Publisher Copyright: © 2026 by SCITEPRESS – Science and Technology Publications, Ltd.

Detecting intrusions in modern network infrastructures is challenging due to the networks’ growing size and complexity in structure. While several approaches try to cope with those challenges, few address problems arising from heterogeneity and changes within those infrastructures.We present the idea of a self-forming community approach that integrates federated learning (FL) with distributed intrusion detection systems based on anomaly detection. It autonomously separates the anomaly detection models into communities at runtime with the goal of mutual information exchange using FL techniques to improve detection accuracy. Community formation is realized via the introduction of a similarity score between each pair of models, indicating which models would profit from aggregation. Through a re-evaluation of the similarity score during runtime, changes in the deployed infrastructure can be considered, and the communities adapted. Our initial experiments demonstrate that our approach achieves a zero false alarm rate on a real-world dataset, in contrast to related work with false positive rates as high as 37.5% on that data set, while maintaining an identical intrusion detection rate of up to 98%.