## 4 Intrusion Detection Systems Based on Federated Learning
### Comparative Analysis of Federated-Learning-Based Intrusion Detection Systems
#### 4.1.1 The Federated Learning-Based Intrusion Detection Systems for Smart Home Settings
The two-level hierarchical approach is suggested to cope with heterogeneity of the IT ecosystem of the organizations and to enable knowledge sharing between organizations even in the case that they do not trust each other. In order to achieve the letter requirement, the smart contract running on a permissioned blockchain is adopted. The training process includes two levels of aggregation: local aggregation, when the aggregation is performed on the intermediate level, and the global one that is implemented by a global server. _Federated learning architecture_. The proposed architecture includes two levels of the hierarchy; the top level is represented by a global server that is running a blockchain smart contract. This entity is also known as the reducer. It is hosted on a cloud-decentralized blockchain, and runs FL tasks using a smart contract. The intermediate level is represented by a combiner or aggregating server of the collaborating organizations. The combiner aggregates local models from the smart IoT endpoints that perform local models directly on data. _ML methods_. The trained model is a deep feed-forward (DFF) neural network with the following architecture: input layer that consists of neurons equal to number of data features, four middle layers with Relu activation function, and an output layer that consists of one sigmoidal neuron. _ML methods_. Aggregation function is FedAvg. _Implementation_. Custom. _Dataset_. NFBoT-IoT-v2 with NetFlow 9 attributes constructed from BoT-IoT dataset [70; 72] with four types of attack: DDoS, DoS, reconnaissance, and theft. _Experiments_. The authors considered two experimental scenarios. One scenario corresponds to the collaborating entities. The authors modeled the cooperation of two organizations with two smart endpoints each. Thus, to model partition across four collaborating endpoints, the authors split the dataset in such a manner that each client had malicious samples of at least two attack types. Another scenario corresponds to a non-collaborating entity. In this scenario, the training of the intrusion detection model was performed on the part of the dataset that belongs to the selected party. _Used metrics_:  
* Accuracy;
* Detection rate;
* False alarm rate (FAR)--the percentage of benign data samples incorrectly classified;
* F1-measure. _Advantages_:
* Hierarchical FL-based IDS supports large-scale deployments and solves the problem of aggregation of large number of local updates from the numerous IoT endpoints. * Some types of the \"unseen\" attacks are reliably detected. However, this is true only for DDoS and DoS attacks. * Application of the blockchain smart contracts provides a defense mechanism against data/model poisoning attacks. **Blockchained-federated-learning-based cloud intrusion detection scheme for IoT [53]. **_Federated learning architecture_. The architecture of the proposed solution includes four layers--application layer, federated-learning layer, chaincode layer, and blockchain layer. The architecture is centralized. _Privacy-preserving mechanism_. Hyperledger fabric (blockchain). _ML method_. A semi-supervised learning algorithm based on divergence for local model training (decision tree and multilayer perceptron) and FedAvg algorithm for global model training. _Implementation_. Implemented (custom). _Dataset_. KDDCup99 dataset. _Experiments_. The authors deployed the testbed for the experiments using Ubuntu operating system. They used hyperledger fabric for the blockchain project. Four hosts simulating different organizations are connected to a blockchain network; three of them simulate regional service parties (for local models), while the last simulates global service party (for global model). The authors compared their solution--semi-supervised learning algorithm based on divergence for local model training (decision tree and multilayer perceptron)--with random forest and SVM (50-iteration training). They concluded that the multilayer perceptron is the most suitable for real scenarios.