Empirical Evaluation of a Privacy-Preserving Federated Learning Framework with Homomorphic Encryption for Decentralized Cyber Threat Intelligence Sharing: An Experimental Study
Keywords:
Federated Learning, Homomorphic Encryption, Differential Privacy, CIC-IDS2017, Cyber Threat Intelligence, Privacy-Preserving Cybersecurity, Decentralized Aggregation.Abstract
The current research conducts an empirical assessment of the performance of a privacy-preserving federated learning (FL) framework using a combination of MK-HE, DP, and blockchain-based decentralized aggregation to support cyber threat intelligence (CTI) exchange. Based on the widely-used and publicly available CIC-IDS2017 dataset (2,830,743 network flows, 78 features, 15 classes - benign and 14 different attacks), the hybrid FL approach is implemented via horizontal FL on 10 simulated clients in a non-IID manner. Specifically, local model training employs DP-SGD and secure global model aggregation relies on selective CKKS-based MK-HE. The experimental evaluation demonstrates excellent accuracy (93.8%), robustness against collusion attacks (even for up to K-1 parties), and reduced communication overhead by 3.5 times compared to fully homomorphic FL (HE-FL). The PriSec-FL-CTI framework achieves a favorable balance between privacy (ε=0.8) and efficiency.
