Today, Federated Learning (FL) stands out as the solution to addressing the challenges of distributed computing and empowering a wide range of edge devices with artificial intelligence capabilities. One variant of FL called semi-decentralized FL (SDFL) enables multiple server units to coordinate the learning task instead of relying on only one central server, hence preventing single-point failures. However, SDFL requires careful consideration regarding the coordination between server nodes, and dealing with the heterogeneous computing resources and data distributions across end devices (FL clients). Therefore, we propose TUNE-FL, an adapTive semi-synchronoUs semi-deceNtralizEd Federated Learning that addresses the clients' heterogeneity challenges. TUNE-FL alleviates these challenges by (i) ensuring consensus regardless of the network topology, and (ii) deploying an adaptive semi-synchronous mechanism for coordinating the learning process across all nodes while taking into consideration the heterogeneity presented by end devices. We evaluated TUNE-FL for the intrusion detection system (IDS) datasets and compared it with the three most representative baseline models. The experimental results demonstrate that TUNE-FL outperforms the baselines in accuracy while greatly reducing the duration of FL training by approximately 97 times.

The widespread adoption of the Internet of Things (IoT) in our technology-driven society raises significant security and privacy concerns, highlighting the need for collaborative Intrusion Detection Systems (IDS) that leverage Deep Learning (DL) methods to detect suspicious network traffic. Using both the computing power and local data available at distributed end devices, Federated Learning (FL) provides a decentralized learning paradigm that preserves data privacy. However, the system heterogeneity and the Independent and Identically Distributed (non-IID) distribution of FL clients’ data introduce various challenges that impact training efficiency. To address these issues, we propose an adaptive approach named FLAIR, which leverages a semi-synchronous FL mechanism and a Decision Transformer (DT) to select clients that not only enhance the global model’s performance but also reduce communication and computation overhead. DT helps to make client selection decisions by considering both current and historical information, with the model trained offline using various client selection policies. The process begins by generating an offline database, which will be used to train the DT offline. Then, the DT is deployed for online client selection under a semi-synchronous protocol, enabling a fully adaptive FL system. Extensive experiments on IDS datasets show that FLAIR significantly reduces computation and communication time by up to 94% and 93%, respectively, while maintaining comparable classification performance to the baseline models.

Attack paths are the potential chain of malicious activities an attacker performs to compromise network assets and acquire privileges through exploiting network vulnerabilities. Attack path analysis helps organizations to identify new/unknown chains of attack vectors exposing critical assets, as opposed to individual attack vectors in signature-based attack analysis. Timely identification of attack paths enables proactive mitigation of threats. Nevertheless, manual analysis of complex network configurations, vulnerabilities, and security events to identify attack paths is rarely feasible. This work proposes a novel transferable graph neural network-based model for shortest path identification. The shortest path, integrated with a novel holistic model for identifying potential network vulnerabilities interactions, is then utilized to detect network attack paths. Our framework automates the risk assessment of attack paths indicating the propensity of the paths to enable the compromise of highly-critical assets (e.g., databases). The proposed framework, named SPGNN-API, incorporates automated threat mitigation through a proactive timely tuning of the network firewall rules and Zero-Trust (ZT) policies to break critical attack paths and bolster cyber defenses. Our evaluation process is twofold; evaluating the performance of the shortest path identification and assessing the attack path detection accuracy. Our results show that SPGNN-API largely outperforms the baseline model for shortest path identification with an average accuracy$\geq95$% and successfully detects 100% of the potentially compromised assets, outperforming the attack graph baseline by 47%.