior more accurate. The AWID, an open wireless network attack data set, is selected as the experimental data set. Its dimensionality reduces by the method of principal component analysis (PCA). Experimental results show that the improved k -means clustering intrusion detection algorithm based on Federated Learning has better performance in detection rate, false detection rate, and detection of unknown attack types.

Framing Network Flow for Anomaly Detection Using Image Recognition and Federated Learning

“…Tian et al [36] proposed a specific neural network called a lightweight residual network (LwResnet) using FL architecture for the detection and classification of DDoS attacks. Xie et al [37] presented an enhanced k-means clustering intrusion detection technique based on FL. To enhance k-means clustering, this approach was coupled with three-way decision concepts and introduced multiple viewpoints of cosine distance as a measure of similarity between data items.…”

Clustered Federated Learning Based on Momentum Gradient Descent for Heterogeneous Data

“…is an open question. References [16,17] proposed the k-means clustered algorithm based on FL. However, the k-means clustering algorithm can only be used on convex datasets, meaning that the shape of the k-means cluster can only be spherical, which cannot be generalized to arbitrary shapes.…”

“…Additionally, it heavily depends on the value of k, and when the data amounts are large, we cannot judge in advance. Reference [16] used the cosine distance to measure the similarities between network data objects. Reference [18] proposed StoCFL, a novel clustered federated learning approach for addressing generic non-IID issues.…”

A novel federated learning aggregation algorithm for AIoT intrusion detection

“…This algorithm was used for intrusion detection in wireless networks. In the enhanced k-means clustering process, the algorithm introduced a multi-perspective cosine distance to measure the similarity between network data objects, resulting in more reasonable clustering outcomes and more accurate judgment of network data behaviour[23]. Qin et al proposed an endless learning framework for intrusion detection.…”