# Network Anomaly Detection Using Federated Learning

arXiv: https://arxiv.org/abs/2303.07452 · HTML: https://mlsanity.com/paper/2303.07452/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 15 references that are in the map.
- First posted on arXiv 13 Mar 2023.

## Builds on (most cited first, 7 of 7)

- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [Towards Federated Learning at Scale: System Design](https://mlsanity.com/paper/1902.01046/) (2019)
- [A Survey on Federated Learning Systems: Vision, Hype and Reality for Data Privacy and Protection](https://mlsanity.com/paper/1907.09693/) (2019)
- [Client-Edge-Cloud Hierarchical Federated Learning](https://mlsanity.com/paper/1905.06641/) (2019)
- [Bandit-based Communication-Efficient Client Selection Strategies for Federated Learning](https://mlsanity.com/paper/2012.08009/) (2020)
- [Communication-Efficient Hierarchical Federated Learning for IoT Heterogeneous Systems with Imbalanced Data](https://mlsanity.com/paper/2107.06548/) (2021)
- [Condition monitoring and anomaly detection in cyber-physical systems](https://mlsanity.com/paper/2301.09030/) (2023)

## Built on by (most cited first, 4 of 4)

- [Efficient Client Selection in Federated Learning](https://mlsanity.com/paper/2502.00036/) (2025)
- [Adaptive Client Selection in Federated Learning: A Network Anomaly Detection Use Case](https://mlsanity.com/paper/2501.15038/) (2025)
- [HFL-FlowLLM: Large Language Models for Network Traffic Flow Classification in Heterogeneous Federated Learning](https://mlsanity.com/paper/2511.14199/) (2025)
- [Reducing Communication Overhead in Federated Learning for Network Anomaly Detection with Adaptive Client Selection](https://mlsanity.com/paper/2503.15448/) (2025)

## Abstract (arXiv)

Due to the veracity and heterogeneity in network traffic, detecting anomalous events is challenging. The computational load on global servers is a significant challenge in terms of efficiency, accuracy, and scalability. Our primary motivation is to introduce a robust and scalable framework that enables efficient network anomaly detection. We address the issue of scalability and efficiency for network anomaly detection by leveraging federated learning, in which multiple participants train a global model jointly. Unlike centralized training architectures, federated learning does not require participants to upload their training data to the server, preventing attackers from exploiting the training data. Moreover, most prior works have focused on traditional centralized machine learning, making federated machine learning under-explored in network anomaly detection. Therefore, we propose a deep neural network framework that could work on low to mid-end devices detecting network anomalies while checking if a request from a specific IP address is malicious or not. Compared to multiple traditional centralized machine learning models, the deep neural federated model reduces training time overhead. The proposed method performs better than baseline machine learning techniques on the UNSW-NB15 data set as measured by experiments conducted with an accuracy of 97.21% and a faster computation time.