# Robust Federated Learning for Mitigating Advanced Persistent Threats in Cyber-Physical Systems
## 3 Methodology
\begin{cases}(1-\gamma)(T-X)&\text{if }X\leq T\\ \gamma(X-T)&\text{otherwise}\end{cases}  \tag{4}\]  
The targeted quantile is selected based on the expected risk of adversaries in the system. Similar to most anomaly detection-based defense mechanisms in federated learning, adjusting this parameter involves a trade-off between security and performance. For large values of \(\gamma\), gradients are aggressively clipped, which results in highly secure aggregation. Conversely, choosing small values of \(\gamma\) results in a more accurate model with a higher risk of being compromised. Figure 1: Block diagram of the APT detection framework. Algorithms 1 and 2 are used for robust aggregation and client updates, respectively. ```
Input: Local weights \(W_{k}^{t}\), local thresholds \(T_{k}^{t}\) Output: Aggregated weights \(\bar{W}^{t+1}\), averaged threshold \(\bar{T}^{t+1}\)
1 for each time step \(t\)do
2 fore each node \(k\), \(1\leq k\leq N\)do
3\(\Delta_{k}^{t}\), \(T_{k}^{t}\leftarrow\text{ClientUpdate}(\bar{W}^{t},\bar{T}^{t})\)
4 endfor
5\(\bar{T}^{t+1}=\frac{1}{N}\sum_{k=1}^{N}T_{k}^{t}\)for\(\forall W_{k}^{t}\), \(1\leq k\leq N\)do
6\(\hat{\Delta}_{k}^{t}=\text{Clip}(\Delta_{k}^{t},\bar{T}^{t+1})\)
7 endfor
8\(\bar{\Delta}^{t}=\text{FedAvg}(\{\hat{\Delta}_{k}^{t}\}_{k=1}^{N})\)
9\(\bar{W}^{t+1}=\bar{W}^{t}+\eta_{a}\bar{\Delta}^{t}\)
10 endfor
```  
**Algorithm 2**Client Update  
```
Input: Global weights \(\bar{W}^{t}\), global threshold \(\bar{T}^{t}\), dataset \(D_{k}^{t}\), learning rate \(\eta\), threshold learning rate \(\eta_{T}\) Output: Local weights \(W_{k}^{t}\), local threshold \(T_{k}^{t}\)
1\(W_{k}^{t}\leftarrow\bar{W}^{t}\)
2\(T_{k}^{t}=\bar{T}^{t}\)
3 for batch \(b\in X\)do
4\(W_{k}^{t}\gets W_{k}^{t}-\eta\
abla J(W_{k}^{t},b)\)
5 endfor
6\(\Delta_{k}^{t}\gets W_{k}^{t}-\bar{W}^{t}\)
7\(\Delta_{k}^{t}\leftarrow\Delta_{k}^{t}\cdot\min\left(1,\frac{T_{k}^{t}}{\|\Delta \|}\right)\)
8 Calculate \(T_{k}^{t+1}\) using \(T_{k}^{t}\), \(\eta_{T}\), and (7) return\(\Delta_{k}^{t}\) and \(T_{k}^{t+1}\)
```  
**Algorithm 3**Client Update  
Aiming to find an update rule that leads to the optimal \(T\) for a specified value of \(\gamma\), we treat the above formulation as an optimization problem. To do so, the average derivative of \(J\) for timestep \(t\) is calculated as follows:  
\[ \begin{split}\bar{J}^{t}(X,T^{t})&=\frac{1}{m}\sum _{i=1}^{m}\begin{cases}(1-\gamma)&\text{if }x_{i}\leq T^{t}\\ \gamma&\text{if }x_{i}>T^{t}\end{cases}\\ &=\frac{1}{m}\left((1-\gamma)\sum_{i=1}^{m}\mathbb{I}_{x_{i}\leq T ^{t}}-\gamma\sum_{i=1}^{m}\mathbb{I}_{x_{i}>T^{t}}\right)\triangleq\frac{1}{m }\sum_{i=1}^{m}\mathbb{I}_{x_{i}\leq T^{t}}-\gamma\end{split}  \tag{5}\]  
The update rule for estimating \(T^{t+1}\) can be obtained as follows:  
\[T^{t+1}\gets T^{t}-\eta_{T}\left(\frac{1}{m}\sum_{i=1}^{m}\mathbb{I}_{x_{i }\leq T^{t}}-\gamma\right), \tag{6}\]  
where \(\eta_{T}\) is the learning rate used for the threshold estimation. Equation (5) enhances the model's performance and robustness by dynamically adapting the threshold to changes in the update distribution. In the obtained update rule in (6), the value of \(T\) linearly changes with a maximum of \(\eta_{T}\) in each iteration. This can be problematic when the desired \(T\) is significantly larger or smaller than the current value. To address this problem, a geometric form of this update rule is employed to speed up and improve the convergence of the function, as follows:  
\[T^{t+1}\gets T^{t}.\exp\left(-\eta_{T}\Big{(}\frac{1}{m}\sum_{i=1}^{m} \mathbb{I}_{x_{i}\leq T^{t}}-\gamma\Big{)}\right) \tag{7}\]  
Each node communicates both \(W_{k}^{t}\) and \(T_{k}^{t}\) to the server. FedAvg with adaptive clipping is defined in Algorithm 1, which details the aggregation operation on the server side. Client-side operations are defined in Algorithm 2 based on the aforementioned formulations.