MT-FBERT: Malicious Traffic Detection Based on Efficient Federated Learning of BERT
Open accessAbstract
The rising frequency of network intrusions has significantly impacted critical infrastructures, leading to an increased focus on the detection of malicious network traffic in recent years. However, traditional port-based and classical machine learning-based malicious network traffic detection methods suffer from a dependence on expert experience and limited generalizability. In this paper, we propose a malicious traffic detection method based on an efficient federated learning framework of Bidirectional Encoder Representations from Transformers (BERT), called MT-FBERT. It offers two major advantages over most existing approaches. First, MT-FBERT pretrains BERT using two pre-training tasks along with an overall pre-training loss on large-scale unlabeled network traffic, allowing the model to automatically learn generalized traffic representations, which do not require human experience to extract the behavior features or label the malicious samples. Second, MT-FBERT finetunes BERT for malicious network traffic detection through an efficient federated learning framework, which both protects the data privacy of critical infrastructures and reduces resource consumption by dynamically identifying and updating only the most significant neurons in the global model. Evaluation experiments on public datasets demonstrated that MT-FBERT outperforms state-of-the-art baselines in malicious network traffic detection.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Detectors that achieve >99% accuracy on a single dataset routinely lose 10-20 percentage points when transferred cross-dataset.
“detectors that achieve >99% accuracy on a single dataset routinely lose 10-20 percentage points when transferred cross-dataset”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [65]
Federated learning and differential privacy provide orthogonal building blocks, but their integration into agentic systems is immature.
“Federated learning [57,65,66] and differential privacy provide the orthogonal building blocks, but their integration into agentic systems is immature.”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [65]
Cites
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215 · see citing works
ALBERT: A Lite BERT for Self-supervised Learning of Language Representations
Lan, Z., Chen, M., Goodman, S., Gimpel, K., Sharma, P., & Soricut, R. (2019) · arXiv · doi:10.48550/arxiv.1909.11942 · Cited by 4,308 · see citing works
Learning Structured Sparsity in Deep Neural NetworksPreprint
Wen, W. X., Wu, C., Wang, Y., Chen, Y., & Li, H. H. (2016) · arXiv (Cornell University) · doi:10.48550/arxiv.1608.03665 · Cited by 1,861 · see citing works
CICIoT2023: A Real-Time Dataset and Benchmark for Large-Scale Attacks in IoT Environment
Neto, E. C. P., Dadkhah, S., Ferreira, R., Zohourian, A., Lu, R., & Ghorbani, A. A. (2023) · Sensors · doi:10.3390/s23135941 · Cited by 1,368 · see citing works
Deep packet: a novel approach for encrypted traffic classification using deep learning
Lotfollahi, M., Jafari Siavoshani, M., Shirali Hossein Zade, R., & Saberian, M. (2020) · Soft Computing · doi:10.1007/s00500-019-04030-2 · Cited by 1,190 · see citing works
Malware traffic classification using convolutional neural network for representation learning
Wang, W., Zhu, M., Zeng, X., Ye, X., & Sheng, Y. (2017) · 2017 International Conference on Information Networking (ICOIN) · doi:10.1109/icoin.2017.7899588 · Cited by 1,177 · see citing works
End-to-end encrypted traffic classification with one-dimensional convolution neural networks
Wang, W., Zhu, M., Wang, J., Zeng, X., & Yang, Z. (2017) · 2017 IEEE International Conference on Intelligence and Security Informatics (ISI) · doi:10.1109/isi.2017.8004872 · Cited by 991 · see citing works
Semi-supervised sequence tagging with bidirectional language models
Peters, M., Ammar, W., Bhagavatula, C., & Power, R. (2017) · Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) · doi:10.18653/v1/p17-1161 · Cited by 655 · see citing works
Website Fingerprinting at Internet Scale
Panchenko, A., Lanze, F., Zinnen, A., Henze, M., Pennekamp, J., Wehrle, K., & Engel, T. (2016) · Proceedings 2016 Network and Distributed System Security Symposium · doi:10.14722/ndss.2016.23477 · Cited by 645 · see citing works
Chen, T. M., & Abu-Nimeh, S. (2011) · Computer · doi:10.1109/mc.2011.115 · Cited by 398 · see citing works
Lashkari, A. H., Kadir, A. F. A., Taheri, L., & Ghorbani, A. A. (2018) · IEEE International Carnahan Conference on Security Technology (ICCST) · doi:10.1109/ccst.2018.8585560 · Cited by 391 · see citing works
FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic
van Ede, T., Bortolameotti, R., Continella, A., Ren, J., Dubois, D. J., Lindorfer, M., Choffnes, D., van Steen, M., & Peter, A. (2020) · Proceedings 2020 Network and Distributed System Security Symposium · doi:10.14722/ndss.2020.24412 · Cited by 339 · see citing works
Industrial Control Systems: Cyberattack trends and countermeasures
Alladi, T., Chamola, V., & Zeadally, S. (2020) · Computer Communications · doi:10.1016/j.comcom.2020.03.007 · Cited by 268 · see citing works
Lin, K., Xu, X., & Gao, H. (2021) · Computer Networks · doi:10.1016/j.comnet.2021.107974 · Cited by 226 · see citing works
Towards the Development of a Realistic Multidimensional IoT Profiling Dataset
Dadkhah, S., Mahdikhani, H., Danso, P. K., Zohourian, A., Truong, K. A., & Ghorbani, A. A. (2022) · Conference on Privacy, Security and Trust · doi:10.1109/pst55820.2022.9851966 · Cited by 225 · see citing works
Zhao, R.-J., Zhan, M.-W., Deng, X.-W., Wang, Y., Wang, Y.-J., Gui, G., & Xue, Z. (2023) · AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v37i4.25674 · Cited by 212 · see citing works
Markov chain fingerprinting to classify encrypted traffic
Korczyński, M., & Duda, A. (2014) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom.2014.6848005 · Cited by 196 · see citing works
Hadžiosmanović, D., Sommer, R., Zambon, E., & Hartel, P. (2014) · Annual Computer Security Applications Conference · doi:10.1145/2664243.2664277 · Cited by 190 · see citing works
McPherson, J., Ma, K., Krystosk, P., Bartoletti, T., & Christensen, M. (2004) · IEEE Symposium on Visualization for Cyber Security (VIZSEC) · doi:10.1145/1029208.1029220 · Cited by 186 · see citing works
Zhang, H., Yu, L., Xiao, X., Li, Q., Mercaldo, F., Luo, X.-P., & Liu, Q.-X. (2023) · The Web Conference · doi:10.1145/3543507.3583227 · Cited by 183 · see citing works
Autonomous Unknown-Application Filtering and Labeling for DL-based Traffic Classifier Update
Zhang, J., Li, F., Ye, F., & Wu, H. (2020) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom41043.2020.9155292 · Cited by 137 · see citing works
Netmamba: Efficient Network Traffic Classification Via Pre-Training Unidirectional Mamba
Wang, T., Xie, X., Wang, W., Wang, C., Zhao, Y., & Cui, Y. (2024) · IEEE International Conference on Network Protocols (ICNP) · doi:10.1109/icnp61940.2024.10858569 · Cited by 115 · see citing works
Aoudi, W., Iturbe, M., & Almgren, M. (2018) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3243734.3243781 · Cited by 110 · see citing works
Feature analysis of encrypted malicious traffic
Shekhawat, A. S., Troia, F. D., & Stamp, M. (2019) · Expert Systems with Applications · doi:10.1016/j.eswa.2019.01.064 · Cited by 107 · see citing works
Zhou, X., Huang, W., Liang, W. Y., Yan, Z., Ma, J., Pan, Y., & Wang, K. I. (2024) · Information Sciences · doi:10.1016/j.ins.2024.120217 · Cited by 104 · see citing works
Zhang, Z., Yang, Y., Dai, Y., Wang, Q., Yu, Y., Qu, L., & Xu, Z. (2023) · Findings of the Association for Computational Linguistics: ACL (Findings of ACL) · doi:10.18653/v1/2023.findings-acl.632 · Cited by 103 · see citing works
On Ladder Logic Bombs in Industrial Control Systems
Govil, N., Agrawal, A., & Tippenhauer, N. O. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-72817-9_8 · Cited by 90 · see citing works
Digital Twin-based Intrusion Detection for Industrial Control Systems
Varghese, S. A., Dehlaghi Ghadim, A., Balador, A., Alimadadi, Z., & Papadimitratos, P. (2022) · 2022 IEEE International Conference on Pervasive Computing and Communications Workshops and other Affiliated Events (PerCom Workshops) · doi:10.1109/percomworkshops53856.2022.9767492 · Cited by 85 · see citing works
Hang, Z., Lu, Y.-L., Wang, Y., & Xie, Y. (2023) · International Symposium on Recent Advances in Intrusion Detection · doi:10.1145/3607199.3607206 · Cited by 66 · see citing works
Abbasi, A., & Hashemi, M. (2016) · University of Twente Research Information · Cited by 60 · see citing works
Intrusion Detection in Digital Twins for Industrial Control Systems
Akbarian, F., Fitzgerald, E., & Kihl, M. (2020) · 2020 International Conference on Software, Telecommunications and Computer Networks (SoftCOM) · doi:10.23919/softcom50211.2020.9238162 · Cited by 58 · see citing works
Edge Device Identification Based on Federated Learning and Network Traffic Feature Engineering
He, Z., Yin, J., Wang, Y., Gui, G., Adebisi, B., Ohtsuki, T. O., Gacanin, H., & Sari, H. (2021) · IEEE Transactions on Cognitive Communications and Networking · doi:10.1109/tccn.2021.3101239 · Cited by 57 · see citing works
Ning, J., Poh, G. S., Loh, J.-C., Chia, J., & Chang, E. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3354204 · Cited by 55 · see citing works
Internet Traffic Classification with Federated Learning
Mun, H., & Lee, Y. (2020) · Electronics · doi:10.3390/electronics10010027 · Cited by 52 · see citing works
Towards Detection of Zero-Day Botnet Attack in IoT Networks Using Federated Learning
Zhang, J., Liang, S., Ye, F., Hu, R. Q., & Qian, Y. (2023) · International Conference on Communications · doi:10.1109/icc45041.2023.10279423 · Cited by 34 · see citing works
Ahmed, S. T., Kumar, V. V., Mahesh, T. R., Prasad, L. V. N., Velmurugan, A., Muthukumaran, V., & Niveditha, V. R. (2024) · Soft Computing · doi:10.1007/s00500-023-09542-6 · Cited by 31 · see citing works
Majeed, U., Khan, L. U., & Hong, C. S. (2020) · Asia-Pacific Network Operations and Management Symposium (APNOMS) · doi:10.23919/apnoms50412.2020.9236971 · Cited by 30 · see citing works
Guo, Y.-Y., & Wang, D. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3204975 · Cited by 27 · see citing works
isAnon: Flow-Based Anonymity Network Traffic Identification Using Extreme Gradient Boosting
Cai, Z., Jiang, B., Lü, Z., Liu, J., & Ma, P. (2019) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn.2019.8851964 · Cited by 24 · see citing works
Federated Split BERT for Heterogeneous Text Classification
Lit, Z., Sit, S., Wang, J., & Xiao, J. Z. (2022) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn55064.2022.9892845 · Cited by 20 · see citing works
Zhai, D. (2024) · Asia Pacific Law Review · doi:10.1080/10192557.2024.2417949 · Cited by 16 · see citing works
Xu, W., Wang, S., & Zuo, X. (2024) · Computer law & security review · doi:10.1016/j.clsr.2024.106061 · Cited by 15 · see citing works
Not all parameters are born equal: Attention is mostly what you need
Bogoychev, N. (2021) · BlackboxNLP Workshop on Analyzing and Interpreting Neural Networks for NLP (BlackboxNLP) · doi:10.18653/v1/2021.blackboxnlp-1.28 · Cited by 7 · see citing works
BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding
Devlin, J., Chang, M.-W., Lee, K., & Toutanova, K. (2018) · arXiv · doi:10.48550/arxiv.1810.04805
Flagged first, then by citations
Cited by
Sorted by citations
Sezgin, A., Ulaş, M., & Boyacı, A. (2025) · Sensors · doi:10.3390/s25196099 · Cited by 10 · see citing works
Nageshwaran, V., & Ezekiel, S. (2026) · Electronics · doi:10.3390/electronics15122740 · Cited by 4 · see citing works
“Increasingly, researchers have turned to graph neural networks (GNNs) that exploit the topological structure of IoT traffic [59–64] and to federated learning that allows distributed devices to train shared anomaly detectors without exposing raw data [57,65,66].”
InfluentialLiang, W., Xiong, Z., Cai, L., & Xu, J. (2026) · Concurrency and Computation Practice and Experience · doi:10.1002/cpe.70798 · Cited by 2 · see citing works
Alenazi, M. M., & Alhazmi, A. S. (2025) · Research Square · doi:10.21203/rs.3.rs-7873990/v1
Federated Large Language Models for Distributed Cyber Attack Classification
Abbas, S., & Sultana, A. (2026) · International Conference on Artificial Intelligence, Systems, and Emerging Technologies (ICAISET) · doi:10.1109/icaiset66439.2026.11541717
Su, J. (2026) · International Conference on Distributed Computing and Electrical Circuits and Electronics (ICDCECE) · doi:10.1109/icdcece68961.2026.11645875
- Authors
- Tang, J., Huang, Z., & Li, C.
- Affiliations
- China International Water & Electric Corp., Beijing 101116, China
- Beijing Information Science & Technology University (CN)
- Corresponding author
- Tang, Jian
- Venue
- Future Internet
- Publisher
- MDPI AG
- Published
- 2025-07-23
- Volume
- 17
- Issue
- 8
- Pages
- 323
- ISSN
- 1999-5903 (ISSN-L)
- OpenAlex
- W4412616751
- Cited by
- 6
- References
- 44
- Citations by year
- 2026: 4 · 2025: 2
- FWCI
- 2.54
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- Future Internet (publishedVersion, cc-by)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Funders
- Basic Research Program of Yunnan Provincial Science and Technology Department, China (202501AS070131)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- malicious traffic detection, federated learning, BERT, pre-training, critical infrastructure security, data privacy, network intrusion detection
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
