<p>Dataset statistics.</p>

Federated learning (FL) is emerging as a key approach for collaborative machine learning (ML) in distributed information systems where direct data sharing is infeasible due to policy constraints. In security operations center (SOC) settings, we study FL for the classification of network intrusion detection system (IDS) alerts—structured event records emitted by sensors (e.g., Snort/Suricata)—where consistent interpretation of event data is critical for reliable ML-based decision support. However, differences in labeling criteria across organizations often lead to semantic inconsistencies, undermining the accuracy and generalizability of FL models. This paper presents two key contributions that mitigate this issue without requiring raw data exchange. First, we propose Keyed Feature Hashing (KFH), a key-dependent obfuscated encoding scheme that enables consistent vectorization of heterogeneous IDS alerts across entities while reducing the risk of model inversion. Second, we introduce a filtering mechanism that leverages KFH representations to identify and exclude alerts likely to be misclassified due to inter-entity label discrepancies. Experiments using a large-scale real-world dataset collected from 14 organizations demonstrate that our method improves classification F1-score by up to 13.36% while maintaining over 99% alert coverage. These contributions enhance the trustworthiness of FL-based decision models in distributed, label-divergent environments.联邦学习（Federated Learning, FL）正成为分布式信息系统中开展协作式机器学习（Machine Learning, ML）的关键方法，这类场景因政策约束无法直接共享原始数据。在安全运营中心（Security Operations Center, SOC）场景下，本文研究面向网络入侵检测系统（Network Intrusion Detection System, IDS）告警分类的联邦学习方法：IDS告警是传感器（如Snort、Suricata）生成的结构化事件记录，对事件数据的一致性解读，是实现可靠机器学习辅助决策的关键前提。然而，不同组织间的标注准则差异常引发语义不一致问题，进而损害联邦学习模型的准确性与泛化能力。针对该无需交换原始数据即可缓解的问题，本文提出两项核心贡献：其一，提出带密钥特征哈希（Keyed Feature Hashing, KFH），一种基于密钥的混淆编码方案，可实现异构IDS告警在不同参与方间的一致向量化，同时降低模型反演风险；其二，引入一种过滤机制，依托KFH表征识别并排除因参与方标注差异而可能被误分类的告警。使用从14家机构采集的大规模真实数据集开展的实验表明，所提方法可将分类F1分数提升最高达13.36%，同时保持超过99%的告警覆盖率。上述贡献提升了分布式、标注存在分歧环境下基于联邦学习的决策模型的可信度。