Cybersecurity is a critical concern for next-generation data centers, where fast and reliable Intrusion Detection Systems (IDS) are essential. While traditional deep learning models deliver strong performance, they often face limitations related to data privacy, latency, and dependence on centralized architectures. Accordingly, we propose FedTran, a novel IDS pipeline that supports collaborative learning by leveraging secure model updates and shared learned representations, while rigorously ensuring privacy preservation and data confidentiality. First, data imbalance is handled using SMOTE–Tomek Links, followed by feature selection through metaheuristic optimization techniques, specifically the Growth Optimizer Algorithm (GOA), Whale Optimization Algorithm (WOA), and Particle Swarm Optimization (PSO). Second, FedTran adopts a kappa-weighted fusion approach to integrate pretrained ResNet50, InceptionV3, and DenseNet121 models within a transfer learning (TL) framework. By mapping tabular features to structured RGB images, the proposed IDS model facilitates hierarchical and spatial feature learning using CNN-based architectures. Third, Federated Averaging (FedAvg) facilitates decentralized, privacy-preserving collaborative training across distributed edge nodes. In this setting, improved generalization and reduced overfitting are achieved through complementary mechanisms, including data distribution handling, regularization techniques, early stopping, and ensemble learning, thereby limiting sensitivity to dataset-specific noise. On the UNSW-NB15 dataset, the proposed method achieves 96.06% accuracy with FedAvg and 99.98% accuracy with the TL model, significantly surpassing the conventional CNN in both predictive accuracy and training efficiency. Furthermore, the integration of a SHAP-based XAI module allows FedTran to maintain high detection accuracy while offering transparent and interpretable insights for effective security decision-making.

The improvement of IoT security solutions is nowadays more current and urgent because of the large masses of vulnerabilities, cyber attacks, data theft, and other threats related to the use of IoT devices. Most IoT datasets are imbalanced, as benign traffic dominates while malicious traffic is scarce. Additionally, IoT traffic is sensitive and rarely available for public research. Generating realistic synthetic data is essential for overcoming these limitations. Our study focuses on Deep Learning models for network intrusion detection by implementing Tabular Generative Adversarial Networks (TGAN) to address class imbalance. GANs help by increasing the proportion of rare malware samples, improving model training and detection accuracy. In this paper, we rely on the UNSW-NB15 and NSL-KDD datasets to address the issue of imbalanced classes. We propose a new approach that we called FS-TGAN, which is based on feature selection methods and TGAN model for samples generating. The time is a crucial parameter for security tools such as IDS and antivirus, where a lot of data must be analyzed to look for malware, anomalies, or anything suspicious that might be trying to penetrate the system. For this purpose, we reduced the number of features to eliminate redundant features or those that are highly correlated. The results show that TGAN performs well. We achieved 99.03% of accuracy with the UNSW-NB15 dataset, demonstrating a significantly reduced error rate by learning to provide new unseen data that share the training set’s statistics, with a detection time of 0.230 ms per traffic set.