SafeNet

• 

• 

• 

• 

• 

• 

• 

Inspiration

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for SafeNet

Inspiration

Modern networks generate huge amounts of traffic, making it difficult to manually identify malicious activity. Existing intrusion detection systems can detect attacks, but they can also struggle with highly imbalanced data, evolving attack patterns, and the need to protect sensitive network data.

We were inspired to build SafeNet, an intelligent network intrusion detection system that uses machine learning and federated learning to identify suspicious network activity while reducing the need to centralize sensitive network data.

What it does

SafeNet analyzes network-flow features and classifies traffic into different categories of normal and malicious activity.

The system:

• Extracts important network-flow features such as protocol information, packet rates, TCP flags, and connection statistics.
• Uses machine learning to classify network traffic into multiple attack categories.
• Uses Federated Learning (FL) to allow multiple clients to train collaboratively without directly sharing their raw network data.
• Evaluates client model updates to identify potentially unreliable or malicious participants.
• Uses trust-related signals such as update similarity, update magnitude, and deviation from other clients.
• Provides performance metrics such as accuracy, precision, recall, F1-score, and classification reports to evaluate the detection system.

Our goal is to make intrusion detection more collaborative and resilient while keeping the underlying network data distributed.

How i built it

i built SafeNet using a combination of machine learning, federated learning, and network-security datasets.

Technology Stack

• Python — core implementation
• Pandas / NumPy — data processing
• Scikit-learn — preprocessing and evaluation
• XGBoost / Neural Networks — intrusion classification
• Flower — federated learning
• CICIoT2023 / related IoT network data — training and evaluation
• Kaggle GPU environment — model experimentation and training

The pipeline follows:

Network Traffic → Feature Extraction → Preprocessing → Local Model Training → Federated Aggregation → Trust Evaluation → Attack Classification

We also experimented with federated aggregation and robust aggregation approaches to investigate how the system behaves when some participating clients provide unreliable updates.

Challenges i ran into

One of our biggest challenges was severe class imbalance in the network dataset. Some attack classes contained hundreds of thousands of samples, while other classes contained only a few hundred samples. This made accuracy alone an unreliable measure of performance.

We also encountered challenges while implementing federated learning, including:

• Handling different attack classes consistently across clients.
• Encoding labels correctly across training, validation, and test datasets.
• Managing large datasets containing millions of network-flow records.
• Preventing minority attack classes from being ignored by the model.
• Designing meaningful trust signals for evaluating federated client updates.
• Managing GPU and resource limitations during large-scale experiments.

These challenges forced us to look beyond a single accuracy number and evaluate the model using macro precision, macro recall, macro F1-score, and per-class performance.

Accomplishments that we're proud of

We successfully developed an end-to-end prototype capable of processing millions of network-flow records and performing multi-class intrusion detection.

We are particularly proud of:

• Building a machine-learning pipeline for large-scale network traffic.
• Supporting multiple attack categories instead of only binary attack/normal classification.
• Implementing a federated learning workflow with multiple clients.
• Exploring trust-based evaluation of federated client updates.
• Comparing conventional and robust aggregation strategies.
• Building an evaluation pipeline using accuracy, precision, recall, F1-score, and confusion matrices.
• Turning a complex cybersecurity research concept into a working prototype that can be demonstrated end-to-end.

What i learned so far

learned that building an intrusion detection system is not simply a matter of achieving high accuracy.

A model can achieve high overall accuracy while performing poorly on rare attack classes because of severe class imbalance. This taught us to examine macro F1-score and class-level metrics instead of relying only on accuracy.

i also learned that federated learning introduces a different set of challenges. Distributed training requires consistent preprocessing, label mappings, model architectures, and aggregation strategies across clients.

Most importantly, we learned that trust in federated learning cannot be assumed. Client updates need to be evaluated because a poorly trained, unreliable, or malicious client can potentially influence the global model.

What's next for SafeNet

Our next goal is to turn SafeNet from a research prototype into a more practical network-security platform.

Future improvements include:

• Real-time network traffic monitoring.
• Automated attack alerts and notifications.
• More robust detection of previously unseen attacks.
• Improved handling of highly imbalanced attack classes.
• More advanced Byzantine-robust federated aggregation.
• A dashboard for visualizing attacks, clients, and trust scores.
• Deployment across real distributed IoT or organizational networks.
• Continuous model improvement as new attack patterns emerge.

Ultimately, we want SafeNet to demonstrate that network intelligence can be collaborative without requiring every participant to centralize its raw network data.

Built With

• machine-learning
• numpy
• pandas
• python
• xgboost