# FedDB: A Federated Learning Approach Using DBSCAN for DDoS Attack Detection
## 2 Related
Machine learning methods for DDoS attack detection have achieved high accuracy, and combining these methods with federated learning frameworks has produced satisfactory results for user data security and privacy. Federated learning offers several advantages. Firstly, it allows model training without transferring raw data to a central server, thus protecting sensitive information and enhancing user privacy. Secondly, federated learning enables multiple participants to collaboratively train a shared model while keeping data local, creating a cooperative environment without compromising personal data security. Additionally, federated learning minimizes the need for extensive data transfer, reducing communication overhead compared to traditional centralized machine learning methods, which is crucial for improving training efficiency, especially with numerous edge devices. Finally, federated learning can improve the accuracy and generalization of machine learning models by aggregating data from multiple clients. Regarding methods combining federated learning with machine learning, reference [5] proposes a decentralized DDoS classification method based on deep federated learning, allowing independent clients to train on local data while preserving data privacy. This framework employs a filter-based Pearson Correlation Coefficient (PCC) feature selection technique to select potential features, reducing model complexity and enhancing performance. The model achieved an excellent accuracy of 98.37% on the CICDDoS2019 dataset. Reference [16] designs a federated learning-based DDoS attack detection model called FLDDoS, incorporating a K-Means-based hierarchical aggregation algorithm and a SMOTEENN-based data resampling method. The results show a 4% improvement in accuracy and a 40% reduction in communication rounds compared to traditional methods. Reference [17] employs a lightweight residual neural network for detection and classification, deploying the classifier model within a federated learning framework, achieving DDoS traffic classification without data exchange and with fewer parameters. Due to the non-IID nature of data held by different clients in federated learning, training processes can become complex. This non-IID property may pose challenges in achieving a universal global model. References [18; 19] propose solutions to this issue. Reference [18] introduces FLD, a novel adaptive mechanism addressing the limitations of the FedAvg algorithm in non-IID data network security applications. FLD optimizes federated training processes by adjusting client selection and computation, achieving more efficient and precise model aggregation. Reference [19] utilizes a CNN model and data preprocessing algorithms to achieve 99% accuracy in DDoS attack detection, effectively handling non-IID data and providing personalized models for clients. Reference [20] proposes a novel Federated Intrusion Detection System (FIDS) to classify differences in non-IID concentrated DDoS attacks. The system introduces Prototypical Weights to measure the relevance between global and local data spaces and explores abnormal behavior feature combinations during preprocessing, enhancing training stability and convergence speed.