{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,18]],"date-time":"2026-07-18T16:23:53Z","timestamp":1784391833747,"version":"3.55.0"},"reference-count":30,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2026,2,26]],"date-time":"2026-02-26T00:00:00Z","timestamp":1772064000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>Deployed in distributed organizations and edge networks, contemporary intrusion detection increasingly requires high-performing models without centralizing sensitive traffic logs. This study presents a lightweight federated intrusion detection framework that integrates (i) unidirectional serialization to convert tabular flow records into short sequences, (ii) multi-scale one-dimensional convolutions to capture heterogeneous temporal\u2013statistical patterns at different receptive fields, and (iii) an attention-based reweighting module that emphasizes informative feature channels prior to classification. A sample-size-weighted FedAvg aggregation protocol is used to train a global detector without transferring raw data. Experiments on three widely used benchmarks (UNSW-NB15, KDD Cup 99, and NSL-KDD) under multiple client configurations report consistently high detection effectiveness, with peak accuracies of 99.38% (UNSW-NB15), 99.86% (KDD Cup 99), and 99.02% (NSL-KDD), alongside strong precision, recall, and F1 scores. In addition, the proposed framework is quantitatively benchmarked on UNSW-NB15 against two recent federated intrusion detection baselines, FedMSP-SPEC and a multi-view federated CAE-NSVM model, demonstrating improvements of more than 10 percentage points in macro F1-score while retaining a compact architecture. The manuscript further specifies a concrete threat model, clarifies the client data partitioning strategy and Non-IID quantification, and provides a reproducibility protocol (hyperparameters, random seeds, and evaluation procedures) to facilitate independent verification.<\/jats:p>","DOI":"10.3390\/fi18030117","type":"journal-article","created":{"date-parts":[[2026,2,26]],"date-time":"2026-02-26T11:23:45Z","timestamp":1772105025000},"page":"117","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Federated Intrusion Detection via Unidirectional Serialization and Multi-Scale 1D Convolutions with Attention Reweighting"],"prefix":"10.3390","volume":"18","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1754-6099","authenticated-orcid":false,"given":"Wenqing","family":"Li","sequence":"first","affiliation":[{"name":"Hangzhou Institute for Advanced Study, University of Chinese Academy of Sciences, Hangzhou 310000, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Di","family":"Gao","sequence":"additional","affiliation":[{"name":"Hangzhou Institute for Advanced Study, University of Chinese Academy of Sciences, Hangzhou 310000, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4958-3393","authenticated-orcid":false,"given":"Tianrong","family":"Zhang","sequence":"additional","affiliation":[{"name":"College of Information Science and Technology, Zhejiang Shuren University, Hangzhou 310015, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,2,26]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"1153","DOI":"10.1109\/COMST.2015.2494502","article-title":"A survey of data mining and machine learning methods for cyber security intrusion detection","volume":"18","author":"Buczak","year":"2016","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"20","DOI":"10.1186\/s42400-019-0038-7","article-title":"Survey of intrusion detection systems: Techniques, datasets and challenges","volume":"2","author":"Khraisat","year":"2019","journal-title":"Cybersecurity"},{"key":"ref_3","first-page":"102419","article-title":"Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study","volume":"50","author":"Ferrag","year":"2020","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_4","first-page":"50","article-title":"Federated learning: Challenges, methods, and future directions","volume":"37","author":"Li","year":"2020","journal-title":"IEEE Signal Process. Mag."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"2031","DOI":"10.1109\/COMST.2020.2986024","article-title":"Federated learning in mobile edge networks: A comprehensive survey","volume":"22","author":"Lim","year":"2020","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1561\/2200000083","article-title":"Advances and open problems in federated learning","volume":"14","author":"Kairouz","year":"2021","journal-title":"Found. Trends Mach. Learn."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"244","DOI":"10.1016\/j.future.2022.05.003","article-title":"A state-of-the-art survey on solving Non-IID data in federated learning","volume":"135","author":"Ma","year":"2022","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3460427","article-title":"A comprehensive survey of privacy-preserving federated learning: A taxonomy, review, and future directions","volume":"54","author":"Yin","year":"2021","journal-title":"ACM Comput. Surv."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Gosselin, R., Vieu, L., Loukil, F., and Benoit, A. (2022). Privacy and Security in Federated Learning: A Survey. Appl. Sci., 12.","DOI":"10.3390\/app12199901"},{"key":"ref_10","first-page":"220","article-title":"Differential Privacy Federated Learning: A Comprehensive Review","volume":"15","author":"Shan","year":"2024","journal-title":"Int. J. Adv. Comput. Sci. Appl."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Zhang, X., Luo, Y., and Li, T. (2025). A Review of Research on Secure Aggregation for Federated Learning. Future Internet, 17.","DOI":"10.3390\/fi17070308"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"145","DOI":"10.1109\/18.61115","article-title":"Divergence measures based on the Shannon entropy","volume":"37","author":"Lin","year":"1991","journal-title":"IEEE Trans. Inf. Theory"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"147","DOI":"10.1016\/j.cose.2019.06.005","article-title":"A survey of network-based intrusion detection data sets","volume":"86","author":"Ring","year":"2019","journal-title":"Comput. Secur."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/2808691","article-title":"Evaluating computer intrusion detection systems: A survey of common practices","volume":"48","author":"Milenkoski","year":"2015","journal-title":"ACM Comput. Surv."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"110010","DOI":"10.1016\/j.comnet.2023.110010","article-title":"F-NIDS\u2014A Network Intrusion Detection System based on federated learning","volume":"236","author":"Meneguette","year":"2023","journal-title":"Comput. Netw."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Alsamiri, J., and Alsubhi, K. (2023). Federated Learning for Intrusion Detection Systems in Internet of Vehicles: A General Taxonomy, Applications, and Future Directions. Future Internet, 15.","DOI":"10.3390\/fi15120403"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"473","DOI":"10.1007\/s10586-025-05325-w","article-title":"Federated learning in intrusion detection: Advancements, applications, and future directions","volume":"28","author":"Buyuktanir","year":"2025","journal-title":"Clust. Comput."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"3454","DOI":"10.1109\/TIFS.2020.2988575","article-title":"Federated learning with differential privacy: Algorithms and performance analysis","volume":"15","author":"Wei","year":"2020","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Zhou, X., Xu, M., Wu, Y., and Zheng, N. (2021). Deep Model Poisoning Attack on Federated Learning. Future Internet, 13.","DOI":"10.3390\/fi13030073"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Manzoor, H.U., Shabbir, A., Chen, A., Flynn, D., and Zoha, A. (2024). A Survey of Security Strategies in Federated Learning: Defending Models, Data, and Privacy. Future Internet, 16.","DOI":"10.3390\/fi16100374"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Aziz, R., Banerjee, S., Bouzefrane, S., and Le Vinh, T. (2023). Exploring Homomorphic Encryption and Differential Privacy Techniques towards Secure Federated Learning Paradigm. Future Internet, 15.","DOI":"10.3390\/fi15090310"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"111023","DOI":"10.1016\/j.comnet.2024.111023","article-title":"A review of federated learning applications in intrusion detection systems","volume":"258","author":"Belenguer","year":"2025","journal-title":"Comput. Netw."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Devine, M., Ardakani, S.P., Al-Khafajiy, M., and James, Y. (2025). Federated Machine Learning to Enable Intrusion Detection Systems in IoT Networks. Electronics, 14.","DOI":"10.3390\/electronics14061176"},{"key":"ref_24","first-page":"100068","article-title":"Federated learning-based intrusion detection system for the internet of things using unsupervised and supervised deep learning models","volume":"3","author":"Pranggono","year":"2025","journal-title":"Cyber Secur. Appl."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"41264","DOI":"10.1038\/s41598-025-25175-1","article-title":"Graph-based federated learning approach for intrusion detection in IoT networks","volume":"15","author":"Ghalmane","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Klinkhamhom, C., Boonyopakorn, P., and Wuttidittachotti, P. (2025). MIDS-GAN: Minority Intrusion Data Synthesizer GAN\u2014An ACON Activated Conditional GAN for Minority Intrusion Detection. Mathematics, 13.","DOI":"10.3390\/math13213391"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Li, B., Li, J., and Jia, M. (2025). ADFCNN-BiLSTM: A Deep Neural Network Based on Attention and Deformable Convolution for Network Intrusion Detection. Sensors, 25.","DOI":"10.3390\/s25051382"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Cui, B., Chai, Y., Yang, Z., and Li, K. (2024). Intrusion Detection in IoT Using Deep Residual Networks with Attention Mechanisms. Future Internet, 16.","DOI":"10.3390\/fi16070255"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Ji, C., He, S., and Dai, W. (2025). A Federated Learning Based Intrusion Detection Method with Multi-Scale Parallel Convolution and Adaptive Soft Prediction Clustering. Electronics, 14.","DOI":"10.3390\/electronics14234705"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Yu, J., Wang, G., Shi, N., Saxena, R., and Lee, B. (2025). A Multi-View-Based Federated Learning Approach for Intrusion Detection. Electronics, 14.","DOI":"10.3390\/electronics14214166"}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/18\/3\/117\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,26]],"date-time":"2026-02-26T11:29:40Z","timestamp":1772105380000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/18\/3\/117"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,2,26]]},"references-count":30,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2026,3]]}},"alternative-id":["fi18030117"],"URL":"https:\/\/doi.org\/10.3390\/fi18030117","relation":{},"ISSN":["1999-5903"],"issn-type":[{"value":"1999-5903","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,2,26]]}}}