## 3 Proposed Methodology  
A scalable and reliable framework for multi-label DDoS attack detection in IoT networks is provided via a hybrid architecture of deep learning and federated learning. The innovative ResVGG-SwinNet architecture integrates ResNet, VGGNet, and Swin-Transformer to handle varied Internet of Things (IoT) traffic and ever-changing cyberattack patterns. The dataset is improved and class imbalance is reduced using advanced preprocessing approaches such as Multi-scale Temporal Balancing (MTB) and Adaptive Feature Normalisation (AFN), which in turn makes the framework efficient and adaptive. By reducing communication overhead and enabling decentralised training across several IoT devices, the federated-learning paradigm effectively updates models while safeguarding data privacy. By reducing duplication while maintaining critical data, the Dual Adaptive Selector (DAS) improves the predictive value of features via the application of unique feature optimization algorithms. To further enhance the model's ability to identify multi-label attacks, techniques for feature generation and calibration are used. These algorithms capture intricate relationships and temporal dynamics within the dataset. By centrally updating client-specific models and then aggregating them, federated learning trains the ResVGG-SwinNet architecture to produce a fast, privacy-preserving global model. We integrate all parts to provide adaptability to different IoT settings, low false positive rates, and excellent detection accuracy. These aspects are described in each of the sections that follow. There is a visual representation of the suggested system framework in Figure 1.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Ref.** & **Methodology** & **Key Contributions** & **Challenges Identified** \\ \hline
[20] & Distributed NIDS for STINs using FL & Optimized resource allocation and improved CPU utilization in satellite–terrestrial networks. & Scalability to other IoT applications was unexplored. \\ \hline
[21] & FeDIoT platform with FL and autoencoders & Achieved significant accuracy improvements for anomaly detection in IoT traffic. & Did not address real-time scenarios with dynamic traffic patterns. \\ \hline
[22] & Collaborative FL framework & Preserved data privacy while training IDS across organizations; high classification performance. & Faced challenges in handling heterogeneous data sources. \\ \hline
[23] & FedeX: FL-based explainable anomaly detection & Achieved high detection rates and efficient deployment on edge devices. & Relied on specific datasets, limiting generalizability. \\ \hline
[24] & Federated Sequence Learning (FSL) & Effectively handled data heterogeneity in IIoT while ensuring data security. & Required extensive computational resources for training. \\ \hline
[25] & FedAGRU with attention mechanisms & Improved communication efficiency and accuracy for intrusion detection. & Dependency on specific network configurations restricted broader applicability. \\ \hline
[26] & FLAD (Adaptive FL for new attack profiles) & Rapid convergence and high accuracy for dynamic attack adaptation. & Required substantial computational resources, limiting suitability for resource-constrained devices. \\ \hline
[27] & Decentralized FL-based systems & Emphasized privacy preservation and enhanced detection capabilities. & Did not integrate hybrid optimization algorithms, limiting detection robustness. \\ \hline \hline \end{tabular}
\end{table}
Table 1: Cont.