# FedDB: A Federated Learning Approach Using DBSCAN for DDoS Attack Detection
## 4 Results
### Robustness to Data Distribution  
In federated learning, the data from multiple clients are often Non-Independent and Identically Distributed (non-IID) [25]. This means that the data patterns generated by different clients, (X\({}_{1}\), Y\({}_{1}\)), (X\({}_{2}\), Y\({}_{2}\)), \(\ldots\), (X\({}_{k}\), Y\({}_{k}\)), follow different distributions. This heterogeneity in data can significantly reduce the model's accuracy. Therefore, we introduce the Dirichlet distribution [26] to our dataset to evaluate the model's performance under different data conditions.  
Specifically, we use Dirichlet distributions with parameters 0.9 and 0.2 to distribute the data among 10 clients, represented as Dir(\(\alpha\)), where \(\alpha=0.9\) and \(\alpha=0.2\). A larger \(\alpha\) value leads to a more concentrated distribution, while a smaller value results in a more dispersed distribution. Figures 3 and 4 illustrate the distributions for \(\alpha=0.9\) and \(\alpha=0.2\), respectively. It can be observed that the distribution for \(\alpha=0.9\) is relatively balanced, whereas, for \(\alpha=0.2\), the data are significantly dispersed, with each client focusing on a specific type of data. In the figures, the blue color represents the training set, orange represents the validation set, and green represents the test set.  
Figure 3: The distribution with alpha = 0.9.  
Figure 2: Taxonomy of DDoS attacks in the ClCDDOS2019 dataset [24].  
In our approach to LSTM hyperparameter tuning, we focus on three key parameters: hidden size, the number of layers, and learning rate. Experimental results show that setting the learning rate to 0.01 leads to higher accuracy compared to 0.001 (Table 1). Additionally, when analyzing the hidden size and the number of layers, Table 2 indicates that, rather than a more complex network architecture, our dataset performs better with a simpler model structure, as evidenced in the tables. In this paper, when selecting DBSCAN parameters, we chose eps as 0.5 and MinPts as 5. The hyperparameters of DBSCAN, such as \(\epsilon\) and MinPts, primarily depend on the structure and density distribution of the data. When the eps and MinPts values are set too low or too high, the clustering effectiveness of the model is significantly reduced, losing its core advantages. This leads the model to overly rely on individual client data for updates, ultimately resulting in decreased accuracy.  
We compared our method with FedAvg and FedMe, as shown in Table 3. It can be observed that our proposed method achieves superior overall average accuracy compared to the other two. Additionally, we noticed that, although FedMe's average accuracy is the same as our method, both exceeding 90%, the accuracy of FedMe's Worker 2 is only 60%, while the average accuracy is 92%, indicating a significant discrepancy. In contrast, the accuracy of each worker in our method is very close to the average accuracy.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Hidden Size, Layer** & **Learning Rate** & **Accuracy** \\ \hline (64,1), (64,2) & 0.001 & 0.51 \\ (64,1), (64,2) & 0.01 & 0.71 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Comparison of hidden size and layer count on model accuracy.  
Figure 4: The distribution with alpha = 0.2.  
This situation becomes even more pronounced with \(\alpha=0.2\), as seen in Table 4, where the impact of training on accuracy is more significant in the case of more uneven data distribution. However, our method effectively addresses this issue, ensuring that the accuracy of each client remains close to the average value, even in uneven data scenarios. This confirms the effectiveness of our method in handling data heterogeneity and maintaining stable model performance in non-IID data environments.