HP²-FedIDS: A Hybrid Privacy and Poisoning-Resilient Federated Learning Framework for Adversarial Robust Intrusion Detection Systems

K. Selvamani, S. Kanimozhi, S. K. Muthusundar, H. Riasudheen, M. Divya, Adam Marks, Ijaz Ahad, A. Shyam Sundhar, Targyn A. Nauryz, Raja Brahmendra Chowdary Veerepalli Department of Computer Science and Engineering, College of Engineering Guindy, Anna University, Chennai, Tamil Nadu, India. Department of Artificial Intelligence and Data Science, Meenakshi College of Engineering, Chennai, Tamil Nadu, India. Department of Artificial Intelligence and Data Science, Chennai Institute of Technology, Chennai, Tamil Nadu, India. Department of Artificial Intelligence and Machine Learning, Saveetha School of Engineering, Chennai, Tamil Nadu, India. Department of Computer Applications, Hindustan College of Arts and Science, Chennai, Tamil Nadu, India. Department of Information Science, Institute for Higher Education Leadership, Dubai, United Arab Emirates. Department of Computer Systems Engineering, University of Engineering and Applied Sciences, Swat, Khyber Pakhtunkhwa, Pakistan.  Department of Computer Systems Engineering, University of Electronic Science and Technology of China, Chengdu, Sichuan, China. Department of Information and Communication, Tampere University, Tampere, Pirkanmaa, Finland. School of Digital Technologies, Narxoz University, Almaty, Kazakhstan. Department of Computer Science, Texas State University, San Marcos, Texas, United States of America.

Abstract: Federated Learning (FL) has become a popular privacy-preserving approach for collaborative Intrusion Detection Systems (IDS), allowing remote network nodes to train detection models without disclosing sensitive traffic data. Despite this architectural advantage, FL-based IDS deployments are vulnerable to gradient leakage attacks, which reconstruct sensitive traffic patterns from transmitted model updates, and model poisoning attacks, in which adversarial clients inject corrupted gradients to degrade or backdoor the global detection model. Practical FL-IDS deployments are vulnerable to multi-vector adversarial exploitation because existing defence measures mostly target these threat vectors in isolation. Researchers present HP²-FedIDS, a Hybrid Privacy- and Poisoning-Resilient Federated Intrusion Detection System that protects against gradient reconstruction and malicious client poisoning in a single, analytically sound defence architecture. The proposed framework comprises a client-side gradient privacy module that uses noise injection and selective gradient masking, a server-side malicious client detection engine that uses gradient similarity analysis and historical behavioural consistency checks, and an adaptive trust-weighted robust aggregation mechanism that dynamically modulates client influence based on anomaly-detection trust scores. Unlike static protocols, HP-FedIDS adjusts trust assignments in each round, reducing hostile contributions and ensuring convergence stability. HP-FedIDS outperforms single-defence baseline frameworks with 96.8% detection accuracy, 14.3% Attack Success Rate (ASR), and a privacy leakage score of 0.31 in standard IDS benchmarks (NSL-KDD, CIC-IDS2017, TON_IoT). These findings support a privacy-integrity co-defence architecture for next-generation federated intrusion detection.

---

Keywords: Federated Learning (FL); Intrusion Detection Systems (IDS); Model Poisoning; Adversarial Robustness; Secure Aggregation; Privacy Preservation; Cybersecurity Architectures.

---

Received on: 08/08/2025Revised on: 25/10/2025Accepted on: 26/11/2025Published on: 03/03/2026

---

---