# Enhancing Federated Intrusion Detection with Class-Specific Dynamic Sampling
## 3 DS-FedIDS
### Experimental Results  
Our experimental evaluation, conducted across five distinct network environments, demonstrates the effectiveness of DS-FedIDS in addressing federated intrusion detection challenges. The framework was tested over ten federated rounds, revealing several key achievements:  
* DS-FedIDS consistently outperforms the baseline FedPer in global accuracy, particularly after the initial training rounds, indicating effective personalization and knowledge sharing.
* Dynamic sampling significantly enhances the detection of minority attack classes, such as Theft and R2L attacks, overcoming a common limitation in traditional intrusion detection systems.
* Despite the added complexity of sampling and personalization, DS-FedIDS maintains efficient training overhead, which is particularly beneficial for resource-constrained environments like edge devices.
* Client-specific analysis reveals stable improvements across diverse network types, with notable gains in edge-based scenarios where data distributions vary significantly.
* Exploration of stratified sampling techniques enhances the preservation of traffic distribution characteristics when applying dynamic sampling thresholds.  
The results validate DS-FedIDS's ability to handle real-world network security challenges, where traffic patterns and attack distributions vary dramatically across network domains. The framework's capacity to maintain high detection accuracy while adapting to local characteristics makes it highly valuable for organizations with heterogeneous network environments.  
\begin{table}
\begin{tabular}{l c c c} \hline \hline
**Framework** & **Average Accuracy** & **Avg. Inference Time (s)** & **Total Training Time (s)** \\ \hline FedPer & 0.8787 & 0.1440 & 661.72 \\ PFedMe & 0.5089 & 0.6591 & 2252.51 \\ PerfedAvg & 0.4811 & 0.6870 & 588.85 \\ LG-FedAvg & 0.7941 & 0.5868 & 449.30 \\ DS-FedIDS & 0.9266 & 0.1307 & 20.08 \\ \hline \hline \end{tabular}
\end{table}
Table 5: Comparative results of personalized FL frameworks (single round).  
Given DS-FedIDS's application across heterogeneous devices, we assessed its computational power requirements and energy consumption implications. The dynamic sampling process, with a complexity of \(O(|\mathcal{D}_{k}|\cdot|\mathcal{C}|)\) for calculating \(T_{\text{class}}\) and balancing classes, and local training over 5 epochs (batch size 64), demands moderate computational resources, feasible on our dual-GPU setup (average round time 12 s, Figure 8). However, for resource-constrained devices like IoT nodes, this could strain capacity. Pruning mitigates this by reducing model size (up to 30% compression) and inference FLOPs (25% reduction post-round 5), while sampling could be optimized (e.g., offline pre-computation) for low-power settings.  
Energy consumption varies with computation frequency. In our experiments, training occurred every round (10 rounds), suitable for high-capacity devices like content delivery network servers but potentially excessive for IoT devices. We propose adaptive frequency (e.g., hourly updates for servers, weekly or anomaly)-triggered updates for edge devices--balancing accuracy and energy use. Optimizations, such as lightweight sampling variants (e.g., stratified sampling), could further enhance support for heterogeneous devices.