A Framework for Real-Time Continual Learning Federated Intrusion Detection Systems

Abstract

Intrusion Detection and Prevention Systems (IDS/IPS) are vital components of security architecture for protecting the networks against cyberattacks. Traditional IDS/IPS rely on static rules and user configurations, which make them less effective against growing threats. Modern studies have integrated Artificial Intelligence (AI) and Machine Learning (ML) to IDS to improve the accuracy and detection speed. However, such AI/ML based systems still face many issues, which include reliance on the outdated datasets, almost no handling of zero-day attacks, lack of interpretability, and privacy concerns. This paper studies recent AI/ML based IDS/IPS works to identify key shortcomings, and then proposes a real-time, continually learning, federated IDS framework with integrated explainable AI. The proposed framework design addresses the adaptability, privacy, and trustability aspects, which can be used to build more resilient network defense systems