## 4 Intrusion Detection Systems Based on Federated Learning
### Comparative Analysis of Federated-Learning-Based Intrusion Detection Systems
#### 4.1.1 The Federated Learning-Based Intrusion Detection Systems for Smart Home Settings
The results obtained for mini-batch avg were very close to the centralized ones. Multi-epoch avg showed an insignificant decrease in the accuracy on known devices and an accuracy exceeding the centralized one on the new device. For the unsupervised methods, the experiments showed that centralizing the data gives higher performance than the naive method, while the multi-epoch avg and the mini-batch avg methods demonstrate the results close to the centralized one. The authors also considered the data poisoning attacks and their impact on the model performance and demonstrated that it is reduced substantially. _Used metrics_:  
* True positive rate, which is calculated as ratio of true positives to the (true positives + false negatives);
* True negative rate, which is calculated as ratio of true negatives to the (true negatives + false positives);
* Accuracy, which is calculated as ratio of (true positives + true negatives) to the (true positives + false positives + false negatives + true negatives);
* F1-score, which is calculated as ratio of true positives to the (true positives + 1/2 of (false positives + false negatives)). _Advantages_:  
* Implemented (code is available at [69]);
* The N-BaIoT dataset was used for the experiments;
* Preserves the security and privacy of the model;
* Obtained results for FL methods are close to the results obtained using centralized models while preserving the privacy;
* The malware threats are considered;
* The cyberthreats against federated learning framework are considered;* Different data partitions are investigated. _Limitations_: performance is reduced substantially in case of data poisoning attacks; scalability is not considered due to the dataset limitations. **FL-based edge cloud architecture for attack detection**[23]. In [23], the authors propose an edge cloud architecture for attack detection. _Federated learning architecture_. The authors implement hierarchical architecture in the cloud. The proposed architecture incorporates the following layers: data perception layer (IoT devices with sensors); edge layer (IoT gateways responsible for normalizing the data and containing Lockedge module); network layer (secures data transfer); data management layer (the cloud that is responsible for deciding the number of neurons per layer and the weights of the neural network algorithm); application layer (applications management); business layer (IoT applications and services management). Thus, the detection module is implemented at the edge in the IoT system. _ML methods_. Lockedge (Low-Complexity Cyberattack Detection in IoT Edge Computing) based on traditional neural network (NN) that performs multi-class classification to detect different types of attacks. The authors used the principal components analysis (PCA) method to extract the most important features. For the neural network model, the authors chose the ReLU as activation function in hidden layers and softmax activation function for the multi-class classification problem. _Implementation_. The authors implemented their solution both in centralized and federated learning mode. In the federated learning mode, the edge nodes implement detection and training. They send weights to the cloud to update the global training model. Thus, the workload of the central cloud is reduced. The authors used a Raspberry Pi 3B+ to implement the edge gateway (1.4 GHz ARM-based quad-core processor with 400% CPU usage at maximum and 1 GB RAM) with installed Raspberry Pi OS. They used the Python 3 programming language to implement the detection solution. _Dataset_. The authors used the BoT-IoT dataset [70] (5% extracted from the original dataset). The dataset is generated considering the following IoT devices: a weather station, a smart fridge, remotely activated motion activated lights, and a smart thermostat. It includes the following types of attacks: DDoS (HTTP, TCP, UDP), DoS (HTTP, TCP, UDP), OS fingerprinting, server scanning, keylogging, and data exfiltration attacks.