## 4 Results
### CIDS Trust and Privacy-Preserving Analysis  
In the CIDS, implemented within an edge-fog-cloud architecture and utilizing blockchain with a proof-of-work (PoW) consensus mechanism, preventing Sybil attacks is crucial for maintaining network integrity and trustworthiness. Each participating edge device and fog node maintains a copy of the blockchain ledger, serving as a decentralized and immutable record of all transactions, including model updates and node interactions. The PoW consensus mechanism ensures that transactions are validated and added to the blockchain through computationally intensive mining processes, making it challenging for malicious entities to tamper with the ledger. To model the prevention of Sybil attacks mathematically, we denote variables such as the total number of nodes (\(N\)), total number of miners (\(M\)), total computational power of miners (\(P\)), target difficulty for PoW mining (\(T\)), current blockchain height (\(H\)), block reward (\(B\)), and cost of performing a Sybil attack (\(C\)). The probability of a Sybil attack succeeding (\(P_{\text{Sybil}}\)) can be represented as \(\frac{C}{P}\). To prevent Sybil attacks, the computational power of legitimate nodes participating in PoW mining (\(P_{\text{legitimate}}\)) must exceed the computational power of potential attackers (\(C\)). Thus, by ensuring that \(P\) exceeds \(C\), the CIDS network mitigates the risk of Sybil attacks, safeguarding its trust and privacy-preserving capabilities. By integrating blockchain with a PoW consensus mechanism into the CIDS network, the system ensures that Sybil attacks are economically infeasible for potential attackers. The computational resources required to perform a successful Sybil attack would surpass the computational power of honest nodes participating in PoW mining, thereby safeguarding the integrity and trustworthiness of the CIDS network. In the CIDS, FL plays a pivotal role in preserving privacy by ensuring decentralized storage of sensitive data, while blockchain technology is utilized to uphold trust and transparency within the system. This combination of mechanisms is well suited to prevent data breaches and uphold privacy standards. In the CIDS ecosystem, each edge device trains its local intrusion detection model using locally collected sensitive network traffic data. These data remain decentralized and are never shared with other devices or the central server. Let \(N\) represent the total number of participating edge devices in FL, \(M\) denote the total number of fog nodes, and \(T\) represent the total number of transactions recorded on the blockchain. Furthermore, Data\({}_{i}\) signifies the sensitive data stored on edge device \(i\), Model\({}_{i}\) denotes the local model trained on edge device \(i\), and Update\({}_{ij}\) represents the model update transmitted from edge device \(i\) to fog node \(j\). After local training, edge devices transmit only model updates (not raw data) to the fog nodes for aggregation. This transmission process employs privacy-preserving techniques such as secure aggregation or differential privacy to maintain the confidentiality \begin{table}
\begin{tabular}{c c c} \hline \hline
**Number of Transactions** & **CPU (\%)** & **RAM (Mb)** \\ \hline
1000 & 15.42 & 138.17 \\
2000 & 17.55 & 140.27 \\
3000 & 15.13 & 144.24 \\
4000 & 15.34 & 144.52 \\
5000 & 15.48 & 144.62 \\
6000 & 15.64 & 144.09 \\
7000 & 17.36 & 144.39 \\
8000 & 17.1 & 144.66 \\
9000 & 17.86 & 145.11 \\
10,000 & 19.223 & 147.43 \\ \hline Average & 16.61 & 143.75 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: CPU and memory from IPFS. of individual contributions. These methods ensure that the aggregated model update \(\text{Agg}_{j}\) does not divulge any sensitive information regarding the individual data of edge devices. After the model updates are aggregated at the fog nodes, denoted as \(\text{Transaction}_{t}=\{\text{Agg}_{j}\}_{j=1}^{M}\), they are bundled into a transaction and subsequently recorded on the blockchain.