# Federated Learning for Cybersecurity: A Privacy-Preserving Approach
## 4 Experimental Setup and Evaluation
### Implementation Setup and Evaluation Process  
To ensure scientific rigor and reproducibility, the SecFL-IoT framework was carefully structured and implemented in a controlled simulation environment using standard protocols for distributed learning and security evaluation. The system was implemented in Python 3.10, and its core modules relied on TensorFlow Federated (TFF) and PySyft for FL operations and secure multi-party computation, respectively. OpenDP and TF Privacy libraries were integrated for privacy-preserving mechanisms to simulate differential privacy at both the client and server aggregation stages.  
The experimental setup consisted of 20 virtual edge clients, each of which simulated a distinct IoT node or hospital department. These clients ran on isolated Docker containers hosted on a high-performance computing cluster with 128 GB of RAM and four NVIDIA A100 GPUs (NVIDIA, Santa Clara, CA, USA). Each client was assigned non-IID data partitions from the CICIDS2017 and TON_IoT datasets to replicate real-world data heterogeneity and imbalance. This reflects the operational reality of IoT deployments, where data distributions are highly personalized based on device function, network role, and environment.  
Figure 8: Accuracy vs. privacy loss.  
The chosen model architecture for training was a three-layer MLP with ReLU activations. It was optimized using Adam (from PyTorch, version 2.2.2) with a learning rate of 0.01 and a batch size of 64. Local model updates were computed over ten training epochs, followed by secure transmission to a fog-level aggregation node. Before update submission, gradient clipping (with a norm threshold of 1.0) and Fisher-based parameter pruning were applied to mitigate leakage and reduce communication overhead.  
To enforce differential privacy, calibrated noise (\(\epsilon\) = 1.5, \(\delta\) = 1 \(\times\) 10\({}^{-5}\)) was added to the aggregated model parameters, which is consistent with the current FL privacy guidelines [1]. To test robustness, a subset of experiments included simulated adversarial nodes (10% of clients) that conducted model poisoning and data inversion attacks. The system's resilience was measured by degradation in detection accuracy and associated privacy loss metrics.  
We evaluated model performance using standard and custom metrics, including accuracy, precision, recall, F1 score, privacy loss, and communication overhead reduction. Additionally, confusion matrices were generated to assess per-class detection efficacy, and receiver operating characteristic (ROC) curves were computed to evaluate discrimination capacity under varying thresholds. All evaluations were performed using Scikit-learn, version 1.3.2, Matplotlib, version 3.8.4, and custom monitoring dashboards developed in Flask.  
To ensure consistent results and address reproducibility concerns, each experimental configuration was executed five times, and the mean and standard deviation of all metrics were reported. For comparison, a baseline centralized model was trained with identical hyperparameters to allow for a fair performance comparison with the proposed federated architecture.  
This comprehensive implementation process, which integrates secure learning, adversarial simulation, and rigorous statistical validation, demonstrates the SecFL-IoT framework's practical viability and scientific grounding in real-world IoT cybersecurity contexts.