# Federated Learning for Cybersecurity: A Privacy-Preserving Approach
## 4 Experimental Setup and Evaluation
### Experiment Phases  
The experimental evaluation followed a structured, iterative methodology that reflects real-world FL deployments in IoT-centric cybersecurity infrastructures. The workflow, shown in Figure 6, consists of five distinct phases designed to balance detection accuracy, privacy protection, and communication efficiency.  
* Local Training Phase--Each IoT client performs model training using its locally available, non-IID dataset partition. No raw data is exchanged during training, ensuring complete data locality and adherence to privacy principles.
* Privacy Enforcement Phase--After local training, each client applies gradient clipping, Fisher-based pruning, and encryption techniques to its model updates. These mechanisms limit potential gradient leakage and increase robustness against inversion attacks.
* Secure Communication Phase--Encrypted updates are transmitted over secure VPN channels using lightweight protocols to minimize overhead. This ensures both confidentiality and efficiency during transmission to the central aggregator.
* Secure Aggregation Phase--The aggregation server collects encrypted model updates from participating clients and performs secure multiparty aggregation. Individual client contributions remain hidden, supporting robustness against adversarial reconstructions.
* Global Model Update Phase--A refined global model is synthesized and distributed to clients for the next round of training. The cycle repeats iteratively until convergence criteria are met, typically defined by accuracy stabilization or loss threshold.  
The iterative experimental workflow is illustrated in Figure 6.  
To validate this experimental cycle, we simulated a network of 50 heterogeneous IoT clients, each assigned personalized non-IID subsets of the CICIDS2017 and TON_IoT datasets. All communications were routed through VPN tunnels using encrypted, low-overhead transport protocols, resulting in a measured 27% reduction in communication overhead compared to unencrypted baselines.  
Over 10 rounds of communication, the federated model converged after 8 rounds, achieving an average accuracy of 91.8% while maintaining a privacy loss of less than 5%.  
Figure 6: The iterative experimental workflow.  
These results confirm the framework's ability to balance model quality with privacy and communication efficiency under constrained, distributed cybersecurity conditions.  
Figure 7 illustrates the evolution of the relative communication overhead over ten rounds of federated training, comparing the proposed encrypted FL framework to a baseline centralized model. While the centralized approach shows a constant overhead throughout the process, the federated method shows a steady decline--from 100% to approximately 73%--due to the cumulative effects of model pruning, gradient compression, and selective parameter updates.  
This optimization reduces overall communication overhead by 27%, significantly enhancing bandwidth efficiency, which is a critical factor in resource-constrained IoT environments. These findings highlight the framework's suitability for real-world deployments where transmission efficiency and data confidentiality are essential for operational viability.