Evolutionary Replay-Driven Federated Class-Incremental Learning for Cyber-attack Detection

With the continuous evolution of cyber-attack patterns and strategies, the task of detecting cyber-attacks in real-time has become increasingly critical. However, existing replay-based class-incremental learning methods face two fundamental challenges: a relying on continuous sample aggregation may raise concern about privacy data leakage, and b lacking careful consideration of evolving cyber-attacks, leading to insufficient detection capabilities for attack variants. In this paper, we propose an evolutionary replay-driven federated class-incremental learning for cyber-attack detection, which effectively enhances the detection of variants in incremental learning tasks while protecting data privacy. Specifically, at task T, each local client trains a classification model and stores prototypical features ‘genes’ for each class, accompanied by a category-specific convolutional autoencoder CAE model. Under privacy-preserving mechanisms, a global network attack detection model is trained via federated learning, with subsequent updates propagated to local client models. At task T_1, old knowledge genes are generated from the stored prototypical sample library using a gene evolution strategy and the pre-trained CAE model. These generated features are integrated with new data for model update. Finally, the detection model is updated again through the federated learning mechanism. Extensive experiments conducted on authoritative datasets demonstrate the effectiveness of our proposed method. Experimental results show that our method achieves 90.16 accuracy in Task 2 and 85.90 accuracy in Task 3. Notably, in Task 3, our method outperforms the random replay method by 4.66 , the GAN-based replay method by 6.91 , and the VAE-based replay method by 22.32 . Code available: https: github.com sjy722 Evolutionary-Replay-Driven-FCIL