## 3 Proposed Methodology
### Component-Wise Contributions of ResVGG-SwinNet  
The ResVGG-SwinNet model improves multi-label DDoS detection in IoT networks by combining ResNet, VGGNet, and Swin-Transformer. These components were selected for their feature extraction, refinement, and contextual learning characteristics, enabling the model to manage IoT traffic complexity and heterogeneity. The powerful feature extraction capabilities of ResNet, short for Residual Network, make it a popular choice. It excels in capturing packet-level statistics and flow characteristics from network traffic data. ResNet uses residual connections to avoid the vanishing gradient issue in deep networks. These connections let gradients flow through the network during backpropagation, allowing deeper layers to acquire meaningful representations without performance deterioration. VGGNet refines features after ResNet. These modest (3 \(\times\) 3) convolutional filters boost the depth and resolution of retrieved features in this network architecture. VGGNet refines ResNet's feature maps to help the model detect minor traffic patterns that may signal various DDoS assaults. This modification reduces noise and improves attack detection characteristics to enhance multi-label classification. ```
1:Input: Local datasets \(\mathcal{D}_{i}\) for each client, global model initialization \(\zeta^{0}\)
2:Output: Final global model \(\zeta^{\text{final}}\)
3:Initialization:
4:Initialize global model \(\zeta^{0}\) (ResNet, VGGNet, Swin-Transformer)
5:for each client \(\tilde{t}\) in parallel do
6: Initialize local model \(\zeta^{0}\) based on global model \(\zeta^{0}\)
7: Initialize local dataset \(\mathcal{D}_{\tilde{t}}\)
8:endfor
9:Federated-Learning Training:
10:for each communication round \(t=1\) to \(\mathbf{R}\)do
11:Local Training for Each Client
12:for each client \(\tilde{t}\) in parallel do
13: Perform local training on local dataset \(\mathcal{D}_{i}\) for \(T\) iterations:
14:for each iteration \(\tilde{t}=1\) to \(\mathbf{T}\)do
15:Step 1: Feature Extraction using ResNet Block
16:Extract low-level features from the local data using the ResNet Block (initial feature representation). 17:Step 2: Feature Optimization using VGGNet Block
18:Pass the extracted features through VGGNet to optimize feature representation (adjust depth, width, and resolution). 19:Step 3: Contextual Learning using Swin-Transformer Block
20:Pass the optimized features through the Swin-Transformer block to capture long-range dependencies and contextual relationships. 21:Step 4: Update Model Weights using Local Gradient Descent
22:Compute gradients based on the loss function \(\mathcal{L}\) using the local model \(\zeta^{i}_{i}\) and dataset \(\mathcal{D}_{\tilde{t}}\)
23:Update local model weights based on the computed gradients. 24:endfor
25: Send updated local model \(\zeta^{\text{final}}_{i}\) to central server
26:endfor
27:Federated Averaging (FedAvg):
28: Aggregate the models from all clients at the central server. 29:\(\zeta^{\text{final}}_{i}=\frac{1}{N}\sum_{k=1}^{N}\zeta^{\text{final}}_{i}\)\(\zeta^{\text{final}}_{i}\)
30:Send updated global model \(\zeta^{\text{final}}\) back to all clients
31:endfor
32:Final Model:
33:After rounds, the final global model \(\zeta^{\text{final}}\) is obtained
34:Classification:
35:For final global model \(\zeta^{\text{final}}\), apply softmax for multi-label classification to determine attack types (e.g., normal, DDoS). ```  
**Algorithm 1** Federated Training of ResVGG-SwinNet for DDoS Attack Detection. Final component Swin-Transformer collects long-range interdependence and complicated contextual interactions in network data. The hierarchical, window-based self-attention method of the Swin-Transformer differs from local convolutional networks. Analysing traffic data at many scales lets the model understand global and local trends. This capacity helps identify changing and complex attack patterns by analysing traffic flow context and temporal relationships.