https://www.mdu.se/

Modern smart grid technology improves system efficiency and reliability, but it also increases the attack surface. This threat to smart grid security creates a need for intrusion detection systems (IDS) to help combat the problems. Centralized machine-learning-based IDS is one solution, but it comes with drawbacks in terms of privacy, scalability, and communication. Federated learning (FL) is an emerging technology that aims to address these limitations and provide better privacy and security for the system. This thesis investigates the communication-accuracy trade-off in network-based intrusion detection systems (NIDS) using federated learning and compares three neural network architectures: CNN, LSTM, and a hybrid architecture, CNN-LSTM. To investigate this, an experiment was conducted in a simulated FL environment with one server and three clients, all using Flower as the FL framework. Each client was trained and evaluated using the Edge-IIoT dataset, with testing at 1, 3, 5, 7, and 10 rounds of federated learning. Network conditions were emulated using tc-netem, introducing packet loss ranging from 1% to 10% during federated learning. Results indicate that the CNN-LSTM architecture had the best communication-accuracy trade-off, showing high accuracy and low communication costs. CNN reached high accuracy quickly, but fluctuations prevented the model from stabilizing. The largest model was LSTM, which also had the highest communication costs but still achieved strong classification performance. Packet loss caused a disproportionately large increase in communication overhead. Findings in this thesis suggest that important factors in FL NIDS include communication cost, convergence, accuracy, and network stability.