# CGFL: A Robust Federated Learning Approach for Intrusion Detection Systems Based on Data Generation
## 3 Methods
### Label Noise Correction Module  
The label noise correction module utilizes the differences in distribution between normal and malicious traffic to adjust incorrect labels within a low-quality training dataset. Typically, normal traffic exhibits a denser distribution, whereas malicious traffic tends to be more sparse. In this section, the overall distribution of the low-quality training dataset is analyzed to pinpoint the regions with the highest and lowest data densities. Denseregions usually indicate that the features of training samples are tightly clustered, reflecting characteristic patterns of normal traffic. In contrast, sparse regions may contain noisy or mislabeled samples. This methodology enables the identification of label noise and anomalous data, offering valuable insights for refining labels in subsequent steps. The flowchart of the label correction module is shown in Figure 3.  
This study incorporates a label noise correction module tailored to the traffic's distribution characteristics. Initially, the module uses the Latent Diffusion Energy-Based Model (LDEBM) [46], an efficient autoregressive generative model, to estimate the underlying data distribution. LDEBM combines diffusion models with energy-based models, where the forward diffusion process incrementally introduces noise to convert the data into pure noise, and the reverse denoising process sequentially reconstructs the original data. Let \(X\) represent the input dataset for LDEBM, and let \(\mathbf{x}=(x_{1},x_{2},\ldots,x_{d})\in\mathbb{R}^{d}\) denote a sample drawn from the dataset. The joint probability distribution of \(\mathbf{x}\) is represented as follows:  
\[p_{\alpha}(z_{t}\mid z_{t+1})=\mathcal{N}(z_{t};\mu_{\theta}(z_{t+1},t),\sigma _{t}^{2}I), \tag{2}\]  
where \(\mu_{\theta}(z_{t+1},t)\) is the mean predicted by the model, \(\sigma_{t}^{2}\) is the fixed variance, and \(I\) is the identity matrix. LDEBM captures the probability density function of \(X\) by employing stochastic gradient descent to maximize the likelihood of individual samples. The probability density of a given sample indicates its relative position within the data distribution, such as whether it resides in densely populated or sparsely populated regions. This positional information is vital for accurately inferring the true labels of the samples. The initial low-quality training set, \(\bar{D}_{\text{train}}\), is filtered to exclude a subset of samples with normal labels, referred to as \(\bar{w}_{\text{train}}\). This filtered dataset, \(\bar{w}_{\text{train}}\), serves as the input for LDEBM. This approach ensures that LDEBM does not assign high-density values to genuinely malicious data, as \(\bar{w}_{\text{train}}\) generally includes fewer malicious samples compared to \(\bar{D}_{\text{train}}\). Additionally, this method amplifies the distributional differences between truly normal and malicious data. The following steps are then carried out to relabel certain samples based on their probability density values in \(\bar{D}_{\text{train}}\). The process begins with _High-Density Sample Selection_, where a subset \(\bar{H}_{\text{train}}\) is extracted from \(\bar{D}_{\text{train}}\), comprising samples with high probability density values. The size of \(\bar{H}_{\text{train}}\) is determined as \(\alpha\cdot|\bar{D}_{\text{train}}|\), with \(\alpha\) being a predefined parameter within the interval \((0,1)\). Subsequently, _Euclidean Distance Calculation_ is performed for each sample within \(\bar{H}_{\text{train}}\) to compute the average Euclidean distance to other samples. Samples exhibiting the smallest distances are categorized into a group denoted as \(N_{s}\), signifying high-confidence normal training data due to their similarity and dense distribution. Following this, _Sparse Region Identification_ is carried out for every sample in \(\bar{D}_{\text{train}}-N_{s}\) by calculating the average Euclidean distance to all samples within \(N_{s}\). A subset of samples, labeled \(M_{s}\), which exhibit greater distances, is selected.