Abstract:Federated learning is widely applied in industrial control system intrusion detection, significantly enhancing detection capabilities by integrating high-quality datasets from various systems and collaboratively training high-performance neural network models. However, existing federated learning methods for industrial control systems struggle to balance high performance, low resource consumption, and robust privacy protection. To address this, a dual-server secure serial federated learning (DS-SSFL) approach is proposed for industrial control intrusion detection. The dual-center server coordinates clients for asynchronous serial training, efficiently mining the data features of each client and collaboratively constructing a high-performance intrusion detection model. The approach integrates a decision-differential privacy-preserving mechanism to comprehensively safeguard data privacy and security, while the anti-forgetting aggregation strategy effectively mitigates the catastrophic forgetting issue in serial training. Experimental results show that, compared to traditional federated learning methods, DS-SSFL significantly reduces communication and computational resource overhead, and enhances the model’s robustness and convergence efficiency.