# CGFL: A Robust Federated Learning Approach for Intrusion Detection Systems Based on Data Generation
## 4 Experiments and Results
### Results and Discussions
#### 4.2.1 Methods Comparison

Table 2: Performance comparison with other methods. Figure 9 illustrates the test accuracy curves of the global models ResNet20 and EfficientNet-B0 on the NSL-KDD, CIC-IDS2017, and CSE-CIC-IDS2018 datasets. In contrast, the global model accuracies of FedAvg, FedProx, and FedOpt exhibit significant instability during training. The CGFL proposed in this paper significantly enhances the stability of global model training. It is important to note that the oscillation amplitude of CGFL's global model accuracy curves is considerably reduced once the communication rounds surpass the warm-up rounds. Furthermore, the global models that are trained with CGFL not only accomplish superior performance but also converge more rapidly. Figure 8: The average test accuracy curves for local models ResNet20 and EfficientNet-B0 on NSL-KDD, CIC-IDS2017, and CSE-CIC-IDS2018. Figure 9: The average test accuracy curves for global models ResNet20 and EfficientNet-B0 on NSL-KDD, CIC-IDS2017, and CSE-CIC-IDS2018. Meanwhile, we compared the performance of the CGFL algorithm proposed in this paper with other Federated Learning algorithms applied to intrusion detection in ICS/Supervisory Control and Data Acquisition (SCADA) systems [47]. During the experiments, we strictly followed the settings outlined in the literature [48], setting the hyperparameter \(\gamma\) in the PHEC model to 0.3 and \(u\) to 2. \(\gamma\), as a key balancing parameter, is primarily used to regulate the trade-off between the True Positive Rate (TPR) and the False Positive Rate (FPR). By flexibly adjusting the value of \(\gamma\), the PHEC model can achieve a balance between different combinations of TPR and FPR to meet diverse detection requirements. The parameter \(u\), on the other hand, is defined as the maximum tolerable upper bound for the FPR, and its main role is to effectively control the number of false positives, thus preventing excessive false alarms and enhancing the reliability and practicality of the intrusion detection system. Additionally, following the description in the literature [49], we set up 15 decision trees in the experiments to ensure that the experimental conditions were consistent with those in the literature, thereby making the experimental results more comparable and valuable for reference. For the experiment, the Gas Pipeline dataset was utilized. This time-series data, collected by the Mississippi State University laboratory in 2015, originates from a SCADA system monitoring a natural gas pipeline. The dataset contains 17 features per data point, which include network details and a payload offering in-depth information on the gas pipeline's status and configuration. The experimental results are shown in Table 3.  
Table 3 demonstrates the test accuracies (%) of four different methods (PHEC, [49], FATRAF, and CGFL) under different numbers of clients (K = 100, K = 150, K = 200). The data indicates that as the number of clients increases, the test accuracies of all methods decrease. However, CGFL consistently exhibits the highest accuracy. This is because CGFL employs a generative model that combines a Generative Adversarial Network (GAN) and a Variational Autoencoder (VAE), such as CVAE-GAN, to generate class-balanced data. This approach helps to address the issues of data imbalance and the shortage of samples for rare attack types. Such a data augmentation strategy enhances the data diversity among clients for the model, enabling it to more effectively handle the differences in data distributions across different clients.