Handling Class Imbalance in Federated Learning for Cyber-Physical Attack Detection

Cyber-Physical Systems (CPS) are increasingly targeted by diverse cyberattacks, making intrusion detection a critical requirement. A major barrier in this domain is the imbalance of attack data, where minority classes remain poorly detected, particularly in federated learning environments with non-IID data distribution. This work introduces an imbalance-aware federated framework for CPS intrusion detection, evaluated on the CIC-IDS2017 dataset. Four training strategies were compared: baseline FedProx, focal loss, oversampling, and a combined approach. Although FedProx alone failed to capture minority attacks (0% precision and recall for PortScan), focal loss and oversampling improved detection moderately, achieving F1-scores of 0.48 and 0.62, respectively. The hybrid method delivered the most balanced outcome, reaching 97.7% accuracy with a PortScan precision of 0.78, recall of 0.72, and F1-score of 0.75. These results confirm that combining data-level and loss-level remedies substantially enhances the detection of rare attacks without compromising overall performance, offering a practical pathway for secure and privacy-preserving CPS operations. The proposed framework can be directly extended to industrial control and smart-infrastructure settings, where decentralized nodes must coordinate securely under constrained communication and heterogeneous attack patterns.