Federated learning(FL) is a machine learning paradigm designed to protect data privacy and security among multiple clients. It is widely used in industries such as healthcare, finance, and insurance. However, common personalization techniques such as clustering, data augmentation, and knowledge distillation often increase privacy risks or incur high computational costs with methods like homomorphic encryption. To address these challenges, this paper proposes the Secure Personalized Federated Learning (SPFL) algorithm, combining Clustered Federated Learning (CFL) and Oblivious Transfer (OT). Using the Affinity Propagation (AP) clustering algorithm, SPFL groups clients by model similarity to create personalized global models without additional information sharing. OT has achieved efficient delivery of security models. Experimental results show SPFL enhances security, adapts to Non-Independent and Identically Distributed (Non-IID) data, improves global model accuracy by more than 6.5%, and reduces the overall running time under three alpha values by more than 19.82% compared to Paillier encryption.

Bufferbloat, or excessive queuing delay under load, is a noticeable quality of service degradation that occurs when latency-sensitive traffic experiences the effects of increased packet buffering delays in network devices. This phenomenon leads to increased latency and reduced network performance, particularly affecting real-time voice and video traffic, online gaming, and other interactive applications that demand low-latency at all times. Bufferbloat also poses serious risks to future ambitions of latency-critical applications such as telesurgery, autonomous vehicles, and virtual reality, as it undermines network consistency and creates significant operational issues for service providers to manage. Bufferbloat is especially detrimental to Wireless Internet Service Providers (WISPs), due to their often ad-hoc and dynamic nature. To better characterise the prevalence of bufferbloat, we analyse a real-world WISP network and propose "Polus", a framework for detecting and characterising adverse network conditions caused by the phenomenon.

Network data constantly evolves with new network applications and protocols. There is a need for robust techniques to detect anomalous behaviour. Offline models trained with static data lose validity when new variants of traffic emerge. They require retraining but the need for ground truth and lengthy training times make this task challenging. Meanwhile, online models which detect outliers in streaming data are susceptible to the curse of dimensionality and natural variability. Today’s anomalies may be tomorrow’s new traffic and existing methods do not provide a way to differentiate between them. We propose a framework that makes the most of both approaches: an offline deep learning model extracts features of normal traffic and provides a bias for an online outlier detection model to select data for training. The online model retains its previously learnt knowledge and retrains itself with new data. Online thresholds are updated in a drifting manner and the Mann-Whitney U test is incorporated to prevent inaccurate updates. We perform analysis on the scores, develop heuristics to detect new traffic and evaluate using three deep learning models and four outlier detection methods on the UNSW-NB15 and CTU-13 datasets. The framework improves upon any individual offline or online models in isolation.

The challenge of anomaly detection is to obtain an accurate understanding of expected behaviour which is intensified when the data are distributed heterogeneously. Transmitting raw data to a central site incurs high communication overhead and raises privacy issues. The concept of Edge AI allows computation to be performed at the edge site allowing for quick decision making in mission critical scenarios such as self-driving cars. A model is learnt locally and its parameters are transmitted and aggregated. However, existing methods of aggregation do not account for variance and heterogeneous distribution of data. They also do not consider edge constraints such as limited computational, memory and communication capabilities of edge devices. In this work, a fully Bayesian approach is employed by means of a Bayesian Random Vector Functional Link AutoEncoder being incorporated with Expectation Propagation for distributed training. Our anomaly detection system operates without any transmission of raw data, is robust under inhomogeneous network densities and under uneven and biased data distributions. It allows for asynchronous updates to converge in a few iterations and is a relatively simple neural network addressing edge constraints without compromising on performance as compared to existing more complex models.

With the advancement in technology, normal network traffic is becoming more heterogeneous. In this scenario, the problem of detecting anomalies is intensified. In the literature, offline methods see more data and can be optimised to achieve lower false positive rates. However, they cannot readily adapt to changing network conditions or capture concept-drift. This necessitates an incremental online learning model. On the other hand, online training is easily affected by noise. In this paper, we propose a hybrid Online Offline system in which the Offline model retains general characteristics of network traffic while the Online model continuously learns. The Offline model acts as a bias for the Online model to select new data to learn from. The Online model retains its knowledge and adapts to the changing ground truth. They are put to work together to detect anomalies. We implement this idea with an Online Support Vector Machine (SVM) which retains its support vectors and shifts its decision boundary guided by an Offline Radius Nearest Neighbor (Rad-NN). The method is evaluated on the NSL-KDD 2009 dataset. This relatively simple model achieves over 95% accuracy on known anomalies and over 60% detection rate on most of the unknown anomalies.