## 4 Experiments, Results, and Discussion
### Performance Evaluation
#### 4.4.2 Intrusion Detection using Federated Method

Table 3: Settings for the ML classifiers used in the proposed solution. As shown in Figure 4, we have displayed the learning process vs. accuracy graph for both centralized and FL techniques. The gap between the centralized approach (both CNN and RNN) and the FL method is rather substantial at the beginning. However, the margin shrinks as we move on to higher rounds, and by the 50 th round, the results are quite competitive. This demonstrates that our proposed FL-method performs quite well in comparison to the centralized ML approaches and has further advantages that we will cover in the next sections. Figure 5, which plots the true positive rate of intrusion detection versus the likelihood of a false positive, shows the Receiver Operating Characteristic (ROC) curve for the Edge-IIoTset dataset. Equations (10) and (11) represent the True Positive Rate and False Positive Rate, which can also be termed the Detection Rate and False Alarm Rate, respectively [32]. Given that all of the AUC (Area Under Curve) values fall between 0.91 and 0.95, we recognize that the performance of both ML approaches using our proposed FL method was quite satisfactory. \begin{table}
\begin{tabular}{c c c c c c c c c c c c c c} \hline \hline \multirow{3}{*}{**Classifier**} & \multirow{3}{*}{**Clients**} & \multicolumn{6}{c}{**1 st Round**} & \multicolumn{6}{c}{**50 th Round**} \\ \cline{3-14}  & & \multicolumn{2}{c}{**IID**} & \multicolumn{2}{c}{**Non-IID**} & \multicolumn{2}{c}{**IID**} & \multicolumn{2}{c}{**Non-IID**} \\ \cline{3-14}  & & **B** & **W** & **G** & **B** & **W** & **G** & **B** & **W** & **G** & **B** & **W** & **G** \\ \hline \multirow{3}{*}{CNN} & \(K=3\) & **63.23** & 52.84 & 62.19 & **59.89** & 23.48 & 52.34 & **91.34** & 90.62 & 91.27 & 89.76 & 34.02 & 90.58 \\  & \(K=9\) & 56.71 & 55.23 & 57.34 & 54.32 & 17.45 & 54.31 & 91.30 & 90.18 & 91.13 & 90.19 & 58.23 & **90.73** \\  & \(K=15\) & 56.51 & 57.23 & 57.78 & 57.92 & 16.74 & 54.32 & 90.77 & 89.65 & 90.56 & 90.12 & 57.49 & 90.18 \\  & \(K=3\) & **61.67** & 54.87 & 61.28 & **60.21** & 24.64 & 53.37 & **92.49** & 92.08 & 92.37 & 91.26 & 72.98 & **91.87** \\  & \(K=9\) & 58.43 & 53.67 & 56.84 & 53.68 & 19.42 & 55.79 & 92.41 & 92.01 & 92.28 & 91.13 & 69.37 & 91.53 \\  & \(K=15\) & 59.65 & 52.69 & 58.92 & 57.97 & 17.16 & 54.72 & 92.19 & 91.98 & 92.02 & 91.06 & 74.71 & 91.07 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Evaluation of the FL Model in Intrusion Detection. Figure 4: Learning vs. accuracy of centralized and FL. Figure 6 represents the training time of our proposed FL method after 50 FL rounds. We have demonstrated the time consumption for different numbers of FL clients (3, 9, and 15) for two different data distribution types (IID and Non-IID). As can be seen from the figure, the training time increases as the number of clients increases. It is evident from the figure that the training process is faster for the CNN method in comparison to RNN method. Additionally, it can be noticed that the different types of data distribution have no real significant impact on the time consumption, although in Non-IID cases, the time is slightly on the higher side. So, we can conclude that the training time for our proposed method varies depending only on the ML method and the number of clients used.