# FedDB: A Federated Learning Approach Using DBSCAN for DDoS Attack Detection
## 1 Introduction
Therefore, enhancing detection capabilities is crucial for improving the overall defense effectiveness of the system. In early defense attempts, deep learning techniques have been widely applied to train DDoS detectors due to their superior feature extraction capabilities. Deep learning methods can automatically learn complex features from large amounts of network traffic data and effectively identify abnormal behaviors, thus significantly improving the accuracy of DDoS attack detection. These methods model the characteristic patterns of attack behaviors, enabling responses in the early stages of an attack and thereby effectively reducing the risk of system compromise. Specifically, deep learning models can extract multi-level feature representations from network traffic data, revealing potential attack patterns and anomalous behaviors. For instance, deep learning models can identify unusual traffic patterns, abnormal traffic spikes, and various other indicators of potential attacks, allowing for early warning and intervention before the attack fully unfolds. As deep learning technology progresses, its application in DDoS detection has become increasingly sophisticated and demonstrates significant performance improvements. These advancements enable deep learning methods to handle more complex and diverse attack patterns and show good detection results across various network environments [5]. However, these methods still face the challenge of data scarcity. In the context of big data,expanding datasets to enhance model performance is a feasible solution. However, this centralized model training approach typically requires uploading large volumes of data to central servers, which not only increases the burden of data transmission but also raises concerns about data privacy and security risks. Privacy vulnerabilities during data sharing have become another critical issue. Sharing data among different clients might expose sensitive information from the original data, allowing attackers to exploit this information for further attacks or breaches. Additionally, machine learning models often rely on large quantities of high-quality data to perform well. Insufficient or low-quality data from clients can negatively impact model accuracy and predictive capability [6], potentially leading to overfitting or instability in the model, thereby reducing DDoS attack detection effectiveness. Consequently, addressing the challenge of effective model training while ensuring data privacy and security remains a key issue in current network attack research. Innovative approaches are needed in model training processes to enhance learning effectiveness and detection accuracy while protecting data privacy. Federated learning (FL) provides a framework in which each local client trains a model using its own local data. Specifically, each client performs model training locally and uploads the resulting model parameters to a central server. The central server aggregates these parameters and generates a new global model based on the aggregated results. This global model is then distributed back to each client, and the process is repeated multiple times until the global model reaches the desired accuracy on the test set. A key advantage of federated learning is that it only uploads model parameters rather than raw data to the server, effectively protecting user data privacy. Additionally, federated learning offers benefits such as decentralized collaboration, scalability, and lower computational costs [7]. However, federated learning faces a significant challenge when dealing with non-IID (Non-Independent and Identically Distributed) datasets [8]. In federated learning, non-IID data can lead to imbalanced data distributions, which may affect the effectiveness of model training, making it difficult to train high-performance models on certain clients' data.