## 4 Intrusion Detection Systems Based on Federated Learning
### Comparative Analysis of Federated-Learning-Based Intrusion Detection Systems
#### 4.1.3 The Federated-Learning-Based Intrusion Detection Systems for Specific Areas  
While most papers consider Smart Home infrastructures or industrial IoT architectures, there are also specific test cases, such as agricultural IoT or Internet of Medical Things. **A federated-learning-based intrusion detection system for agricultural IoT infrastructures [52]. **  
In [52], the authors introduced a federated-learning-based intrusion detection system for agricultural IoT infrastructures. _Federated learning architecture_. The authors used the centralized architecture where the devices train local models of the same structure using different local datasets. They share the updates from their model with an aggregation server that produces an improved detection model. The developed FELIDS system protects data privacy through local learning. _ML methods_. The FELIDS uses deep neural networks, convolutional neural networks, and recurrent neural networks. The authors provide the following parameters for the global classifier: batch size = 100; local epochs = 1; global epochs = 50; learning rate = 0.01-0.5; regularization is L2; global loss function is categorical_crossentropy; activation function is ReLu; classification function is softmax, and optimizer is Adam. _Implementation_. The authors used Google Colaboratory [82] for the experiments and the Python 3 programming language. To implement the proposed system the authors used NumPy, Pandas, TensorFlow, Keras, Scikit-learn, and SMOTE libraries. The Sherpa.ai FL framework [83] was used for the federated learning. To evaluate the training energy consumption, the authors used carbontracker [84]. _Dataset_. The CSE-CIC-IDS2018, MQTset, and InSDN real-world traffic datasets are used for the experiments. The authors considered the following types of attacks: conventional network-based attacks, namely, denial-of-service (DoS), distributed denial-of-service (DDoS), brute force, web-based, infiltration, and botnet (CSE-CIC-IDS2018 dataset); IoT protocol-based attacks, including DoS, BruteForce, Malformed, SlowITe, and Flood (MQTIset that contains message queue telemetry transport (MQTT)-protocol-based communications between IoT devices); sophisticated network-based attacks, including network and application DoS attacks, DDoS attacks, password guessing, web applications-based attacks, probes, botnets, and U2R attacks (InSDN dataset). The authors used the independent and identically distributed (IID) data partition among the clients. In this case, the data distribution for the clients is consistent with the data distribution in the entire dataset. They also used non-independent and identically distributed (non-IID) data partition among the clients. In this case, the data distribution for the clients is not consistent with the data distribution in the entire dataset. _Experiments_. The authors first conducted the experiments for the centralized model and obtained the best results for the InSDN dataset: 98.54% accuracy for DNN, 97.71% for CNN, and 97.84% for RNN. They obtained the worst results for the MQTIset dataset: 90.40% accuracy for DNN, 90.76% for CNN, and 90.05% for RNN. The authors provide the following learning scenario based on the FedAvg algorithm: (1) a generic neural network model is generated by the FELIDS server (the set of initial model weights, the neural network architecture, the hyperparameters, and local and global epochs are identified); (2) the clients download the generic model from the FELIDS server; (3) the generic model is retrained by the clients locally using their private data computing new local set of weights; (4) the clients share the updated model parameters with the server; (5) the FELIDS server aggregates the parameters and creates an updated global model; (6) the updated global model parameters are shared by the server with the clients; (7) the clients use the updated parameters to retrain the model using new local data. The authors used different sets of clients: 5, 10, and 15. A total of 50 communication rounds were used.