A federated learning system for cyber threat detection that combines differential privacy (Opacus DP-SGD) with Byzantine-robust Krum aggregation, so no participating organization ever shares raw network traffic. Classifies multiple attack types from the CICIDS2017 schema (DoS/DDoS, brute force, web attacks, port scans, botnets, infiltration) and includes a live attack simulation lab with a real-time React dashboard over WebSocket.
- Federated averaging via Flower (flwr) — organizations train locally and share only model updates
- Differential privacy with Opacus DP-SGD, bounded to ε ≤ 1.0 against gradient-inversion attacks
- Byzantine-robust Krum aggregation detects and discards poisoned updates from malicious clients
- Live attack simulation lab (DoS, brute force, port scan, SQLi) with a real-time WebSocket dashboard
- 01Each simulated organization trains a local PyTorch model on its own traffic slice using Opacus DP-SGD
- 02Flower (flwr) clients send only model weight updates — never raw data — to the FastAPI FL server
- 03The server's Krum/Multi-Krum aggregator filters outlier (potentially poisoned) updates before aggregating
- 04A live attack-simulation lab generates real DoS/DDoS, brute-force, and port-scan traffic against the target
- 05Training rounds and incidents stream to a React dashboard in real time over WebSocket
Training a shared threat-detection model across simulated organizations without centralizing raw traffic opens the door to gradient-inversion attacks and poisoned client updates. Solved with Opacus DP-SGD to bound privacy leakage and a Krum/Multi-Krum Byzantine-robust aggregator that filters out malicious updates before FedAvg aggregation.
