# Enhancing Federated Intrusion Detection with Class-Specific Dynamic Sampling
## 3 DS-FedIDS
### Visual Analysis of Traffic Patterns  
Beyond categorical distributions, we examine temporal characteristics and packet size variations within these heterogeneous datasets. Figures 3 and 4 illustrate key patterns observed in our experiments.  
The temporal patterns (Figure 3) illustrate distinct flow duration distributions across network environments, reflecting differences in traffic volume and inter-arrival dynamics. The top subplot shows that normal traffic in CDN networks has longer flow durations (mean 1.69 s), indicating sustained, high-volume connections typical of content delivery, while IoT networks exhibit shorter durations (mean 0.49 s), suggesting frequent, bursty flows from sensor data. The bottom subplot reveals that attack traffic durations vary, with Database and Industrial networks showing prolonged attack flows (means 2.06 s and 1.71 s, respectively), likely due to data exfiltration or DDoS attacks. The packet size  
\begin{table}
\begin{tabular}{l c c c c c} \hline
**Protocol** & **CDN** & **IoT** & **DB** & **Office** & **Industrial** \\ \hline tcp & 100.00 & 54.57 & 100.00 & 86.38 & 100.00 \\ udp & 0.00 & 45.43 & 0.00 & 13.62 & 0.00 \\ \hline \end{tabular}
\end{table}
Table 4: Protocol distribution by network type.  
\begin{table}
\begin{tabular}{l c c c c c} \hline
**Service** & **CDN** & **IoT** & **DB** & **Office** & **Industrial** \\ \hline http & 80.71 & 9.46 & 0.00 & 13.48 & 17.34 \\ dns & 0.03 & 35.86 & 0.00 & 0.00 & 0.00 \\ ftp & 19.21 & 0.00 & 0.00 & 3.21 & 0.00 \\ ssl & 0.06 & 0.00 & 0.00 & 0.00 & 0.00 \\ smtp & 0.00 & 0.00 & 0.00 & 5.33 & 0.00 \\ pop3 & 0.00 & 0.00 & 0.00 & 0.10 & 0.00 \\ dhcp & 0.00 & 0.01 & 0.00 & 0.00 & 0.00 \\ other & 0.00 & 54.67 & 100.00 & 77.88 & 82.66 \\ \hline \end{tabular}
\end{table}
Table 2: Service distribution by network type.  
\begin{table}
\begin{tabular}{l c c c c c} \hline
**Attack Cat.** & **CDN** & **IoT** & **DB** & **Office** & **Industrial** \\ \hline Exploits & 61.87 & 6.90 & 22.74 & 37.78 & 38.21 \\ DoS & 8.25 & 1.20 & 3.63 & 5.26 & 5.84 \\ Reconnaissance & 9.48 & 4.36 & 17.59 & 17.02 & 14.92 \\ Generic & 8.17 & 78.90 & 3.22 & 5.41 & 5.57 \\ Fuzzers & 8.57 & 7.67 & 49.11 & 30.68 & 31.54 \\ Analysis & 2.53 & 0.23 & 0.21 & 0.90 & 1.32 \\ Backdoor & 0.45 & 0.13 & 0.77 & 0.50 & 0.66 \\ Shellcode & 0.00 & 0.56 & 2.71 & 2.19 & 1.61 \\ Worms & 0.67 & 0.06 & 0.02 & 0.25 & 0.33 \\ \hline \end{tabular}
\end{table}
Table 3: Attack category distribution by network type.  
comparison (Figure 4) highlights differences in packet size distributions. The top subplot shows that normal traffic in Office and Database networks has larger median packet sizes (2646 and 2974 bytes), reflecting enterprise and data transfer activities, while IoT and Industrial networks have smaller sizes (1580 and 2766 bytes), indicative of lightweight, frequent transmissions. The bottom subplot indicates that attack traffic packet sizes are highly variable, with CDN and Office networks showing larger mean sizes (6016 and 25,808 bytes) due to bulk attack data, while IoT's small median size (114 bytes) suggests rapid, targeted attacks.  
Figure 4: Comparison of packet size distributions across network environments. The top subplot shows the distribution of packet sizes (in log scale) for normal traffic, while the bottom subplot shows the distribution for attack traffic, across CDN, IoT, Database, Office, and Industrial networks.  
Figure 3: Temporal traffic patterns observed across network environments. The top subplot shows the distribution of flow durations (in log scale) for normal traffic, while the bottom subplot shows the distribution for attack traffic, across CDN, IoT, Database, Office, and Industrial networks.