Latency-Aware Federated Learning for Network Intrusion Detection under Non-IID Data

Federated Learning (FL) enables privacy-preserving network intrusion detection without sharing raw traffic, yet its deployment on resource-constrained edge environments remains limited by non-IID data, communication overhead, latency, and privacy–utility trade-offs. This paper presents a systems-level evaluation of FL-based intrusion detection on CIC-IDS-2017 under Dirichlet non-IID partitioning (α = 0.5), 10 clients, and 50% client participation. We systematically compare FedAvg, FedProx, SCAFFOLD, and FedNova with a momentum-stabilized FedAvgM using a LayerNorm/SiLU client model, evaluating detection performance, convergence, latency, communication cost, and energy consumption. FedAvgM achieves 98.44% accuracy and
98.16% Macro-F1, reaching its best performance by round 58, outperforming the evaluated federated baselines. A componentwise ablation confirms the complementary benefits of LayerNorm and server-side momentum, while DP-SGD quantifies the resulting privacy–utility trade-off, achieving ϵ = 5.7343 at δ = 10^−5. The results demonstrate that momentum-based aggregation can improve both convergence and detection performance under partial participation and non-IID data, while highlighting the
practical cost of formal differential privacy in FL-based intrusion detection.