# CGFL: A Robust Federated Learning Approach for Intrusion Detection Systems Based on Data Generation
## 4 Experiments and Results
### Results and Discussions
#### 4.2.3 Different Category Distributions Comparsion  
This part examines how different class distributions affect the performance of Federated Learning algorithms. To simulate the distribution of client data, the Dirichlet \begin{table}
\begin{tabular}{l c c c c c} \hline \hline
**Sample** & **Attack** & **Precision** & **Recall** & **F1-Score** & **G-Mean** \\ \hline \multirow{6}{*}{Original sample} & Normal & 0.9263 & 0.9169 & 0.9216 & 0.9216 \\  & Dos & 0.7824 & 0.8863 & 0.8311 & 0.8327 \\  & Probe & 0.9931 & 0.9925 & 0.9928 & 0.9928 \\  & R2L & 0.5333 & 0.2428 & 0.3337 & 0.4927 \\  & U2R & 0.1671 & 0.1565 & 0.1616 & 0.1617 \\ \hline \multirow{6}{*}{Hybrid sample} & Normal & 0.9183 & 0.9186 & 0.9184 & 0.9184 \\  & Dos & 0.8983 & 0.9180 & 0.9080 & 0.9081 \\ \cline{1-1}  & Probe & 0.7964 & 0.9283 & 0.8573 & 0.8598 \\ \cline{1-1}  & R2L & 0.6053 & 0.8553 & 0.7089 & 0.7583 \\ \cline{1-1}  & U2R & 0.9843 & 0.9827 & 0.9835 & 0.9835 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: The performance of the model on the KDDTest-21 before and after data augmentation. \begin{table}
\begin{tabular}{l c c c c c} \hline \hline
**Sample** & **Attack** & **Precision** & **Recall** & **F1-Score** & **G-Mean** \\ \hline \multirow{6}{*}{Original sample} & Benign & 0.9983 & 0.9989 & 0.9986 & 0.9986 \\  & Bot & 0.7842 & 0.4263 & 0.5523 & 0.5782 \\  & DoS & 0.9811 & 0.9805 & 0.9808 & 0.9808 \\  & Infiltration & 0.3233 & 0.1628 & 0.2166 & 0.2294 \\  & PortScan & 0.9671 & 0.9665 & 0.9668 & 0.9668 \\  & Web Attack & 0.6409 & 0.5373 & 0.5845 & 0.5868 \\  & Brute Force & 0.8946 & 0.9237 & 0.9089 & 0.9090 \\ \hline \multirow{6}{*}{Hybrid sample} & Benign & 0.9983 & 0.9986 & 0.9984 & 0.9984 \\  & Bot & 0.8971 & 0.9358 & 0.9160 & 0.9162 \\ \cline{1-1}  & DoS & 0.9934 & 0.9942 & 0.9938 & 0.9938 \\ \cline{1-1}  & Infiltration & 0.4532 & 0.8426 & 0.5894 & 0.6180 \\ \cline{1-1}  & PortScan & 0.9959 & 0.9923 & 0.9941 & 0.9941 \\ \cline{1-1}  & Web Attack & 0.8531 & 0.9424 & 0.8955 & 0.8966 \\ \cline{1-1}  & Brute Force & 0.9531 & 0.9755 & 0.9642 & 0.9642 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: The performance of the model on the CIC-IDS2017 before and after data augmentation. distribution \(\text{Dir}(\alpha)\) was utilized in the experiments. The parameter \(\alpha>0\) controls both the level of class imbalance and the diversity among clients. Experiments were conducted using five \(\alpha\) values: 0.1, 0.07, 0.05, 0.03, and 0.01. As \(\alpha\) decreases, client datasets exhibit stronger bias toward minority classes, leading to increased diversity and greater class imbalance, which presents challenges for training the model. The ResNet20 architecture was used in experiments conducted on the NSL-KDD, CIC-IDS2017, and CSE-CIC-IDS2018 datasets. Comparisons involving SCAFFOLD were excluded in this section because of its poor performance under low client sampling frequencies, as shown in Table 2.  
The proposed CGFL method demonstrates superior performance compared to existing approaches across various client class distributions, as shown in Table 7. The improvements become more significant as the \(\alpha\) value decreases. For example, when \(\alpha\) is set to 0.01, CGFL achieves an accuracy improvement of 14.81% over the best current method on the NSL-KDD dataset. Similarly, on the CIC-IDS2017 dataset, CGFL outperforms by 5.82% and 4.74% for a values of 0.03 and 0.01, respectively. These findings highlight CGFL's increased advantage as the imbalance in client data distributions intensifies, showcasing its effectiveness in mitigating performance degradation under highly imbalanced and diverse client class distribution scenarios.