An Explainable Federated Intrusion Detection Framework for SDN Using Distributed Key Generation and Threshold Homomorphic Encryption
Abstract
The rapid advancement of software-defined networking (SDN) has enhanced network programmability, centralized control, and traffic management flexibility, while also increasing exposure to sophisticated attacks targeting the control plane. Although federated learning (FL) enables collaborative intrusion detection without centralized raw data sharing, existing FL-based intrusion detection systems remain vulnerable to plaintext model update leakage, centralized cryptographic trust, limited interpretability, and insufficient validation in operational SDN environments. To address these limitations, this paper presents an explainable federated intrusion detection framework that integrates distributed key generation (DKG), CKKS-based threshold homomorphic encryption, collaborative decryption, and SHapley Additive exPlanations (SHAP). Unlike conventional HE-enabled FL systems that rely on a trusted authority or a globally shared secret key, the proposed framework removes the trusted key-generation dealer, avoids centralized custody of the complete secret key, and prevents any single client or aggregation server from independently decrypting ciphertexts using locally held key material. A gated recurrent unit (GRU)-based model is used for privacy-preserving intrusion detection, and SHAP provides global and local explanations of model decisions. The framework is further deployed in a real-time SDN testbed to evaluate the online inference pipeline following threshold-secured federated…
Read the paper
Related studies
- Active Learning during Federated Learning for Object Detection
- Fairness-aware federated learning
- Decentralized Federated Learning
- Building a Personally Identifiable Information Recognizer in a Privacy Preserved Manner Using Automated Annotation and Federated Learning
- Preservation of Patient Level Privacy: Federated Classification and Calibration Models
- Efficient explainable federated learning
Go deeper in Evidence Hub
Evidence Hub adds a study data sheet (design, sample size, evidence level, key numbers), an AI summary and a chat grounded in the paper's text.