## 4 Intrusion Detection Systems Based on Federated Learning
### Comparative Analysis of Federated-Learning-Based Intrusion Detection Systems
#### 4.1.1 The Federated Learning-Based Intrusion Detection Systems for Smart Home Settings
Advantages
Implemented;  
Collected dataset of network traffic of test IoT devices communication behavior (33 devices, 23 types), dataset of consumer IoT devices (14 devices), dataset of infected with Mirai malware (5 devices) [3];  
Experiments with real IoT devices;  
For Mirai malware: 95.6% detection rate and \(\approx\)257 ms at detecting compromised devices;  
No false alarms;  
Does not require any human intervention or labeled data to operate;  
Learns anomaly detection models autonomously, using unlabeled crowdsourced data captured in client IoT networks. A framework based on federated learning for detection of malware in IoT devices [22]. In [22], the authors propose the framework based on federated learning for detection of malware in IoT devices. Federated learning architectureThe authors implement the centralized architecture. The proposed framework incorporates clients (with single device per client) and a server. The server implements the following functionality: initializes the model; aggregates the models sent by the clients into a global model; coordinates the collaborative normalization, the collaborative grid searches, and the collaborative threshold selection. It is cross-silo FL when there are few powerful and reliable federated clients. ML methodsThe authors used supervised and unsupervised federated models (multiclayer perceptron and autoencoder). They tested different number of hidden layers and hidden neurons. After each hidden layer, the exponential linear unit (ELU) activation function was used. The model updates were computed using stochastic gradient descent (SGD). _Implementation_. For aggregation, the authors used mini-batch aggregation and multi-epoch aggregation from the FedAVG. The training of multi-epoch aggregation was repeated for 30 rounds. _Dataset_. The authors used the N-BaIoT dataset that models network traffic of nine real commercial IoT devices of different types [68]. The malware threat is considered (the devices are uncorrupted or infected by Mirai or BASHLITE). In the supervised case for each device, the data were split chronologically between three parts: the train set--79%, the unused set (the authors left a small set of samples unused between the train part and the test part for each file in the dataset as soon as the features of packets captured in a very short time interval are highly correlated)--1%, and the test set--20%. In the unsupervised case, the benign data were split between four sets: the train set--39.5%, a threshold-selection set--39.5%, the unused set--1%, and the benign part of the test set--20%. The authors also outline three data scenarios via the dataset rebalancing to balance the number of samples and the proportions of classes for the devices. In the first case, they saved the original dataset balance for every device: 7.87% benign traffic and 92.13% attack traffic. In the second case, they outlined for every device 50% benign traffic and 50% attack traffic. In the third case, the authors outlined 95% benign traffic and 5% attack traffic. In addition, the authors selected for each device the same number of samples--100,000 samples for the supervised solution and 10,000 for the unsupervised one. _Experiments_. The authors evaluated the performance of FL models (federated with mini-batch avg and federated with multi-epoch avg). In addition, they compared it to two traditional approaches (naive decentralized approach and centralized approach). For the experiments, the authors used eight clients, each owning data of one of the nine devices from the N-BaIoT dataset, while one device was kept for testing. For the supervised solution, the training was conducted for four epochs, for the unsupervised solution--120 epochs. The experiments were repeated five times; thus, the results of each experiment represent the average over 45 runs (nine devices and five executions). For the supervised methods, the experiments showed that the centralized method's performance was higher than the distributed one.