## 5 Simulation Results and Discussion
### Results Discussion
The CIC-DDoS2019 dataset shows that detection rates decrease with congestion levels, dropping from 95% to 60% as packet loss rises from 0% to 20%. UNSW-NB15 and IoT23 show similar tendencies. This image shows that detection algorithms are resilient under different network situations and emphasises the need to optimise detection techniques for crowded settings. Figures 9 and 10 provide correlation matrices for the CIC-DDoS2019, UNSW-NB15, and IoT23 datasets. These matrices show feature dependencies. In CIC-DDoS2019, \"Flow Duration\" and \"Total Fwd Packets\" are strongly correlated, but in UNSW-NB15, \"Protocol Type\" and \"Service\" are interdependent. A balanced association exists between \"Packet Length Mean\" and \"Flow Packets/s\" in IoT23. These statistics demonstrate how feature selection reduces redundancy and improves classification accuracy. Figure 6: DDoS detection count before and after DPCA balancing for CIC-DDoS2019, UNSW-NB15, and IoT23 datasets. Figure 7: Protocol impact on DDoS attacks across CIC-DDoS2019, UNSW-NB15, and IoT23 datasets. Figure 8: Impact of network congestion (packet loss and latency) on DDoS detection rate. Figure 10: Correlation matrix for IoT23 dataset. Figure 9: Comparison of correlation matrices for (a) CIC-DDoS2019 and (b) UNSW-NB15 datasets. Figures 11 and 12 show feature significance rankings for the CIC-DDoS2019, UNSW-NB15, and IoT23 datasets, generated using the Dual Adaptive Selector. \"Flow Duration\", \"Total Fwd Packets\", and \"Packet Length Mean\" are consistently important across datasets, with values between 0.7 and 0.9. The figures show that DAS can find crucial traits for reliable DDoS detection while lowering computational costs. Figure 13 compares the ROC curves of the FL-LSTM, Hybrid LSTM-GRU, Fedex, and FL ResVGG-SwinNet models. The suggested model has the best AUC of 0.98, showing improved classification performance, notably in high accurate favourable rates and low false positives. This chart illustrates the architecture's resilience and scalability in sophisticated DDoS attacks. The FL ResVGG-SwinNet model assessed confusion matrices for the CIC-DDoS2019, UNSW-NB15, and IoT23 datasets, as shown in Figure 14. These matrices have high true positive and low false positive/negative rates, with all label misclassification errors under 4. The suggested model's attack type identification accuracy and reliability across varied datasets are outstanding. Table 4 evaluates Federated-Learning (FL) models across multiple clients, analysing performance metrics such as MSI, Accuracy, FAR, Log Loss, AUC, OES, and F1-Score. Nine clients are evaluated to simulate heterogeneous data distributions and various source inputs. FL-LSTM, Hybrid LSTM-GRU, Fedex, and FL-Based ResVGG-SwinNet are evaluated. Each model's performance is iteratively assessed across all customers, emphasising the steady improvement in MSI and F1-Score with client interaction. The FL-Based ResVGG-SwinNet excels in managing decentralised IoT network data, with an MSI of 97.0%, Accuracy of 99.0%, and a low FAR of 2.5%, demonstrating its resilience and efficiency. ResVGG-SwinNet surpasses other models in AUC and OES, demonstrating its scalability and optimisation. Figure 4:0 Comparison of feature importance for CIC-DDoS2019 and UNSW-NB15 datasets (DAS). Figure 4:1 Feature importance for IoT23 dataset (DAS). The models can adapt to different data distributions while retaining accuracy and minimal loss with nine clients. The findings show that the suggested model is better in data processing, detection rates, and false alarms, guaranteeing dependable performance across varied IoT contexts. Table 5 compares Federated-Learning (FL)-based approaches for intrusion detection in decentralised IoT networks for classification performance. Each method's resilience and effectiveness in identifying DDoS attacks is assessed using metrics including MSI, Accuracy, FAR, Log Loss, AUC, OES, Recall, and F1-Score.