# Federated Learning for Cybersecurity: A Privacy-Preserving Approach
## 4 Experimental Setup and Evaluation
### Experimental Environment  
The testbed is designed to simulate a distributed IoT network consisting of multiple edge nodes participating in an FL process coordinated by a central aggregation server. The test environment includes a mix of real and virtualized nodes to enable performance evaluation under conditions that mimic real-world constraints such as limited bandwidth, processing power, and asynchronous client participation. The central server was deployed on a Dell PowerEdge R740 physical server with an Intel Xeon Silver 4210 @ 2.20 GHz (Intel, Santa Clara, CA, USA), 128 GB RAM, and Ubuntu 22.04 LTS with Docker and Python 3.10. Each federated client was emulated using Docker containers for heterogeneity simulation running on the cluster of Raspberry Pi 4 (4 GB RAM) and multiple virtual machines hosted on a Proxmox hypervisor. The simulation framework was developed using Flower (FLwr), version 1.6.0, for FL orchestration and PyTorch, version 2.2.2, for local model training. Transport Layer Security (TLS), a widely adopted cryptographic protocol, was used to establish secure communication between nodes over a private network. Prometheus, version 2.51.2, and Grafana, version 10.4.1, were used to monitor the entire testbed for performance tracking and system-level logging. To validate the proposed privacy-preserving FL framework, a comprehensive experimental environment was designed, replicating a distributed IoT cybersecurity scenario. The configuration includes three main layers: edge, fog, and cloud layers. At the edge layer, multiple IoT devices and embedded systems (e.g., sensors, cameras, healthcare monitors) serve as clients, each with their own private dataset. These clients are connected through a secure VPN network (Tailscale, Toronto, ON, USA), ensuring encrypted communication between participants. The fog layer is composed of intermediate edge servers equipped with pfSense firewalls and load balancers, tasked with preprocessing, encrypting, and routing the model updates securely toward the cloud aggregation server. This layer also manages dynamic client sampling to optimize communication overhead. At the cloud aggregation layer, a centralized server aggregates the encrypted model updates, applies privacy-preserving techniques like SMPC, and updates the global model before distributing it back to the clients. Figure 3 illustrates the architecture of the testbed, showing the interplay between the IoT edge clients, the fog aggregation layer, and the cloud-based central server. The setup allows for dynamic client selection, failure injection, and bandwidth throttling to replicate realistic FL conditions in hostile or constrained networks. The component labeled 'pf' in Figure 3 refers to pfSense, which is an open-source firewall and load balancer that is used to manage network traffic and distribute training workloads dynamically across edge servers [1; 2]. In our setup, instances of pfSense are configured to monitor client availability and system load, redirecting model update traffic to the optimal fog or cloud aggregation node as required. Load balancing is handled at the fog layer through DNS-based routing and real-time monitoring of client connection states. This ensures efficient resource utilization and reduces bottlenecks during model aggregation cycles, particularly in scenarios with intermittent edge connectivity [2]. The entire testbed was simulated using Docker containers to represent distributed clients and servers that were interconnected through a virtualized VPN backbone using Tailscale. Additionally, we deployed attack simulation tools to test intrusion detection capabilities, including standard cyberattack patterns such as Denial of Service (DoS), spoofing, and infiltration. This experimental setup reflects the best practices used in recent FL testbeds for cybersecurity and privacy-preserving analytics [35; 37].