# Enhancing Federated Intrusion Detection with Class-Specific Dynamic Sampling
## 3 DS-FedIDS
### Experimental Evaluation and Analysis  
In this section, we present a comprehensive evaluation of our proposed approach, comparing DS-FedIDS against the baseline FedPer. The experiments were conducted over ten federated rounds, each involving multiple clients with potentially imbalanced and heterogeneous traffic data. We focus on two primary metrics to illustrate the benefits of the proposed framework:  
1. **Accuracy and Class-Wise Performance:** Measured as the global accuracy across all clients, along with detailed per-class accuracy trends.
2. **Efficiency and Training Overheads:** Captured via the average training time per round and the overall loss trajectory.  
**Overall Accuracy Comparison.** Figure 5 compares the global accuracy per round for FedPer vs. DS-FedIDS, showing that DS-FedIDS consistently achieves higher detection rates, particularly after round 2. As the training progresses, the performance gap indicates that DS-FedIDS effectively personalizes to local data while retaining global attack knowledge.  
**Per-Class Metrics.** To better understand how each approach handles class imbalance and diverse threat categories, we examine the class-level accuracies. Figure 6 shows FedPer performance on 9 classes (skipping Unknown), while Figure 7 shows DS-FedIDS covering classes 0-9. Observe that DS-FedIDS exhibits more stable improvements in minority classes such as Theft (class 8) and Remote to Local (R2L) (class 5), emphasizing the impact of dynamic up/down sampling in retaining rare-attack knowledge.  
**Loss Trajectory and Training Time.** To assess training efficiency, Figure 8 plots the average loss over rounds, while Figure 9 reports the average training time per round. Although DS-FedIDS' dynamic oversampling may initially incur higher loss (see rounds 1-2 in Figure 8), it stabilizes and drops by round 7, aligning with the accuracy gains observed above. Meanwhile, the training-time analysis in Figure 9 indicates that DS-FedIDS can reduce total overhead despite personalization overheads, thanks to pruning and selective sampling strategies that prevent excessive resource consumption in minority or large-class scenarios.  
Figure 5: Global accuracy comparison between FedPer and DS-FedIDS over 10 rounds. DS-FedIDS achieves higher accuracy across most rounds, illustrating the benefit of pruning-based personalization and dynamic sampling.  
Figure 8: Average loss per round for FedPer and DS-FedIDS. DS-FedIDS initially sees a higher loss due to dynamic sampling of minority classes but converges effectively by round 7.  
Figure 6: Class-wise accuracies for FedPer across 10 rounds (class 9 was skipped). Some minority classes show slower improvement.  
Figure 7: Class-wise accuracies for DS-FedIDS across 10 rounds, including Unknown (class 9). Notice improved handling of minority classes such as R2L (#5) and Theft (#8).  
**Client-Specific Comparison.** Finally, Figure 10 illustrates how each model performs on five distinct clients (cdn, iot, database, office, and industrial). DS-FedIDS yields more consistent improvements in edge-based or resource-constrained environments (e.g., iot), wherein personalized pruning and dynamic sampling mitigate the burden of large, skewed datasets.  
Figure 10: Client-specific accuracy trends for five different network environments (cdn, iot, database, office, and industrial). DS-FedIDS demonstrates more stable improvements, particularly in edge scenarios.  
Figure 9: Average training time per round. DS-FedIDS maintains low overhead after initial rounds, illustrating the benefits of network-aware pruning and targeted dynamic sampling.