Federated learning for privacy-preserving anomaly detection in edge, AI within B5G networks

Abstract

Federated Learning (FL) has the potential to securely detect anomalies in Beyond 5G (B5G) networks while preserving privacy. Traditional, centralized learning (CL) methods face significant challenges. The challenges include privacy risks, communication overhead and resource constraints at network edges. This thesis addresses these issues by implementing and evaluating two federated aggregation strategies Federated Averaging (FedAvg) and Federated Proximal (FedProx)—using a lightweight Multi-Layer Perceptron (MLP) model for binary anomaly detection tasks. Realistic Non-Independent and Identically Distributed (non-IID) scenario prevalent in edge environments is simulated by applying a hash-skewed split to the dataset. The dataset used here is the publicly available Fifth Generation Network Intrusion Detection Dataset (5G-NIDD). This creates a significant data imbalance among client nodes. The effectiveness of FedAvg and FedProx was comparatively assessed on accuracy, precision, recall, F1-score. FedProx (μ = 0.01) achieved a final F1-score of 0.999955, accuracy of 0.999955, precision of 0.999910 and recall of 1.000000. FedProx outperformed FedAvg, which achieved F1-score of 0.999907, accuracy of 0.999914, precision of 0.999858 and recall of 0.999956. The confusion matrix shows that FedProx eliminated all false negatives and had only 10 false positives, while FedAvg resulted in 35 false negatives and 12 false positives. This is a strong indicator that FedProx provided superior robustness under heterogeneous data distribution. FedProx maintains stable convergence and higher detection accuracy compared to FedAvg. This thesis provides a reproducible and scalable pipeline facilitating future expansions to multi-client deployments in high-performance computing clusters like Puhti. Experimental results validate the implemented FL strategies not only enhance anomaly detection capabilities at network edges, but also effectively manage communication overhead and latency constraints. This is crucial for real-time network security applications in B5G systems.