TL-SMOTE: Re-balancing Data in Federated Learning for Anomaly Detection

Abstract

Due to the significant growth of computing devices, attacks on the network have received increasing consideration. In traditional anomaly detection methods, an agent must collect all data to train the model, potentially leading to data leakage. Thus, the security challenges have encouraged the use of federated learning to address this issue by anomaly detection while improving the efficiency and privacy of the training models. However, in an extensive network, the imbalance of data in the training set for each client and the large volume of data point distribution between classes are significant challenges for training models. Thus, it is necessary to re-balance the training dataset before anomaly tasks. In this paper, we propose a re-balancing scheme for mitigating the impact of imbalanced training data. This work combines k-nearest neighbors with the Tomek link synthetic minority oversampling method. While Tomek Link eliminates a pair of samples from two distinct classes (one majority class and one minority class) that are closest, k-nearest neighbors enrich the minority class by providing artificial examples in the minority class. Tomek link makes advantage of minority class data that k-SMOTE oversampled to obtain more accurate class clusters. Our experiments demonstrate the importance of acknowledging class imbalance.