# Anomaly Detection via Federated Learning

arXiv: https://arxiv.org/abs/2210.06614 · HTML: https://mlsanity.com/paper/2210.06614/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 12 references that are in the map.
- First posted on arXiv 12 Oct 2022.

## Builds on (most cited first, 4 of 4)

- [Federated Learning for Malware Detection in IoT Devices](https://mlsanity.com/paper/2104.09994/) (2021)
- [Evaluating Federated Learning for Intrusion Detection in Internet of Things: Review and Challenges](https://mlsanity.com/paper/2108.00974/) (2021)
- [Evaluation of Machine Learning Classifiers for Zero-Day Intrusion Detection -- An Analysis on CIC-AWS-2018 dataset](https://mlsanity.com/paper/1905.03685/) (2019)
- [Federated Multi-Mini-Batch: An Efficient Training Approach to Federated Learning in Non-IID Environments](https://mlsanity.com/paper/2011.07006/) (2020)

## Built on by (most cited first, 3 of 3)

- [MIA-BAD: An Approach for Enhancing Membership Inference Attack and its Mitigation with Federated Learning](https://mlsanity.com/paper/2312.00051/) (2023)
- [Evaluating Query Efficiency and Accuracy of Transfer Learning-based Model Extraction Attack in Federated Learning](https://mlsanity.com/paper/2505.23791/) (2025)
- [DP-FlogTinyLLM: Differentially private federated log anomaly detection using Tiny LLMs](https://mlsanity.com/paper/2604.19118/) (2026)

## Abstract (arXiv)

Machine learning has helped advance the field of anomaly detection by incorporating classifiers and autoencoders to decipher between normal and anomalous behavior. Additionally, federated learning has provided a way for a global model to be trained with multiple clients' data without requiring the client to directly share their data. This paper proposes a novel anomaly detector via federated learning to detect malicious network activity on a client's server. In our experiments, we use an autoencoder with a classifier in a federated learning framework to determine if the network activity is benign or malicious. By using our novel min-max scalar and sampling technique, called FedSam, we determined federated learning allows the global model to learn from each client's data and, in turn, provide a means for each client to improve their intrusion detection system's defense against cyber-attacks.