Random Forest Based on Federated Learning for Intrusion Detection

Markovic, Tijana; León, Miguel; Buffoni, David; Punnekkat, Sasikumar

doi:10.1007/978-3-031-08333-4_11

Cited by 19 publications

(3 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…They have applied homomorphic encryption to protect the gradients. Similar work was published by Markovic et al on intrusion detection (32). BOFRF, a boosting-based federated RF algorithm, is an interesting concept of assigning weights to the DTs by calculating confusion matrices, using test data from all the sites involved (33).…”

Section: Related Workmentioning

confidence: 83%

Development and validation of random-forest based federated learning algorithms for delirium prediction using electronic medical records from eleven hospitals in Austria: a retrospective study

Veeranki

2024

Preprint

View full text Add to dashboard Cite

Background Machine learning models have shown great potential in preventive medicine but require large datasets, which is a challenge due to strict privacy regulations in the healthcare sector. Federated learning is an approach that enables collaboration between institutions while preserving data privacy. The focus today in research is on developing federated learning methods using artificial neural networks. In this study, we aimed to contribute federated learning modelling methods applied for random forests with a use case of predicting delirium in hospitalised patients using data from multiple hospitals. Methods We collected data from 11 hospitals, including 29,479 patients and 627 features. We trained random forest models with each hospital’s data and a general model using all hospitals data. We developed federated learning models by averaging the predictions of the individual hospital models, with different schemes based on the number of samples, positive cases, minority cases and maximum possible diversity and evaluated the models using area under the receiver operating characteristic curve (AUROC) as a performance measure. Results The general model outperformed all the other models with an AUROC of 0.854 [0.849-0.860]. Models trained on data from single hospitals varied in performance with AUROC from 0.626 to 0.828. Models from hospitals with large datasets performed better than that of small hospitals. The general model outperformed all the other models with an AUROC of 0.854. Federated learning models performed better than individual models. Unweighted averaging performed worst with an AUROC of 0.793 [0.782-0.805]. Among the weighted averaging schemes, the number of positive cases performed the best with an AUROC of 0.843 [0.838-0.846], followed by minority class (AUROC=0.840 [0.836-0.845]), maximum possible diversity (AUROC=0.836 [0.830-0.841]) and number of samples (AUROC=0.830 [0.819-0.841]). Conclusions Results suggest that federated learning models can perform better than hospital-specific models in some cases, especially hospitals with limited data. In case of datasets of different size, we suggest weighted averaging based on the number of samples. If the datasets are class imbalanced, maximum possible diversity should also be considered. Additionally, federated learning models are consistent and stable in performance compared to hospital specific models.

show abstract

Section: Related Workmentioning

confidence: 83%

Development and validation of random-forest based federated learning algorithms for delirium prediction using electronic medical records from eleven hospitals in Austria: a retrospective study

Veeranki

2024

Preprint

View full text Add to dashboard Cite

show abstract

“…FL based on random forest is nowadays a very intensive research feld due to the parallel nature of random forest models. In [12], a federated learning approach for intrusion detection based on random forest (RF) is studied. For each client, a RF model is trained on its specifc data, and subsequently, all clients send their RF models to the centralized server to be combined in a global RF.…”

Section: A Federated Random Forestmentioning

confidence: 99%

Mitigating Concept Drift in Distributed Contexts with Dynamic Repository of Federated Models

Tsiporkova,

Vis,

Klein

et al. 2023

2023 IEEE International Conference on Big Data (BigData)

View full text Add to dashboard Cite

This paper proposes a novel federated learning methodology, called FedRepo, that copes with concept drift issues in a statistically heterogeneous distributed learning environment. The proposed horizontal federated learning methodology, based on random forest (RF), can be used for collaborative training and maintenance of a dynamic repository of federated RF models, each one customized to a group of clients/devices. The clients are grouped together if their performance patterns with respect to the global RF model are similar. The performance of the customized RF global models is continuously monitored during the inference phase and the repository is accordingly adapted to mitigate the detected concept drift. The proposed methodology is studied and evaluated against an electricity consumption forecasting use case. The evaluation results demonstrate clearly that the proposed methodology is able to deal with concept drift issues in an effcient a nd a dequate f ashion w ithout c ompromising t he overall performance of the distributed environment.

show abstract

“…In this paper, we are using a FL framework based on RF that was previously proposed in [18]. The framework employs HFL approach and its main idea is to train independent RFs on clients using the local data, merge independent models into a global one on the server and send it back to the clients for further use.…”

mentioning

confidence: 99%

Random forest with differential privacy in federated learning framework for network attack detection and classification

Markovic,

Leon,

Buffoni

et al. 2024

Appl Intell

Self Cite

View full text Add to dashboard Cite

Communication networks are crucial components of the underlying digital infrastructure in any smart city setup. The increasing usage of computer networks brings additional cyber security concerns, and every organization has to implement preventive measures to protect valuable data and business processes. Due to the inherent distributed nature of the city infrastructures as well as the critical nature of its resources and data, any solution to the attack detection calls for distributed, efficient and privacy preserving solutions. In this paper, we extend the evaluation of our federated learning framework for network attacks detection and classification based on random forest. Previously the framework was evaluated only for attack detection using four well-known intrusion detection datasets (KDD, NSL-KDD, UNSW-NB15, and CIC-IDS-2017). In this paper, we extend the evaluation for attack classification. We also evaluate how adding differential privacy into random forest, as an additional protective mechanism, affects the framework performances. The results show that the framework outperforms the average performance of independent random forests on clients for both attack detection and classification. Adding differential privacy penalizes the performance of random forest, as expected, but the use of the proposed framework still brings benefits in comparison to the use of independent local models. The code used in this paper is publicly available, to enable transparency and facilitate reproducibility within the research community.

show abstract

Random Forest Based on Federated Learning for Intrusion Detection

Cited by 19 publications

References 23 publications

Development and validation of random-forest based federated learning algorithms for delirium prediction using electronic medical records from eleven hospitals in Austria: a retrospective study

Development and validation of random-forest based federated learning algorithms for delirium prediction using electronic medical records from eleven hospitals in Austria: a retrospective study

Mitigating Concept Drift in Distributed Contexts with Dynamic Repository of Federated Models

Random forest with differential privacy in federated learning framework for network attack detection and classification

Contact Info

Product

Resources

About