# Enhancing Federated Intrusion Detection with Class-Specific Dynamic Sampling
## 1 Introduction  
Federated Learning (FL) has gained remarkable traction in recent years as a novel paradigm for distributed machine learning, wherein clients collaboratively train a shared model while keeping their local data undisclosed [1, 2, 3]. By significantly reducing the need to transfer sensitive information across networks, FL addresses fundamental privacy concerns and resource constraints, particularly in security-critical applications such as intrusion detection systems (IDS) [4, 5, 6]. However, despite the potential of FL, major challenges persist, especially in the presence of heterogeneous and non-independent and identically distributed (non-IID) data [7, 8, 9]. In security and cybersecurity contexts, such heterogeneity is accentuated by the diverse nature of network traffic, where each domain--be it a cloud infrastructure, Internet of Things (IoT) environment, or industrial control system--exhibits distinct patterns of normal and malicious activities [10, 11, 12]. This non-uniformity can substantially degrade the performance of a single global model trained via conventional FL, limiting its ability tocapture important local nuances in traffic patterns [13; 14; 15]. To mitigate such deficiencies, personalized FL has emerged as a promising direction by introducing adaptive mechanisms that tailor the model to individual clients' data, while still leveraging global insights from collaborative training [16; 17; 18]. In the domain of network intrusion detection, personalization plays a crucial role in accurately modeling normal traffic profiles while also providing robust detection of novel attack signatures [19; 20; 21]. Traditional centralized IDS frameworks typically collect raw data from all clients in a single repository, which not only poses considerable privacy risks but also introduces significant communication overhead [22]. In contrast, personalized federated approaches allow for heterogeneous environments--such as automotive networks, industrial IoT, and multi-controller software-defined networks--to maintain local traffic data and integrate incremental updates into the shared model [23; 24; 25]. This strategy not only aligns with privacy regulations but also enhances the adaptive learning of attack patterns, allowing the overall system to benefit from a wider range of threat intelligence [26]. Nevertheless, many real-world network intrusion scenarios are afflicted by substantial class imbalance, where benign traffic dominates while certain malicious classes are severely underrepresented [27; 28]. Conversely, certain large-scale attacks--such as distributed denial of service (DDoS)--may be overrepresented in local datasets, potentially overshadowing other minority threats. To address these extremes, we adopt dynamic up/down sampling that oversamples minority classes and downsamples extremely large classes, aiming to reduce the bias introduced by heavily skewed distributions [29]. Such an approach helps ensure that personalized FL pipelines can maintain an effective coverage of rare but critical threats, while simultaneously avoiding computational blowups caused by excessively large classes. Despite substantial progress, existing personalized FL approaches often face challenges in balancing model complexity with the need for adaptive, real-time intrusion detection [30]. Large neural architectures designed for comprehensive feature extraction can incur excessive computational overhead, particularly in edge or resource-limited environments such as IoT devices [31; 32; 33]. Moreover, class imbalance in network security datasets, where benign traffic dominates and rare attack classes are underrepresented, further complicates effective detection. Motivated by these gaps, we propose Dynamic Sampling-FedIDS (DS-FedIDS), a comprehensive framework that enhances personalized FL for intrusion detection by incorporating dynamic up/down sampling.