# Robust Federated Learning for Mitigating Advanced Persistent Threats in Cyber-Physical Systems
## 3 Methodology  
Figure 1 depicts the overall structure of the APT detection framework. Considering a set of nodes using a neural network model \(M\) in the FL network, each node contains a local dataset \(D=\{X,Y\}\), where \(X=\{x_{1},x_{2},\ldots,x_{m}\}\) and \(Y=\{y_{1},y_{2},\ldots,y_{m}\}\) denote the set of samples and labels, respectively. We assume that \(X\in\mathbb{R}^{n}\) and \(Y\in\mathbb{N}\). Furthermore, the data are non-i.i.d. across different nodes. In a security context, \(X\) denotes the samples recorded from network traffic, whereas \(Y\) denotes the labels specifying the attack mechanisms with which the recorded samples are associated. At time step \(t\), a model is trained at node \(k\) on \(D_{k}^{t}\) and optimizes the parameters, which in our case are the weights of the network \(W_{k}^{t}=\{w_{1},w_{2},\ldots w_{l}\}\), where \(l\) is the number of layers. \(W_{k}^{t}\) is then communicated to the aggregation server. The server receives \(W_{k}^{t}\) for \(N\) nodes and commences the aggregation process. As a common standard, the server can zero out abnormally large values with a threshold \(T_{0}\) to eliminate the effect of potential data poisoning attacks. Assuming that \(w_{ij}\) indicates the \(j\)-th element of \(w_{i}\in W_{k}^{t}\), then \(\forall w_{ij}\in W_{k}^{t}\), \(1\leq k\leq N\):  
\[\text{Clip}(w_{ij},T_{0})= \begin{cases}w_{ij}&\text{if }|w_{ij}|\leq T_{0}\\ 0&\text{otherwise}\end{cases}  \tag{1}\] \begin{table}
\begin{tabular}{c c c} \hline
**Label** & **Class** & **No. Samples** \\ \hline
1 & APT28 & 68 \\
2 & APT29 & 205 \\
3 & APT30 & 101 \\
4 & Carbanak & 105 \\
5 & Desert Falcon & 45 \\
6 & Hurricane Panda & 315 \\
7 & Lazarus Group & 58 \\
8 & Mirage & 54 \\
9 & Patchwork & 559 \\
10 & Sandwork & 44 \\
11 & Shiqiang & 31 \\
12 & Transparent Tribe & 267 \\
13 & Violin Panda & 23 \\
14 & Volatile Cedar & 35 \\
15 & Winnti Group & 176 \\
16 & Non-APT Malware & 9021 \\ \hline \end{tabular}
\end{table} 
Table 1: APT mechanisms included in the dataset [11]. Class populations are indicated accordingly. If a client becomes rogue and acts maliciously, they can disrupt the global model by communicating a set of poisoned parameters. While such attacks may vary in their objectives, the adversarial task of a malicious client is generally to maximize the loss of the global model as follows:  
\[\max_{\xi_{k}}\mathcal{L}(\hat{W}_{k}^{t},\xi_{k}), \tag{2}\]  
where \(\mathcal{L}\) is a loss function that returns the global model error given poisoned updates obtained by perturbation \(\xi_{k}\). Depending on the attack mechanism (e.g., model poisoning, data poisoning), \(\xi_{k}\) can be applied to the local data as \(D_{k}^{t}+\xi_{k}\) or directly to the resulting gradients as \(W_{k}^{t}+\xi_{k}\). The server then uses the clipped weights to aggregate the updates. Given \(N\) nodes in the network, Federated Averaging (FedAvg) [18] is defined as follows:  
\[\text{FedAvg}\Big{(}\{W_{k}\}_{k=1}^{N}\Big{)}=\frac{1}{N}\sum_{k=1}^{N}W_{k}^{t} \tag{3}\]  
The server continuously receives \(W_{k}^{t}\) from nodes and computes \(\text{Clip}(W_{k}^{t},T_{0}^{t})\) to obtain the clipped weights \(\hat{\Delta}_{k}^{t}\). \(\hat{\Delta}_{k}^{t}\) is then passed as \(\text{FedAvg}(\{\hat{\Delta}_{k}^{t}\}_{k=1}^{N})\) to update the weights of the global model \(\hat{W}^{t+1}\) for the next iteration \(t+1\) (see line 10 in Algorithm 1). Nonetheless, finding a fixed threshold for \(T_{0}\) that optimally works for all nodes and datasets is not feasible in most cases. As a solution, one can dynamically adjust the threshold \(T\). We follow the adaptive clipping approach proposed in [43] and employ an adaptive update rule. \(T\) is adjusted to find an approximate value at a specified quantile of the update norm distribution. Assuming that \(\gamma\in[0,1]\) is the targeted quantile, for any \(T\), the \(\text{Clip}(\cdot,\cdot)\) function can be reformulated to the loss function \(J\) with the following definition:  
\[J(X,T)=