Abstract:Network intrusion detection system (NIDS) plays a critical role in identifying potential threats. However, existing unsupervised intrusion detection models lack sufficient generalization ability in heterogeneous networks. Furthermore, mainstream federated aggregation methods fail to effectively mitigate the local model weight divergence caused by non-independent and identically distributed (Non-IID) data. To address these issues, this study proposes a generalizable unsupervised NIDS based on federated continual learning, named GenFCLNIDS. First, each client is associated with a data silo and independently deploys an unsupervised detection model, EFC-SDSAE, which combines an energy flow classifier (EFC) with a stacked denoising sparse autoencoder (SDSAE). The EFC enhances inter-traffic distinctions to improve the generalization capability of the SDSAE. The FedSI method is then employed to mitigate the divergence of local model weights caused by Non-IID data, yielding an optimal global model. Finally, a dual-threshold anomaly traffic detection algorithm based on F1-score maximization adaptively determines the detection thresholds for precise detection. Experimental results demonstrate that GenFCLNIDS can accurately detect anomalous traffic in heterogeneous networks. Data privacy of network traffic at each client is effectively protected. Furthermore, the generalization capability in heterogeneous networks is significantly superior to other schemes.