گروه تخصصی محاسبات و سامانه های توزیع شده انجمن انفورماتیک ایران دوفصلنامه محاسبات و سامانه های توزیع شده 2645-4416 9 1 2026 08 23 TransFeL-NIDS: Federated Latent Zero-Day Signatures using a Memory-Based Transformer for Network Intrusion Detection System TransFeL-NIDS: Federated Latent Zero-Day Signatures using a Memory-Based Transformer for Network Intrusion Detection System 83 88 247926 FA حمیدرضا یزدان پناه دانشکده مهندسی کامپیوتر دانشگاه یزد؛ یزد؛ ایران مجتبی متین خواه دانشکده مهندسی کامپیوتر دانشگاه یزد، یزد، ایران 0000-0002-3800-8396 علی اکبر نیکوکار دانشکده علوم کامپیوتر، دانشگاه یاسوج؛ یاسوج؛ ایران Journal Article 2026 07 25 Zero-day attacks are a critical challenge for Network Intrusion Detection (NIDS) due to the unknown structure of the attack with no predefined signature. Machine learning (ML) and Deep Learning (DL) models have recently emerged as a promising solution for enhancing IDS capabilities by detecting anomalies. On the other hand, Federated Learning has emerged as a groundbreaking paradigm for distributed applications to enhance privacy and bandwidth efficiency. The standard Federated Learning (FL) approach generally shares model parameters, which cannot effectively transfer knowledge about unseen attack behaviors across clients. This paper introduces TransFeL-NIDS, a novel federated zero-day detection method that allows clients to share the latent zero-day signatures extracted from a memory-based Transformer. The latent signatures encode high-level behavioral semantics without disclosing raw packets or sensitive traffic data. Compared to the standard FL approach, this strategy improves cross-client generalization to detect unseen attacks while preserving privacy and bandwidth efficiency. Additionally, the latent signature updates help mitigate the negative effects of imbalanced and non-IID data distributions in federated learning. Zero-day attacks are a critical challenge for Network Intrusion Detection (NIDS) due to the unknown structure of the attack with no predefined signature. Machine learning (ML) and Deep Learning (DL) models have recently emerged as a promising solution for enhancing IDS capabilities by detecting anomalies. On the other hand, Federated Learning has emerged as a groundbreaking paradigm for distributed applications to enhance privacy and bandwidth efficiency. The standard Federated Learning (FL) approach generally shares model parameters, which cannot effectively transfer knowledge about unseen attack behaviors across clients. This paper introduces TransFeL-NIDS, a novel federated zero-day detection method that allows clients to share the latent zero-day signatures extracted from a memory-based Transformer. The latent signatures encode high-level behavioral semantics without disclosing raw packets or sensitive traffic data. Compared to the standard FL approach, this strategy improves cross-client generalization to detect unseen attacks while preserving privacy and bandwidth efficiency. Additionally, the latent signature updates help mitigate the negative effects of imbalanced and non-IID data distributions in federated learning. https://www.jdcs.ir/article_247926_9300ddd264e9de1113f7c6a7dac1c403.pdf