Federated Learning for Intrusion Detection Under Class Imbalance: A Multi-Domain Ablation Study with Per-Client SMOTE

Abstract

Federated learning (FL) enables privacy-preserving collaboration for Network Intrusion Detection Systems (NIDSs), but its effectiveness under heterogeneous traffic, severe class imbalance, and domain shift remains insufficiently characterized. We evaluate FL in two settings: (i) single-domain training on CICIDS-2017, InSDN/OVS, and 5G-NIDD with cross-domain testing, and (ii) multi-domain training that learns a unified model across enterprise and Software-Defined Network (SDN) traffic. Using consistent preprocessing and controlled ablations over balancing strategy, loss function, and client sampling, we find that dataset structure (class separability) largely determines single-domain FL gains. On datasets with lower separability, FL with Per-Client Synthetic Minority Over-sampling Technique (SMOTE) substantially improves Macro-F1 over centralized baselines, while well-separated datasets show limited benefit. However, single-domain models degrade sharply under domain shift, showing substantial degradation in cross-domain transfer. To mitigate this, we combine multi-domain FL with AutoEncoder pretraining and achieve 77% Macro-F1 across environments, demonstrating that FL can learn domain-invariant representations when trained on diverse traffic sources. Overall, our results indicate that Per-Client SMOTE is the preferred balancing strategy for federated NIDS, and that multi-domain training is often necessary when deployment environments differ from training data.

1. Introduction

Network Intrusion Detection Systems (NIDSs) are critical components of modern cybersecurity infrastructure and are used to identify malicious activities in network traffic. Yet deploying effective NIDSs in practice is hindered by two enduring challenges: class imbalance and data privacy. Real-world traffic is heavily skewed toward benign flows, while rare attack categories (e.g., BOTNET, Web-Attack) can represent only a very small fraction of overall observations. Such extreme imbalance biases learning toward majority classes and can severely degrade the detection of rare attacks with serious consequences [1].

The privacy challenge stems from the sensitive nature of network data. As a result, organizations are reluctant to share raw traffic logs. This limits access to diverse, large-scale training data and makes it harder to build models that generalize across environments. Federated learning (FL) [2] offers an alternative. It enables collaborative model training without centralizing raw data: participants train locally and exchange only model updates.

Although FL has shown promise for intrusion detection [3,4], its benefits under heterogeneous traffic, severe imbalance, and domain shift are not yet fully understood. In particular, the field lacks clear evidence on when FL improves over centralized baselines and which imbalance-aware design choices matter most for multiclass, rare-attack detection.

To address these gaps, we design a two-phase experimental framework. Phase 1 utilizes an attack-only formulation across individual datasets (CICIDS-2017, InSDN-OVS, 5G-NIDD) to eliminate overwhelming majority-class bias. By isolating the challenge of distinguishing between minority attack vectors, we enable a rigorous evaluation of how FL-specific design choices, such as Synthetic Minority Over-sampling Technique (SMOTE) granularity, loss functions, and client selection, mitigate interclass confusion. We hypothesize that Per-Client SMOTE outperforms Global SMOTE by preserving local data distributions during synthesis (Section 6.2).

Phase 2 extends this analysis to a multi-domain environment, combining enterprise and Software-Defined Network (SDN) traffic with benign samples included. This setup simulates a realistic deployment scenario, allowing us to evaluate model robustness and false positive rates under cross-environment heterogeneity.

This structured approach allows us to systematically address the following research questions:

• RQ1: How do data distribution patterns and network traffic characteristics influence the relative performance of federated learning compared to centralized training in Intrusion Detection Systems?
• RQ2: What are the isolated effects of SMOTE granularity, loss design, and client selection on rare-class detection within the Phase 1 framework?
• RQ3: Can multi-domain FL learn domain-invariant representations that serve multiple network environments effectively without a severe performance drop?

Contributions

Our study differs from prior FL-IDS work in three key aspects. First, we provide a systematic ablation that isolates the effects of SMOTE placement, loss functions, and client selection through controlled single-domain experiments, an analysis absent in existing studies. Second, we conduct cross-domain evaluation under domain shift using a unified label space across CICIDS-2017 and InSDN-OVS, unlike prior work focusing on single datasets. Third, we propose and validate Per-Client SMOTE as a more effective strategy than global SMOTE for federated rare-class detection.

Through this comprehensive study, we present findings that challenge common assumptions and provide practical guidance for deploying FL-based IDSs in real-world settings.

The remainder of this paper is organized as follows. Section 2 reviews related work on FL-based IDSs and class imbalance handling. Section 3 details our methodology, including dataset preprocessing, client distribution strategies, and the experimental design. Section 4 describes the experimental setup. Section 5 presents results from both single-domain and multi-domain experiments. Section 6 discusses implications and limitations, and Section 7 concludes with practical recommendations.

2. Related Work

2.1. Detection Paradigms

This section reviews recent advances in federated learning (FL) for intrusion detection systems (IDSs), with a focus on multiclass detection and class-imbalance handling.

Anomaly-Based vs. Multiclass IDSs

IDS research follows two main paradigms. Anomaly-based approaches learn a model of normal traffic and flag deviations as attacks, typically framing detection as a binary or one-class problem. Multiclass approaches instead distinguish among specific attack categories (e.g., DoS, DDoS, Probe, Botnet), which is more challenging due to interclass overlap and severe rare-class imbalance. Our study focuses on the multiclass setting, where distinguishing between attack types, not just detecting anomalies, is the primary objective.

We position our study through controlled ablations that isolate three factors: (i) where oversampling is applied (global vs. per-client), (ii) which imbalance strategy is used (SMOTE vs. CAP vs. class-weighted loss), and (iii) when FL is beneficial across heterogeneous network domains.

2.2. Dataset-Specific FL Applications

Table 1. Comparative analysis of recent FL-IDS studies.

Study	Year	Dataset(s)	FL Algorithm/Focus
FELIDS [8]	2022	CSE-CIC-IDS2018, MQTTset, InSDN	FedAvg
Lazzarini et al. [5]	2023	ToN_IoT, CICIDS2017	FedAvg + adaptive variants
Fed-ANIDS [6]	2023	CICIDS2017	FedProx, FedAvg (anomaly-based)
F-BIDS [14]	2023	Edge-IIoTset, InSDN	Federated Blending
Javeed et al. [15]	2024	CICIDS2017, Edge-IIoTset	Horizontal FL + CNN–BiLSTM
FedNIDS [7]	2025	CICIDS-2017/18	FedAvg (packet-based)
BFL-SDWANTrust [9]	2025	InSDN	FL + blockchain/trust
Zafar et al. [10]	2025	5G-NIDD	FedAvg + adversarial opt.
FD-IDS [11]	2025	IoT benchmarks	FL + knowledge distillation
FedKD-IDS [12]	2025	IoT/IIoT	FL + KD (robust)
Harshitha et al. [13]	2025	CICIDS2017/18	FedAvg + Transformer + XAI
This Study	2025	CICIDS, OVS, 5G-NIDD	FedAvg; multi-dataset ablations

summarizes recent FL-IDS studies evaluated on widely used network intrusion benchmarks. Studies on CICIDS-2017 and its variants explore diverse FL configurations, including adaptive aggregation [5], anomaly-based formulations [6], and packet-level architectures [7]. SDN-focused works such as FELIDS [8] and BFL-SDWANTrust [9] demonstrate FL effectiveness in edge and fog settings using InSDN, while Zafar et al. [10] address adversarial robustness on 5G-NIDD. Recent advances also incorporate knowledge distillation to handle non-IID heterogeneity [11,12] and transformer-based architectures with explainability modules [13].

Beyond these benchmark-driven studies, the literature includes IoT-oriented feasibility analyses [16], trust-aware participant selection mechanisms [17], and concept-drift-aware federated designs [18]; while these works advance FL-IDS along different axes, none systematically isolate the effect of oversampling placement (global vs. per-client) under a unified experimental protocol.

2.3. Class Imbalance in FL-IDSs

Class imbalance is a defining characteristic of IDS datasets, where attack classes such as Botnet or Web-Attack may constitute less than 1% of total samples. SMOTE remains among the most widely adopted resampling techniques [1], while loss-level methods such as Focal Loss emphasize hard-to-classify minority samples [19]. In centralized settings, combining SMOTE with deep models has shown significant gains for rare-class detection [20,21]. Federated approaches have explored dynamic focal loss with client clustering [22] and GAN-based augmentation [23].

Table 2. Imbalance handling techniques in IDS literature.

Study	Year	Dataset(s)	Imbalance Method	P. Ctrl?	Key Gap
DWGF-IDS [23]	2023	NSL-KDD, CSE-CIC-IDS-2018	DDAE + SA-WGAN-GP + Focal Loss	No	No FL oversampling placement study.
CBF-IDS [21]	2023	IDS benchmarks	CNN-BiLSTM + Focal Loss	No	Loss-only; no SMOTE comparison.
CFL-IDS [22]	2024	IIoT Networks	Clustered FL + Dynamic Focal Loss	No	Clustering focus; no placement ablation.
Hybrid-DL-SMOTE [20]	2024	CICIDS2017	LSTM + SMOTE	N/A	Centralized baseline; no FL evaluation.
FTL-Rare [24]	2025	IDS benchmarks	FL + transfer learning	No	Transfer-based; no placement control.
This Study	2025	CICIDS, OVS	Global vs. Per-Client SMOTE	Yes	—

summarizes representative imbalance-oriented designs; while these works improve minority sensitivity, they treat oversampling as a black-box preprocessing step, failing to isolate the impact of placement (global vs. per-client) within the FL pipeline. This gap motivates our controlled ablations on oversampling placement and loss choice across CICIDS and OVS.

2.4. Positioning

Table 1 and Table 2 summarize the landscape of recent FL-IDS research. In summary, these studies indicate that aggregation choice, client heterogeneity, and model architecture can affect detection performance. However, the evidence is often based on single-dataset evaluations or anomaly-oriented formulations. Controlled analysis is still limited on how imbalance handling, loss choice, and oversampling placement interact under realistic non-IID conditions. Multi-domain federated settings with a unified label space are also underexplored.

Our study advances this line of work with a controlled three-dataset design. We examine (i) when FL is beneficial, (ii) where class-imbalance interventions should be applied, and (iii) whether losses such as Focal Loss are still needed once oversampling is integrated properly. This provides a clearer, dataset-dependent view of rare-class handling and the practical utility of FL across heterogeneous network environments.

3. Methodology

3.1. Experimental Design Rationale

We structure our experiments in two complementary phases to systematically address different aspects of the FL-IDS challenge, separating controlled component analysis from realistic cross-environment deployment conditions.

3.1.1. Phase 1: Attack-Only Classification (Single-Domain)

In our single-domain experiments (CICIDS-2017, InSDN-OVS, 5G-NIDD), we exclude benign traffic and focus exclusively on multiclass attack classification. This design choice is motivated by three factors:

• Problem difficulty: In many settings, binary benign-vs-attack detection can reach very high performance due to clearer separability. The more challenging task is distinguishing between attack types, particularly rare classes such as BOTNET and Web-Attack.
• Isolating class imbalance effects: By removing the dominant benign class (often exceeding 80% of traffic), we can more precisely evaluate how SMOTE placement, loss functions, and client selection affect inter-attack discrimination.
• Ablation clarity: Attack-only settings provide cleaner ablation studies, allowing us to attribute performance changes directly to specific components (SMOTE, Focal Loss, rare-class-aware client selection).

3.1.2. Phase 2: Multi-Domain with Benign Traffic (Cross-Environment)

To evaluate cross-environment learning under a unified label space, we combine CICIDS-2017 and InSDN-OVS and include benign traffic to simulate realistic IDS deployment:

• Operational realism: Production IDS must process predominantly benign traffic while detecting rare attacks. Including benign samples tests whether the model maintains low false positive rates, mitigating alert fatigue concerns.
• Domain shift evaluation: Traffic patterns differ substantially across enterprise and SDN environments for both benign and attack classes. We observed that even identically named attacks, such as DDoS, show different feature distributions in CICIDS-2017 and InSDN-OVS, which can degrade detection performance. By including benign and attack samples from both sources, we test whether FL can learn more domain-robust representations under this cross-environment shift.
• Threshold optimization: Our benign-gating mechanism (Equation (2)) requires benign samples to tune the trade-off between attack recall and benign misclassification, which we quantify using the FP/10K metric.

This two-phase design enables both rigorous component attribution (Phase 1) and realistic cross-environment assessment (Phase 2). Crucially, success in inter-attack discrimination (Phase 1) implies a higher level of feature representation granularity; a model that can distinguish between subtly different attack vectors learns more robust decision boundaries than a simple binary classifier. This granular performance serves as a foundation for effective binary classification in broader deployment scenarios, as validated in Phase 2.

3.2. Common Experimental Settings

All experiments use SimpleMLP with two hidden layers [128, 64], BatchNorm1d, ReLU activation, and Dropout(0.3). We optimize with AdamW (lr = $1\times {10}^{-3}$, weight decay = $1\times {10}^{-4}$), batch size 256. Main experiments comparing Per-Client vs. Global SMOTE were repeated across 5 seeds (42, 123, 456, 789, 2024) to verify stability; see Section 4.4 for aggregated statistics. Ablation studies use single-run results (seed = 42). To balance minority class representation without overfitting to synthetic samples, SMOTE is applied with a maximum 10:1 ratio, while this SimpleMLP serves as our base classifier, it is extended into an MLPWithEncoder architecture in Phase 2 to incorporate representation learning, as detailed below.

3.2.1. Phase 1: Single-Domain Settings

We use stratified 70/15/15 train/validation/test splits per dataset. We use 5 FL clients, 15 communication rounds, 5 local epochs per round, with 3 clients selected per round. Rare attack classes are concentrated in two clients (0–1) to ensure sufficient neighborhood density for SMOTE synthesis. To ensure fair comparison, this distribution is maintained across all experimental variants. Each round includes at least one rare-enriched and one common client for balanced gradient updates. Focal Loss γ = 3.0. Feature counts: 28 for CICIDS/OVS, 43 for 5G-NIDD.

3.2.2. Phase 2: Multi-Domain Settings

Each source dataset (CICIDS, OVS) is first split 70/15/15 into train/validation/test. The test and validation portions are combined into global pools: the global test set is held out for final evaluation, while the global validation set is reserved for threshold optimization (Section 3.5.5). The combined training pool undergoes a nested split: 90/10 for AE pretraining (AE-train/AE-val), with the AE-train further divided 70/30 for federated training and round-end validation (FT-train/FT-val). We use 10 clients, 10 rounds, and 2 local epochs with full client participation (

Table 3. Key experimental settings and hyperparameters for Phase 1 and Phase 2.

Category	Phase 1 (Single-Domain)	Phase 2 (Multi-Domain)
Model Architecture	SimpleMLP [128, 64]	Encoder [256 → 128 → 64 → 32] + MLP
Input Features	28 (CICIDS/OVS), 43 (5G)	37 (Harmonized)
Latent Dimension	N/A	32
Optimizer	AdamW (lr = $1\times {10}^{-3}$, wd = $1\times {10}^{-4}$)	AdamW (lr = $1\times {10}^{-3}$, wd = $1\times {10}^{-4}$)
Batch Size	256	256
Train/Val/Test Split	70/15/15 (stratified)	AE: 90/10, FT: 70/30 (nested)
Client Distribution	Rare-concentrated (2 rare, 3 common)	StratifiedKFold (all classes)
Federation	5 Clients, 15 Rounds	10 Clients, 10 Rounds
Client Selection	3/round (Rare-aware: 1-1-2)	10/round (Full)
Local Epochs	5	2
Early Stopping	patience = 8, $\delta =1\times {10}^{-4}$	patience = 8, $\delta =1\times {10}^{-4}$
Focal Loss $\gamma$	3.0	1.5
Balancing	SMOTE (10:1)	CAP + ROS + Per-Client SMOTE

).

For representation learning, we employ a Denoising AutoEncoder (DAE) with a 32-dimensional latent space (see Section 3.5.3 for architecture and justification). Pretraining is fully unsupervised; labels are introduced only during federated fine-tuning.

3.3. Summary of Experimental Hyperparameters

To provide a unified reference, Table 3 summarizes key configurations for both experimental phases.

While non-IID conditions typically motivate advanced aggregation methods, FedAvg proves sufficient in our framework due to a dual-layer mitigation strategy: (1) DAE pretraining (37 → 256 → 128 → 64 → 32) provides a shared, domain-invariant initialization that filters environment-specific noise and reduces gradient divergence, and (2) Per-Client SMOTE addresses label skew locally before training. This combination ensures stable convergence and high-stakes detection performance without the computational overhead of constrained optimization algorithms.

3.4. Domain-Specific FL Pipeline

Figure 1 illustrates the domain-specific FL pipeline, which consists of four stages:

• Data Preprocessing: We apply dataset-specific cleaning and harmonization (e.g., rate-column fixes, label text normalization), followed by feature selection and StandardScaler normalization fitted only on the training split. We then create a stratified train/validation/test split (70%/15%/15%). In Phase 1 single-domain settings, benign samples are excluded to focus on inter-attack discrimination.
  To prevent data leakage, all preprocessing statistics (feature selection scores and StandardScaler) are computed using only the training split. Likewise, all balancing steps (Global/Per-Client SMOTE) are applied only to the training data; validation and test sets remain untouched.
• SMOTE Application: We compare two oversampling placements: (i) Global SMOTE applied before client distribution, and (ii) Per-Client SMOTE applied independently after distribution. We adopt an adaptive neighbor rule $k=min\left(5,n_{min}-1\right)$, targeting the median class, count as a cap to avoid excessive synthesis under extreme rarity.
• Client Distribution: Data are distributed across 5 clients following the rare-concentrated allocation in Table 3, simulating non-IID deployments where only a subset of sites observe rare attacks.
• Federated Training: FedAvg and early stopping settings follow Table 3. Rare-aware selection ensures balanced gradient updates from both rare-enriched and common clients each round.

Dataset-Specific Notes

CICIDS-2017: We perform MI-based feature selection to obtain 28 features. Rate-related columns (e.g., Flow_Bytes/s, Flow_Packets/s) are corrected, values are clipped at the 99.9th percentile, and missing values are imputed using medians computed from the CICIDS training split. The six attack classes include {BFA, BOTNET, DDoS, DoS, Probe, Web-Attack}, where BFA, BOTNET, and Web-Attack are treated as rare.

InSDN-OVS: We use the same 28-feature MI-based selection to maintain comparability. We fix label formatting artifacts (e.g., trailing whitespace in DDoS labels) and impute missing values using medians from the OVS training split. Because rare classes are more sparse in OVS, we use stronger class-wise $\alpha$ weights in Focal Loss compared to CICIDS.

5G-NIDD: We remove the benign class and perform one-hot encoding on categorical attributes (e.g., Proto, State, Cause). Columns with more than 70% missing values are dropped. StandardScaler is fitted on the training split after encoding and applied to validation/test. The eight attack classes include {HTTPFlood, ICMPFlood, SYNFlood, SYNScan, SlowrateDoS, TCPConnectScan, UDPFlood, UDPScan}, with ICMPFlood and SYNFlood treated as rare.

3.5. Multi-Domain FL Pipeline

To examine cross-environment learning under a unified label space, we combine CICIDS-2017 and InSDN-OVS into a 7-class problem: {BENIGN, BFA, BOTNET, DDoS, DoS, Probe, Web-Attack}. We exclude U2R because it appears only in CICIDS-2017 and is extremely scarce (<50 samples), which makes learning unstable and evaluation unreliable. Beyond sample scarcity, the high intraclass variance of U2R exploits (e.g., buffer overflows and rootkits) cannot be effectively captured by such a limited sample size, particularly in a federated setting where data are further partitioned across clients. Including U2R would lead to results dominated by statistical noise rather than genuine feature representation. Thus, removing U2R ensures a more robust label space for cross-domain evaluation and avoids conclusions driven by near-zero support.

Figure 2 summarizes the end-to-end multi-domain FL pipeline.

To prevent data leakage, we adopt the nested split strategy detailed in Section 3.2 (Phase 2 settings). All resampling is applied exclusively to FT-train; validation and test splits remain untouched.

3.5.1. Feature Harmonization and Selection

We align the datasets using a common feature schema, facilitated by the fact that both CICIDS-2017 and InSDN-OVS were generated using the same extraction tool (CICFlowMeter). This ensures that features such as Flow_Duration and Packet_Length carry identical semantic and technical definitions across both environments, providing a consistent baseline for harmonization. We then apply a correlation filter (threshold 0.90), followed by mutual information ranking to select the top 37 features. This selection process focuses on protocol-standard flow characteristics (e.g., packet counts, duration, and byte rates) that are semantically consistent across different network environments. By prioritizing these domain-agnostic features and utilizing a shared extraction methodology, we minimize the risk of environmental bias being encoded into the harmonized feature space.

3.5.2. Client Setup and FL Configuration

Unlike the single-domain experiments, the multi-domain setting uses 10 clients. All clients participate in each round, with 10 rounds total and 2 local epochs per round. We use full participation to make aggregation more stable under cross-domain label sparsity.

3.5.3. AutoEncoder Pretraining

To mitigate cross-domain feature mismatch, we use a Denoising AutoEncoder (DAE) for representation learning. The encoder maps $\mathbf{x}\in {\mathbb{R}}^{37}$ to a latent space $\mathbf{z}\in {\mathbb{R}}^{32}$:

$$\mathbf{x}\to 256\to 128\to 64\to \mathbf{z}.$$

(1)

The compression ratio ($32/37\approx 0.86$) provides a meaningful bottleneck that prevents identity mapping and forces the encoder to filter environment-specific noise, essential for cross-domain alignment. The decoder mirrors this structure to reconstruct $\widehat{\mathbf{x}}$ by minimizing MSE loss. We inject Gaussian noise with $\sigma =0.10$ during pretraining to improve robustness. This pretraining phase is fully unsupervised; no class labels are used.

We pretrain the DAE on the aggregated multi-domain training pool (CICIDS + OVS) to obtain a shared initialization. The pretrained encoder is then used to initialize each client model in MLPWithEncoder. During federated training, the encoder and classifier are optimized jointly on each client (no freezing) under the same Per-Client SMOTE protocol, and updates are aggregated via FedAvg.

To isolate the contribution of representation pretraining, both AE-based and Pure MLP baselines use the same federated optimization protocol and the same Per-Client SMOTE strategy. The only difference is DAE initialization.

Computational Overhead

While DAE pretraining introduces a one-time computational cost (12 epochs with early stopping on the combined training pool), this overhead is negligible compared to the long-term benefits: (1) faster and more stable FL convergence through domain-invariant initialization (see Section 3.3 for FedAvg justification), (2) a modest reduction in the classifier’s input dimensionality during fine-tuning (32 vs. 37), which can slightly lower the computational cost of the classification head and simplify optimization, and (3) significantly improved cross-domain generalization. The pretraining cost is amortized across all subsequent FL experiments using the same dataset combination, and it serves as a critical trade-off for achieving a 0.7739 Global Macro-F1 score in multi-domain settings.

3.5.4. Hierarchical Balancing: CAP, ROS, and Per-Client SMOTE

To address extreme class imbalance in the combined multi-domain distribution, we apply a three-tier hierarchical balancing strategy that operates sequentially at both global and local levels:

• CAP (Global-level): Mitigates major-class dominance by applying hard limits to high-frequency traffic: BENIGN $\le 150$ K, DoS $\le 60$ K, DDoS $\le 45$ K, and Probe $\le 35$ K. Rare classes remain untouched, allowing the optimizer to capture diverse attack gradients without being overwhelmed by the majority.
• Conservative ROS (Global-level): Acts as a bootstrapping seed for rare classes (BFA, BOTNET, and Web-Attack). By applying a $3\times$ cap per rare class (adding approximately 154 samples each), we achieve an aggregate rare-class ratio of $s_r=2.34\%$. This step is technically critical; it ensures a sufficient “starting population” so that local clients receive enough samples ($k\ge 5$) after partitioning to make subsequent SMOTE interpolation viable.
• Per-Client SMOTE (Client-level): Addresses the residual scarcity that emerges after StratifiedKFold distribution across 10 clients. For example, while the BOTNET count drops to ∼108 samples per client after partitioning, Per-Client SMOTE restores this to a target of 500 (a $4.6\times$ local increase). For extremely scarce classes such as Web-Attack, we apply a more conservative target of 150 samples to prevent overfitting on synthetic noise while still providing sufficient diversity for the model.

This sequential pipeline, applying CAP+ROS globally and SMOTE locally with an adaptive $k=min(5,n_{min}-1)$ neighbor rule, prevents global balancing gains from being diluted by the federated partitioning process. The effectiveness of this interaction is validated by our results, where previously undetected classes such as BOTNET achieved a Macro-F1 score of 0.5744. To maintain the integrity of the evaluation, all balancing steps are applied exclusively to the training split.

3.5.5. Threshold Optimization

For multi-domain inference, we use a benign gate followed by class-specific constraints. Let $\mathcal{R}$ denote rare classes, $\mathcal{M}$ denote major attack classes, and $\mathcal{A}=\mathcal{R}\cup \mathcal{M}$. Given predicted probabilities $\left\{p_k\right\}$, we define $p_{max}={max}_{k\in \mathcal{A}}{p}_k$ and $p_{M,max}={max}_{j\in \mathcal{M}}{p}_j$.

$$\widehat{y}=\left\{\begin{array}{cc}\mathrm{BENIGN},\hfill & \mathrm{if}{p}_{\max }<t_{\mathrm{gate}},\hfill \\ {\displaystyle \arg \underset{k\in \mathcal{A}}{\max }{p}_k\mathrm{s}.\mathrm{t}.\left\{\begin{array}{cc}{p}_k\ge t_k,\hfill & k\in \mathcal{M},\hfill \\ p_k\ge t_k^{\min }\wedge p_k\ge t_k\wedge (p_k-p_{M,\max })\ge {\delta }_k,\hfill & k\in \mathcal{R},\hfill \end{array}\right.}\hfill & \mathrm{otherwise}.\hfill \end{array}\right.$$

(2)

where $t_{\mathrm{gate}}$ is the benign gating threshold, $t_k$ are per-class thresholds for major attack classes, and $(t_k^{\min },{\delta }_k)$ are rare-class confidence and margin constraints.

If no attack class meets the constraints above, the prediction defaults to BENIGN. Thresholds are optimized on the validation set using grid search with a step size of 0.005 (yielding 57 candidate values for $t_{\mathrm{gate}}$) to maximize Macro-F1 while keeping false positives at ≤500 per 10K benign samples. Convergence was verified by comparing quantile-based and grid-based optimization, both yielding identical per-class thresholds.

3.6. Experiment Matrix

To ensure reproducibility and isolate the effect of imbalance handling from federated aggregation, we define an experiment matrix spanning SMOTE placement, loss choice, and client-selection variants across three single-domain datasets and one multi-domain setting. We run the full ablation suite on CICIDS-2017 as the primary benchmark. For InSDN-OVS and 5G-NIDD, we report a smaller set of representative configurations (full pipeline, Per-Client SMOTE variant, and a centralized baseline). This design checks whether key findings generalize across datasets without making the experiment grid too large.

Table 4. Complete experiment matrix across datasets. Full ablations are performed on CICIDS-2017, while InSDN-OVS and 5G-NIDD report a reduced subset of representative configurations.

Dataset	Experiment	SMOTE	Loss	FL	Model/Classes
CICIDS	Full Pipeline	Global	Focal ($\gamma =3.0$)	5c/15r	SimpleMLP/6
CICIDS	Per-Client SMOTE	Per-Client	Focal ($\gamma =3.0$)	5c/15r	SimpleMLP/6
CICIDS	Centralized	Global	Focal ($\gamma =3.0$)	–	SimpleMLP/6
CICIDS	No SMOTE	–	Focal ($\gamma =3.0$)	5c/15r	SimpleMLP/6
CICIDS	No Focal Loss	Global	CE	5c/15r	SimpleMLP/6
CICIDS	Random Selection	Global	Focal ($\gamma =3.0$)	5c/15r	SimpleMLP/6
CICIDS	Pure FL	–	CE	5c/15r	SimpleMLP/6
OVS	Full Pipeline	Global	Focal ($\gamma =3.0$)	5c/15r	SimpleMLP/6
OVS	Per-Client SMOTE	Per-Client	Focal ($\gamma =3.0$)	5c/15r	SimpleMLP/6
OVS	Centralized	Global	Focal ($\gamma =3.0$)	–	SimpleMLP/6
5G-NIDD	Full Pipeline	Global	Focal ($\gamma =3.0$)	5c/15r	SimpleMLP/8
5G-NIDD	Per-Client SMOTE	Per-Client	Focal ($\gamma =3.0$)	5c/15r	SimpleMLP/8
5G-NIDD	Centralized	Global	Focal ($\gamma =3.0$)	–	SimpleMLP/8
Multi-Domain	Full Pipeline †	Per-Client	Focal ($\gamma =1.5$)	10c/10r	MLPWithEncoder/7
Multi-Domain	Pure MLP (No AE) ‡	Per-Client	Focal ($\gamma =1.5$)	10c/10r	PureMLP/7

^† Includes CAP, conservative ROS, DAE pretraining, benign-gate, and Per-Client SMOTE. ^‡ Same settings as Full Pipeline without DAE pretraining.

lists all evaluated configurations, while Figure 1 and Figure 2 illustrate the end-to-end pipelines.

4. Experimental Setup

4.1. Datasets

We evaluate on three diverse network intrusion datasets representing different network environments:

CICIDS-2017 [25]: Created by the Canadian Institute for Cybersecurity, this dataset simulates enterprise network traffic with 15 attack types. We use the attack-only subset with six classes: BFA, BOTNET, DDoS, DoS, Probe, and Web-Attack. Total samples: 557,599.

InSDN/OVS [26]: Generated from a Software-Defined Network environment using Open vSwitch, containing the same six attack categories. This dataset presents extreme class imbalance, BOTNET contains only 164 samples total. Total samples: 138,722.

5G-NIDD [27]: Created from a real 5G testbed at University of Oulu, Finland, containing eight attack types targeting 5G infrastructure. Despite class imbalance, the dataset has well-separated class distributions. Total samples: 738,153.

Table 5. Dataset class distributions.

Dataset	Class	Train	Test	%
CICIDS	BFA	9996	2075	2.48
	BOTNET	1420	295	0.35
	DDoS	92,500	19,204	22.96
	DoS	182,548	37,899	45.32
	Probe	114,826	23,840	28.51
	Web-Attack	1575	327	0.39
OVS	BFA	802	167	0.80
	BOTNET	118	25	0.12
	DDoS	34,978	7262	34.90
	DoS	37,910	7871	37.83
	Probe	26,279	5456	26.22
	Web-Attack	139	29	0.14
5G-NIDD	HTTPFlood	101,737	21,122	19.08
	ICMPFlood †	835	173	0.16
	SYNFlood †	7024	1458	1.32
	SYNScan	14,481	3006	2.72
	SlowrateDoS	52,832	10,969	9.91
	TCPConnectScan	14,488	3008	2.72
	UDPFlood	330,428	68,601	61.96
	UDPScan	11,492	2386	2.15

^† Rare classes.

presents the class distributions for each dataset.

4.2. Ablation Experiments

We conduct systematic ablation studies to isolate the contributions of imbalance handling, loss design, and client-selection strategies. To keep the comparison controlled while avoiding an excessive experimental grid across heterogeneous datasets, we perform the full ablation suite on CICIDS-2017 as the primary benchmark. For InSDN-OVS and 5G-NIDD, we report a reduced ablation set limited to the three most informative configurations: the full pipeline, the Per-Client SMOTE variant, and a centralized baseline. This design tests cross-dataset robustness while avoiding results that are dominated by extreme sparsity or dataset-specific characteristics.

4.2.1. CICIDS-2017 (Full Ablation Suite)

We evaluate seven configurations:

• Exp-1: Full Pipeline (FL + Global SMOTE + Focal Loss)
• Exp-2: FL + Per-Client SMOTE + Focal Loss
• Exp-3: FL + Global SMOTE + CrossEntropy (w/o Focal Loss)
• Exp-4: FL + Global SMOTE + Random Selection (w/o Rare-aware)
• Exp-5: FL + No SMOTE + Focal Loss
• Exp-6: Centralized + Global SMOTE + Focal Loss
• Exp-7: Pure FL (No SMOTE, No Focal Loss)

4.2.2. InSDN-OVS and 5G-NIDD (Reduced Ablations)

We restrict ablations to three representative configurations:

• Exp-1: Full Pipeline (FL + Global SMOTE + Focal Loss)
• Exp-2: FL + Per-Client SMOTE + Focal Loss
• Exp-6: Centralized + Global SMOTE + Focal Loss

4.3. Evaluation Metrics

We report Macro-F1 as the primary metric, as it treats all classes equally regardless of sample size, which is critical for rare-class detection. We also report Accuracy, Weighted-F1, and per-class Precision/Recall/F1. For multi-domain experiments, we additionally report FP/10K (false positives per 10,000 benign samples) to quantify the trade-off between rare-class recall and benign misclassification under strong BENIGN dominance.

4.4. Implementation Details

All experiments are implemented in PyTorch 2.5.1 with seed 42 as default. Main experiments (Per-Client vs. Global SMOTE) were repeated across five seeds (42, 123, 456, 789, 2024) to verify stability. Results tables report seed = 42 values as representative examples; aggregated statistics confirm low variance across runs: CICIDS Per-Client SMOTE achieves $0.980\pm 0.010$ Macro-F1, OVS Per-Client SMOTE achieves $0.914\pm 0.016$, and multi-domain experiments achieve $0.763\pm 0.012$. Client data partitioning remains deterministic (random_state = 42) to isolate model initialization effects. Ablation studies use single-run results (seed = 42). To balance minority class representation without overfitting to synthetic samples, SMOTE is applied with a maximum 10:1 ratio. Batch size is 256 throughout.

4.4.1. Phase 1: Single-Domain Settings

We use 5 FL clients, 15 communication rounds, and 5 local epochs per round, with 3 clients selected per round. Rare attack classes (BFA, Botnet, Web-Attack) are concentrated in two clients (0–1) to ensure sufficient neighborhood density for SMOTE synthesis, while this concentration introduces a potential local distribution bias, it is a necessary trade-off for statistical viability; distributing rare samples (e.g., 1420 Botnet samples in CICIDS) uniformly across five clients would result in a sparse 284 samples per client, making effective k-neighbor interpolation impossible for Per-Client SMOTE.

To ensure a fair and controlled comparison, this identical rare-focused distribution is maintained across all experimental variants, including Global SMOTE. This setup isolates the SMOTE placement (Local vs. Global) as the sole independent variable, preventing performance differences from being skewed by variations in data availability. Each round includes at least one rare-enriched and one common client to ensure balanced gradient updates. Focal Loss $\gamma$ = 3.0 intensifies focus on severe class imbalances. Feature counts: 28 for CICIDS/OVS, 43 for 5G-NIDD.

4.4.2. Phase 2: Multi-Domain Settings

We use 10 clients, 10 rounds, and 2 local epochs with full client participation. Training data from both CICIDS-2017 and InSDN-OVS is merged and redistributed using a shuffled stratified split based on class labels; while this partitioning does not explicitly enforce a fixed domain ratio per client, the random shuffling statistically ensures that samples from both network environments are represented across all clients. This setup is feasible because CAP and ROS (Section 3.5.4) pre-balance the class distribution before partitioning, ensuring that each client receives a representative mix of all classes. Thresholds are optimized on the combined validation set, making them dataset-agnostic rather than domain-specific. We use Focal Loss with $\gamma =1.5$, as the combined data pool partially alleviates the extreme imbalance seen in individual datasets. Furthermore, an AutoEncoder with a 32-dimensional latent space provides compression for the 37-feature input, preventing identity mapping while reducing federated learning communication overhead.

5. Results

5.1. Domain-Specific Results (Phase 1: Attack-Only)

Table 6. Domain-specific results: FL vs. centralized training (attack-only classification).

Dataset	Method	Acc	Macro-F1	W-F1
CICIDS-2017	FL (Per-Client SMOTE)	0.9989	0.9835	0.9989
	FL (Global SMOTE)	0.9973	0.9774	0.9974
	Centralized	0.9726	0.8601	0.9821
InSDN-OVS	FL (Per-Client SMOTE)	0.9916	0.9300	0.9918
	FL (Global SMOTE)	0.9896	0.9153	0.9899
	Centralized	0.9627	0.8005	0.9627
5G-NIDD	Centralized	0.9987	0.9980	0.9987
	FL (Per-Client SMOTE)	0.9977	0.9969	0.9977
	FL (Global SMOTE)	0.9976	0.9962	0.9976

presents the main results across all three datasets in the attack-only classification setting (6–8 classes, BENIGN excluded).

Key Observations: FL with Per-Client SMOTE improves Macro-F1 on CICIDS-2017 (+12.34 pp; +14.35% relative to centralized) and InSDN-OVS (+12.95 pp; +16.18% relative). In contrast, it does not improve 5G-NIDD (−0.11 pp), where centralized training already reaches near-perfect performance in the attack-only setting.

5.2. Ablation Study

Table 7. Ablation study on CICIDS-2017 (attack-only, 6 classes). Δ is relative to the Full Pipeline baseline.

Configuration	Macro-F1	Δ (pp)	Interpretation
Full Pipeline (Global SMOTE + Focal)	0.9774	–	Baseline
w/o SMOTE	0.8068	−17.06	SMOTE is critical
w/o Focal Loss (CE only)	0.9899	+1.25	Focal redundant under SMOTE
w/o Rare-aware Selection	0.9506	−2.68	Rare-aware selection helps
Centralized	0.8601	−11.73	FL crucial on CICIDS
FL (Per-Client SMOTE + Focal)	0.9835	+0.61	Best under Focal setting

presents ablation results on CICIDS-2017, isolating the contribution of each pipeline component.

To complement the aggregate Macro-F1 ablation in Table 7,

Table 8. Rare-class breakdown on CICIDS-2017 (attack-only). Values are per-class F1.

Config	BFA	BOTNET	Web-Attack	Macro-F1
Full (Global SMOTE + Focal)	0.9672	0.9850	0.9161	0.9774
w/o SMOTE	0.9510	0.8284	0.0745	0.8068
w/o Focal (CE only)	0.9942	0.9916	0.9555	0.9899
w/o Rare-aware Selection	–	–	–	0.9506
Centralized	0.8148	0.9692	0.2238	0.8601
FL (Per-Client SMOTE + Focal)	0.9862	0.9949	0.9210	0.9835

reports per-class F1 on representative rare attacks, showing that the overall trends are largely driven by rare-class behavior (especially Web-Attack).

Key Findings:

• SMOTE is critical: Removing SMOTE causes a catastrophic 17.06 pp drop in Macro-F1 (0.9774 → 0.8068; Table 7), with Web-Attack collapsing to 0.0745 F1 and BOTNET dropping to 0.8284 F1 (Table 8).
• Focal Loss can be unnecessary once SMOTE is applied: Replacing Focal Loss with CrossEntropy improves Macro-F1 by 1.25 pp (0.9774 → 0.9899; Table 7), suggesting that after oversampling, additional focusing may be redundant. This is also reflected in rare-class gains (e.g., Web-Attack 0.9161 → 0.9555; Table 8).
• Rare-aware client selection is beneficial in our CICIDS setting: Removing rare-aware selection reduces Macro-F1 by 2.68 pp (0.9774 → 0.9506; Table 7), indicating that ensuring rare-class exposure during training can improve federated stability.
• Per-Client SMOTE is the most effective placement under federated imbalance: It improves the Global-SMOTE baseline by +0.61 pp on CICIDS (0.9774 → 0.9835; Table 7) and yields a larger gain on OVS (+1.47 pp;

  Table 9. SMOTE placement comparison across datasets (Macro-F1).

  Dataset	Global	Per-Client	Δ (pp)	Winner
  CICIDS-2017	0.9774	0.9835	+0.61	Per-Client
  InSDN-OVS	0.9153	0.9300	+1.47	Per-Client
  5G-NIDD	0.9962	0.9969	+0.07	Tie

  ).

5.3. SMOTE Strategy Comparison

Table 9 compares Global and Per-Client SMOTE strategies across datasets.

Per-Client SMOTE matches or slightly outperforms Global SMOTE across datasets, with the magnitude depending on dataset characteristics (Table 9). The gain is modest on CICIDS-2017 (+0.61 pp) and InSDN-OVS (+1.47 pp), whereas 5G-NIDD shows a negligible difference (+0.07 pp), consistent with near-ceiling performance in this attack-only setting. A practical advantage of Per-Client SMOTE is that it increases rare-class exposure within each client, which can support more stable local optimization under non-IID splits.

5.4. Per-Class Analysis

Table 10. Per-class performance on CICIDS-2017 with Per-Client SMOTE (attack-only, 6 classes).

Class	Precision	Recall	F1-Score	Support
BFA	0.993	0.979	0.986	2075
BOTNET	0.990	1.000	0.995	295
DDoS	1.000	1.000	1.000	19,204
DoS	0.999	1.000	1.000	37,899
Probe	1.000	0.999	1.000	23,840
Web-Attack	0.898	0.945	0.921	327
Macro Avg	0.980	0.987	0.984	83,640

reports per-class results on CICIDS-2017 for the FL (Per-Client SMOTE) setting.

Critical Finding

Web-Attack is the most challenging rare class in CICIDS-2017 in this setting, with the lowest F1 among the attack classes in Table 10 (F1 = 0.921). Despite its limited support (327 samples), FL with Per-Client SMOTE maintains strong precision–recall balance, supporting our earlier observation that client-wise oversampling improves rare-class visibility under non-IID splits.

Overall, Per-Client SMOTE strengthens rare-class learning on each client and reduces the extent to which optimization is dominated by major-class gradients during federated training.

5.5. Cross-Domain Transfer

Before developing our multi-domain approach, we evaluated direct cross-domain transfer to quantify the domain gap between datasets.

Cross-domain transfer degrades sharply compared to in-domain performance on the target dataset. Specifically, CICIDS → OVS drops from an OVS in-domain Macro-F1 of 0.9300 to 0.138, i.e., an ≈85.2% relative reduction, while OVS → CICIDS drops from 0.9835 to 0.353, i.e., an ≈64.1% relative reduction (Table 6 and

Table 11. Cross-domain transfer results (model trained on source, tested on target).

Transfer Direction	Accuracy	Macro-F1
CICIDS → OVS	0.342	0.138
OVS → CICIDS (FL Global)	0.689	0.296
OVS → CICIDS (FL Per-Client)	0.712	0.353
OVS → CICIDS (Centralized)	0.689	0.322

). Notably, the gap is asymmetric: CICIDS → OVS yields much lower Macro-F1 (0.138) than OVS → CICIDS (best: 0.353 with Per-Client SMOTE), indicating substantial domain shift. Among the evaluated transfer baselines, FL with Per-Client SMOTE provides the best Macro-F1 (0.353 vs. 0.296 Global and 0.322 Centralized). These results motivate our multi-domain training approach (Phase 2), which jointly learns from both domains and reaches Macro-F1 = 0.774, i.e., a $2.2\times$ improvement over the best direct-transfer Macro-F1.

5.6. Multi-Domain Results (Phase 2: 7-Class with BENIGN)

Table 12. Multi-domain global performance (CICIDS-2017 + InSDN-OVS, 7 classes).

Metric	Value
Accuracy	0.9177
Macro-F1	0.7739
Macro-Precision	0.7581
Macro-Recall	0.8252
FP/10K (BENIGN)	299.2
Gate Threshold (val-tuned)	0.214

reports global multi-domain performance, while

Table 13. Per-class performance on multi-domain test set (CICIDS-2017 + InSDN-OVS, 7 classes).

Class	Precision	Recall	F1-Score	Support
BENIGN	0.988	0.970	0.979	314,473
BFA	0.986	0.874	0.927	1540
BOTNET	0.539	0.615	0.574	317
DDoS	0.987	0.996	0.991	26,465
DoS	0.944	0.939	0.941	36,933
Probe	0.770	0.951	0.851	19,079
Web-Attack	0.093	0.431	0.154	350
Macro Avg	0.758	0.825	0.774	–

details per-class F1 outcomes.

Multi-domain training achieves Macro-F1 = 0.7739, corresponding to a 2.2–5.6× increase in Macro-F1 relative to direct cross-domain transfer baselines (0.138–0.353; Table 11). Major classes (DDoS, DoS, BFA) maintain strong performance (F1 ≥ 0.92), while benign-gated inference controls false alarms, keeping FP/10K at 299.2.

Rare Class Limitations: Web-Attack achieves only F1 = 0.154, and BOTNET reaches F1 = 0.574. We attribute this mainly to extreme class sparsity in the multi-domain training pool, especially for Web-Attack and BOTNET after leakage-safe, nested splitting. InSDN-OVS provides very limited Web-Attack support and comparatively few BOTNET instances, leaving only a small number of effective training examples. As shown in Table 13, the remaining errors are concentrated in rare classes.

Even with conservative Per-Client SMOTE caps, the effective supervision for these rare classes remains limited, which makes reliable cross-domain generalization for these rare classes challenging.

AutoEncoder Ablation in Multi-Domain FL Setting

To quantify the contribution of AutoEncoder pretraining in multi-domain learning, we compare against a Pure MLP baseline with identical Per-Client SMOTE configuration (

Table 14. AutoEncoder ablation in multi-domain setting (CICIDS + OVS, 7 classes).

Method	Macro-F1	Accuracy	FP/10K
AE + Per-Client SMOTE	0.7739	0.9177	299.2
Pure MLP + Per-Client SMOTE	0.7370	0.8974	354.7
Δ	+3.69 pp	+2.03 pp	−55.5

).

AutoEncoder pretraining yields a +3.69 pp Macro-F1 and +2.03 pp Accuracy improvement over an architecture-matched Pure MLP baseline under the same Per-Client SMOTE setting, while reducing FP/10K by 55.5. The largest class-wise gains are observed on BFA (+0.1275 F1) and DoS (+0.0574 F1), suggesting that AE pretraining helps extract more transferable representations to mitigate cross-domain feature mismatch between enterprise and SDN traffic.

While this improvement is statistically significant, the encoder does not dominate overall performance gains. Rather, it acts as a complementary component that enhances cross-domain robustness within the broader hierarchical balancing framework (CAP + ROS + Per-Client SMOTE). The primary performance drivers remain data-level interventions, with the encoder providing an additional layer of domain-invariant feature learning. Web-Attack remains challenging for both variants (≈0.15 F1), indicating that extreme data scarcity likely requires additional data-level or threshold-level interventions beyond architectural enhancements.

5.7. Comparison with State-of-the-Art

In this subsection, we focus on the single-domain setting where both training and test traffic are drawn from CICIDS-2017.

Table 15. Comparison with recent methods on CICIDS-2017 (attack-only or closely related multiclass classification protocols).

Method	Set.	Acc	W-F1	M-F1	Year	Ref.
Centralized Methods
LSTM + FS + SMOTE	Cent.	99.34	–	98.97	2024	[20]
CBF-IDS (CNN-BiLSTM + Focal)	Cent.	99.53	–	99.53	2023	[21]
SMOTE + GMM + CNN (SGM-CNN)	Cent. †	99.85	–	99.86	2020	[28]
ML Oversampling + Feature Embedding	Cent. †	99.99	–	99.99	2024	[29]
Federated Learning Methods
FedSBS	FL (5c)	92.89	–	82.70	2024	[30]
FL-ANN (FedAvg)	FL (4c)	98.15	98.16	–	2023	[5]
Fed-Transformer + XAI	FL	97.04	–	97.00	2025	[13]
Edge-FLGuard	FL (Edge) ‡	–	–	91.00	2025	[31]
Ours (Global SMOTE)	FL (5c)	99.73	99.74	97.74	2025	This work
Ours (Per-Client SMOTE)	FL (5c)	99.89	99.89	98.35	2025	This work

^† Centralized imbalance-oriented baselines (SGM-CNN [28] and ML oversampling + feature embedding [29]) are not strictly limited to CICIDS-2017 attack-only protocols; we report their best multiclass Accuracy and overall F₁ on CICIDS-2017, as Macro vs. Weighted-F₁ is not specified. ^‡ Edge-focused FL anomaly-detection framework evaluated on CICIDS-2017 and TON_IoT using binary normal-vs-anomalous labels; we report the overall F₁ score (0.91) from the federated LSTM configuration [31].

compares our approach with representative recent methods that report multiclass results on CICIDS-2017 under attack-only or closely related protocols. Because many prior works emphasize Accuracy or overall/weighted F₁, and protocols and label spaces can differ, we highlight Macro-F₁ as the most informative metric for rare-attack robustness. Overall, Table 15 suggests that while centralized imbalance-oriented pipelines often report near-saturated performance, results are not always directly comparable; among FL methods, our FedAvg baseline is competitive. Focusing on Macro-F₁, our Per-Client SMOTE variant reaches 98.35 and improves over Global SMOTE (97.74), supporting the claim that oversampling placement matters under non-IID splits.

Our Per-Client SMOTE configuration achieves a Macro-F1 of 98.35%, which is competitive with strong centralized and federated baselines reported on CICIDS-2017 under attack-only or closely related multiclass protocols (Table 15). Moreover, while controlled multi-domain FL-IDS evaluations across heterogeneous datasets (e.g., CICIDS-2017, InSDN-OVS, and 5G-NIDD) remain limited in the literature, our results across the single-domain benchmarks and the multi-domain setting show that client-level imbalance handling can remain effective when moving beyond a single environment.

5.7.1. Context Across OVS and 5G-NIDD

We focus the formal SOTA comparison on CICIDS-2017 because it offers a richer and more standardized multiclass baseline literature. For InSDN-OVS and 5G-NIDD, recent multiclass references are comparatively fewer and often rely on dataset-specific label definitions or preprocessing choices, making strict cross-paper comparisons harder to standardize. Nevertheless, our cross-dataset evidence supports the same central conclusion: federated gains are dataset-dependent and become most pronounced when rare-class supervision is fragmented across clients. In particular, Per-Client SMOTE yields larger marginal gains on the more challenging OVS setting, where client-level scarcity is severe, whereas 5G-NIDD already achieves near-perfect Macro-F1 under centralized training, leaving limited headroom for FL improvements.

5.7.2. Takeaway

Overall, evidence across three datasets suggests that the most reliable gains arise not from increasing model complexity, but from aligning imbalance handling with the federated data granularity, especially under extreme client-level rarity and cross-environment shift.

6. Discussion

6.1. When Does FL Help?

Our results indicate that FL’s benefit is dataset-dependent rather than universal:

• Heterogeneous data with class overlap (CICIDS, OVS): Under our controlled setup, FL yields substantial Macro-F1 gains (Table 6). These improvements are consistent with the setting where (i) attack classes are harder to separate and (ii) rare-class supervision is fragmented across clients, making aggregation and repeated client exposure more beneficial.
• Well-separated data (5G-NIDD): FL provides limited to no benefit in our experiments. When centralized training already achieves near-perfect Macro-F1 (>99%), there is little headroom left for FL to improve, and the added system complexity may not be warranted.

Working hypothesis: Our observations across these three datasets suggest that FL yields more consistent gains when the centralized baseline leaves room for improvement (e.g., <90% Macro-F1), whereas near-saturated baselines offer little headroom for FL to add value.

6.2. Why Per-Client SMOTE Outperforms Global SMOTE

Per-Client SMOTE applies oversampling after client partitioning, so each client synthesizes minority samples from its own local neighborhood structure. We hypothesize that this increases the variety of synthetic patterns observed across clients, potentially acting as an implicit form of data augmentation under FedAvg, though we did not directly measure gradient diversity to confirm this mechanism. By contrast, Global SMOTE creates a single synthetic pool before partitioning; when this pool is later distributed to clients, the resulting minority samples can be more homogeneous across the federation, potentially reducing the benefit of locally tailored balancing.

The advantage is most pronounced when local rare-class support is very limited. In our OVS setting, where some clients receive only tens to low hundreds of rare-class samples, Per-Client SMOTE consistently improves over Global SMOTE (Table 9), supporting the view that client-level balancing is especially important under severe client-level scarcity.

6.3. Why Focal Loss Becomes Less Impactful with SMOTE

Focal Loss reduces the contribution of easy-to-classify samples and increases the emphasis on hard examples. Once SMOTE mitigates imbalance, this additional focusing may provide limited gains. Moreover, it can overweight borderline instances under class overlap or noise, which may be counterproductive.

In our CICIDS-2017 ablation, CrossEntropyLoss outperforms Focal Loss (Table 7), suggesting that data-level balancing (SMOTE) can reduce the need for additional loss-level focusing in multiclass IDSs under severe rare-class imbalance.

Comparison with State-of-the-Art

Under our unified-label and controlled preprocessing setup, our FedAvg pipeline with Per-Client SMOTE reaches $98.35\%$ Macro-F1 on CICIDS-2017. Centralized imbalance-oriented pipelines can report near-saturated results on CICIDS-style protocols (e.g., 99.86–99.99% overall F₁ in [28,29]), but direct comparison is not always strict because many studies report overall/weighted F₁ rather than Macro-F₁. Among federated studies on CICIDS-2017, our Macro-F₁ is substantially higher than FedSBS ($82.70\%$ Macro-F₁ [30]) and is competitive with recent FL baselines that report overall/weighted F₁ (e.g., FL-ANN [5], Fed-Transformer+XAI [13], Edge-FLGuard [31]).

6.4. Practical Guidelines

Based on our results, we summarize the following deployment-oriented guidelines:

• Start from the centralized baseline: If a strong centralized model already achieves near-saturated Macro-F1 (e.g., >95%), FL is unlikely to provide meaningful gains.
• Prefer client-wise balancing under non-IID rarity: Per-Client SMOTE is consistently more effective than Global SMOTE when rare samples are unevenly distributed across clients.
• Re-evaluate the need for specialized losses: Once imbalance is mitigated at the data level (SMOTE), standard CrossEntropyLoss can match or outperform Focal Loss in our ablations.
• Match client participation to rarity patterns: Rare-aware client selection improves stability in our setup by ensuring rare-class exposure in each round, especially under partial participation.
• Choose training approach based on deployment constraints: If maintaining multiple models is feasible, domain-specific training yields the best performance (

  Table 16. Comparison of training approaches (Macro-F1 ranges observed in our experiments).

  Approach	Macro-F1	#Models	Recommendation
  Domain-specific	0.93–1.00	N (per-domain)	Best performance when per-domain models are feasible
  Cross-domain	0.14–0.35	1	Not recommended without adaptation
  Multi-domain	0.72–0.78	1	When a single model is required across environments

  ). When operational constraints require a single model across heterogeneous environments, multi-domain training provides a practical compromise. Direct cross-domain transfer without adaptation is not recommended.

Table 16 summarizes the practical trade-offs observed in our experiments across CICIDS, InSDN-OVS, and 5G-NIDD.

6.5. Limitations

Our study has several limitations. (1) We evaluate a fixed federation size (5–10 clients), and scaling effects may differ. (2) The multi-domain setting combines two datasets; additional domains may introduce further heterogeneity. (3) We focus on detection performance and do not analyze communication efficiency or formal privacy guarantees. (4) Resampling caps and threshold parameters may require recalibration under different traffic mixes and label priors. (5) Our findings are derived from three specific IDS datasets (CICIDS-2017, InSDN-OVS, 5G-NIDD); generalization to other network environments, attack types, or traffic distributions requires further validation.

7. Conclusions

7.1. Empirical Findings

This paper presents a systematic study of federated learning (FL) for network intrusion detection across three datasets and two training paradigms. Through controlled ablations across these settings, we derive several findings that refine common assumptions:

• FL is dataset-dependent: FL improves Macro-F1 on datasets with harder-to-separate classes (CICIDS: +12.34 pp; OVS: +12.95 pp), while offering limited gains on well-separated data (5G-NIDD: −0.11 pp), where centralized training is already very high.
• Per-Client SMOTE is more effective than Global SMOTE: Client-wise oversampling better aligns balancing with the federated data granularity and yields consistent gains (up to +1.47 pp Macro-F1 on InSDN-OVS), especially when rare-class support is fragmented across clients.
• The benefit of Focal Loss diminishes after effective data-level balancing: Once SMOTE mitigates imbalance, the marginal benefit of additional loss-level focusing decreases. In our CICIDS ablation, CrossEntropyLoss outperforms Focal Loss by +1.25 pp Macro-F1.
• Multi-domain learning under a unified label space is feasible but remains constrained by rare-class sparsity: Direct cross-domain transfer between CICIDS-2017 and InSDN-OVS performs poorly (0.13–0.34 Macro-F1), whereas multi-domain FL with AutoEncoder pretraining attains substantially higher performance (0.72–0.78 Macro-F1).

7.2. Practical Recommendations

Based on our findings, we offer the following deployment guidelines:

• Use FL with Per-Client SMOTE for heterogeneous settings with overlapping attack distributions.
• Prefer centralized training when the baseline already achieves near-optimal performance (e.g., >95% Macro-F1) to avoid unnecessary communication and computational overhead.
• Adopt multi-domain training with representation learning and leakage-safe balancing when a single model must operate across multiple network environments.