# Anomaly-Flow: A Multi-domain Federated Generative Adversarial Network for Distributed Denial-of-Service Detection

arXiv: https://arxiv.org/abs/2503.14618 · HTML: https://mlsanity.com/paper/2503.14618/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 9 of its 15 references that are in the map.
- First posted on arXiv 18 Mar 2025.

## Builds on (most cited first, 9 of 9)

- [Generalizing to Unseen Domains: A Survey on Domain Generalization](https://mlsanity.com/paper/2103.03097/) (2021)
- [GANomaly: Semi-Supervised Anomaly Detection via Adversarial Training](https://mlsanity.com/paper/1805.06725/) (2018)
- [Towards a Standard Feature Set for Network Intrusion Detection System Datasets](https://mlsanity.com/paper/2101.11315/) (2021)
- [Federated Learning for Intrusion Detection System: Concepts, Challenges and Future Directions](https://mlsanity.com/paper/2106.09527/) (2021)
- [FLEAM: A Federated Learning Empowered Architecture to Mitigate DDoS in Industrial IoT](https://mlsanity.com/paper/2012.06150/) (2020)
- [The Cross-evaluation of Machine Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2203.04686/) (2022)
- [A new method for flow-based network intrusion detection using the inverse Potts model](https://mlsanity.com/paper/1910.07266/) (2019)
- [FLAD: Adaptive Federated Learning for DDoS Attack Detection](https://mlsanity.com/paper/2205.06661/) (2022)
- [Generalizing intrusion detection for heterogeneous networks: A stacked-unsupervised federated learning approach](https://mlsanity.com/paper/2209.00721/) (2022)

## Built on by (most cited first, 2 of 2)

- [Adversarial Defense in Cybersecurity: A Systematic Review of GANs for Threat Detection and Mitigation](https://mlsanity.com/paper/2509.20411/) (2025)
- [A GAN-Based Framework for Robust DDoS Attack Detection](https://mlsanity.com/paper/2609.18281/) (2026)

## Abstract (arXiv)

Distributed denial-of-service (DDoS) attacks remain a critical threat to Internet services, causing costly disruptions. While machine learning (ML) has shown promise in DDoS detection, current solutions struggle with multi-domain environments where attacks must be detected across heterogeneous networks and organizational boundaries. This limitation severely impacts the practical deployment of ML-based defenses in real-world settings. This paper introduces Anomaly-Flow, a novel framework that addresses this critical gap by combining Federated Learning (FL) with Generative Adversarial Networks (GANs) for privacy-preserving, multi-domain DDoS detection. Our proposal enables collaborative learning across diverse network domains while preserving data privacy through synthetic flow generation. Through extensive evaluation across three distinct network datasets, Anomaly-Flow achieves an average F1-score of 0.747, outperforming baseline models. Importantly, our framework enables organizations to share attack detection capabilities without exposing sensitive network data, making it particularly valuable for critical infrastructure and privacy-sensitive sectors. Beyond immediate technical contributions, this work provides insights into the challenges and opportunities in multi-domain DDoS detection, establishing a foundation for future research in collaborative network defense systems. Our findings have important implications for academic research and industry practitioners working to deploy practical ML-based security solutions.