3
دانشکده علوم کامپیوتر، دانشگاه یاسوج؛ یاسوج؛ ایران
چکیده
Zero-day attacks are a critical challenge for Network Intrusion Detection (NIDS) due to the unknown structure of the attack with no predefined signature. Machine learning (ML) and Deep Learning (DL) models have recently emerged as a promising solution for enhancing IDS capabilities by detecting anomalies. On the other hand, Federated Learning has emerged as a groundbreaking paradigm for distributed applications to enhance privacy and bandwidth efficiency. The standard Federated Learning (FL) approach generally shares model parameters, which cannot effectively transfer knowledge about unseen attack behaviors across clients. This paper introduces TransFeL-NIDS, a novel federated zero-day detection method that allows clients to share the latent zero-day signatures extracted from a memory-based Transformer. The latent signatures encode high-level behavioral semantics without disclosing raw packets or sensitive traffic data. Compared to the standard FL approach, this strategy improves cross-client generalization to detect unseen attacks while preserving privacy and bandwidth efficiency. Additionally, the latent signature updates help mitigate the negative effects of imbalanced and non-IID data distributions in federated learning.