# CGFL: A Robust Federated Learning Approach for Intrusion Detection Systems Based on Data Generation
## 3 Methods
### Federated Learning Intrusion Detection Framework  
The fundamental distinction between Federated Learning and conventional training resides in the methodology of data training. Conventional training necessitates the centralization of data on a server, potentially resulting in privacy violations. Federated Learning trains models on client devices, sharing only parameters or gradients, thereby safeguarding data privacy. In industrial control networks, a lack of samples may lead to local models exhibiting reduced sensitivity, thereby impairing detection performance. Federated Learning facilitates the collaborative training of models across disparate networks while preventing data loss, allowing for the exchange of feature information and the development of an effective and complete detection model. In our approach, we implemented several key strategies to address the challenges associated with Federated Learning, especially in environments with non-IID data and limited sample sizes. First, we adopted Geometric Median Aggregation as a core innovation. Unlike the traditional weighted averaging approach, this technique effectively reduces the influence of outliers and noise from less reliable clients, leading to more stable updates and avoiding drastic changes in the global model. The geometric median method is particularly robust against clients with skewed data distributions, which helps maintain overall model stability as updates are aggregated. To counter the issue of class imbalance across clients, which often results in local models that cannot generalize well, we employed Data Augmentation with CVAE-GAN. By leveraging CVAE and GAN, we generated virtual data for underrepresented classes, effectively balancing the data across clients. This not only enhanced the robustness of each client's local model but also accelerated convergence by providing more diverse data for training. Additionally, we implemented a Pretraining Phase with Warm-up Rounds to address initial instability and slow convergence. During this phase, the global model was trained using combined data from all clients, allowing it to stabilize before federated updates began. This pretraining phase reduced variance in the early stages of the Federated Learning process and ensured that local models were better aligned with the global model, thus preventing instability in subsequent rounds. These strategies collectively enhance the effectiveness and stability of Federated Learning, making it a powerful tool for collaborative model training in distributed environments such as industrial control networks. Figure 6 illustrates the system framework. 1. Each client performs local model training using both its local data and the virtual data generated by the data generation module, resulting in a local model \(S_{k}\). 2. After completing local model training, the client sends the model parameters to the server instead of the raw data, effectively reducing the risk of data leakage. 3. The server gathers the local model parameters submitted by all clients and integrates them using a center-based aggregation algorithm. : \[w^{(t+1)}=GM((w^{(t)}_{k})_{k\in S_{k}},\alpha_{k}\in S_{k},e)\] (8)  
In the formula, \(w(t+1)\) denotes the updated global model parameters after round \(t+1\). Meanwhile, \(w(t)_{k}\) represents the local model parameters from client \(k\) after round \(t\). The weight or importance assigned to the model update from client \(k\) is denoted by \(\alpha_{k}\), which is determined based on factors such as data size or client performance. The geometric median aggregation function, denoted by \(GM\), is used to combine model parameters from multiple clients. This function ensures robust privacy protection and minimizes the influence of outliers. Additionally, \(e\) is a small constant or regularization term used to adjust the aggregation process or prevent division by zero. Figure 6: Framework of Federated Learning System Model. The server utilizes an aggregation function to combine the received models and update the global model.