Evaluation Metrics and Formulas.

Securing distributed network infrastructures has become a major priority in modern cybersecurity, where diverse data sources and increasingly sophisticated attacks challenge the reliability of traditional anomaly detection systems. Centralised and local-only detection models often fail to balance environment-specific accuracy with cross-network generalisation, leading to reduced performance and privacy risks. This study presents AnomLocal, a hybrid anomaly detection framework that combines local learning with global federated aggregation to deliver scalable, privacy-preserving, and adaptive network protection. Each client node independently trains a neural model on its local data and shares only model parameters for aggregation through an enhanced FedAvg mechanism, ensuring global learning without exposing sensitive information. Experimental evaluation on the UNSW-NB15 dataset shows that AnomLocal achieves 93.5% accuracy, 92.8% precision, and 91.5% recall, outperforming both centralised and standalone local models. The framework also reduces detection latency by 25%, supporting real-time operation in large-scale distributed environments. By effectively unifying local sensitivity with global adaptability, AnomLocal provides a robust, interpretable, and efficient solution for next-generation distributed intrusion detection systems.

在现代网络安全领域，保障分布式网络基础设施安全已成为核心要务。当前，多样的数据源与日趋复杂的攻击手段正不断挑战传统异常检测系统的可靠性。集中式与纯本地检测模型往往难以兼顾针对特定环境的检测精度与跨网络泛化能力，进而引发性能下降与隐私安全风险。本研究提出AnomLocal——一种融合本地学习与全局联邦聚合（federated aggregation）的混合式异常检测框架，可提供可扩展、隐私保护且自适应的网络防护能力。每个客户端节点均可基于本地数据独立训练神经网络模型，仅通过增强版联邦平均（FedAvg）机制共享模型参数以完成聚合，确保在不泄露敏感信息的前提下实现全局学习。在UNSW-NB15数据集上开展的实验评估结果显示，AnomLocal的准确率可达93.5%、精确率92.8%、召回率91.5%，性能优于集中式模型与独立本地模型。该框架还可将检测延迟降低25%，能够支撑大规模分布式环境下的实时运行需求。通过有效统一本地感知能力与全局自适应能力，AnomLocal可为下一代分布式入侵检测系统提供一种鲁棒性强、可解释性佳且高效的解决方案。