# CGFL: A Robust Federated Learning Approach for Intrusion Detection Systems Based on Data Generation
## 2 Related Work
### Intrusion Detection Systems  
Intrusion Detection Systems (IDS) have long been regarded as a crucial component in safeguarding information and communication technology systems. At their core, these systems function by monitoring and analyzing network traffic to identify potential security threats or attacks. Depending on the detection methodology employed, intrusion detection is typically categorized into two types [38]: Signature-based and anomaly-based. Signature-based intrusion detection operates by analyzing known attack behaviors to extract characteristic signatures, which are then matched against system activities. A match indicates that the system is under the corresponding attack. This method boasts high efficiency in detecting known attacks but struggles to counter novel threats. On the other hand, anomaly-based intrusion detection involves analyzing specific features of network traffic to establish a model of normal behavior. During the detection process, current system activities are compared against this normal model, and significant deviations are flagged as potential intrusions. While this approach is capable of identifying unknown attacks, its accuracy and real-time performance are influenced by the complexity of data and the dynamic nature of systems. Recently, researchers in intrusion detection systems (IDS) have focused on using machine learning (ML) techniques to enhance anomaly and intrusion detection in Industrial Control Systems (ICS) and SCADA systems. [PERSON] et al. [39] proposed a machine learning-based approach using 1D Convolutional Neural Networks (CNNs), Long Short-Term Memory (LSTM) networks, Support Vector Machines (SVMs), and Isolation Forest (iForest) algorithms to detect anomalies in ICS communication networks. Their study demonstrated that the 1D CNN model achieved the highest accuracy (0.92) and F1 score (0.91) with minimal processing time, making it suitable for real-time intrusion detection in ICS environments. Similarly, [PERSON] et al. [40] explored the use of machine learning algorithms for anomaly detection in SCADA systems, employing logistic regression, KNN, and hybrid models (J48 and BayesNet) to classify network traffic and detect intrusions. Their results showed that hybrid models achieved up to 100% accuracy in certain scenarios, highlighting the potential of combining multiple ML techniques for improved detection performance. In addition to these approaches, [PERSON] et al. [41] introduced an AutomatedCybersecurity Risk Assessment (ACSRA) methodology for ICS, which integrates various penetration testing frameworks and automates risk assessment tasks such as device discovery, vulnerability scanning, and continuous monitoring. Their methodology emphasizes the importance of real-time monitoring and the integration of threat intelligence to enhance the security of ICS environments. Recent advancements in Federated Learning and generative adversarial networks have further addressed these challenges. [PERSON] et al. [42] proposed FLGAN-IDS, a framework that integrates GANs with Federated Learning to enhance intrusion detection by generating synthetic data to mitigate non-IID data issues. Similarly, [PERSON] et al. [43] introduced FGA-IDS, which leverages GAN-augmented data to improve the detection accuracy in UAV networks, addressing both data scarcity and non-IID challenges. [PERSON] et al. [44] proposed an adaptive Federated Learning intrusion detection system under IoT, utilizing GANs to dynamically adjust to the non-IID nature of IoT data while maintaining robust detection performance. [PERSON] et al. [45] explored Federated Learning for anomaly-based network intrusion detection systems, emphasizing the role of GANs in generating representative samples to stabilize model training and improve detection accuracy in distributed environments. Building on these insights, we propose CGFL, a novel Federated Learning framework that leverages CVAE-GAN for data generation and geometric median aggregation for secure model updates.