# Federated Learning for Cybersecurity: A Privacy-Preserving Approach
## 4 Experimental Setup and Evaluation
### Datasets Used  
Several publicly available and widely recognized datasets were used to evaluate the performance of the proposed FL framework in cybersecurity applications. These datasets were selected to represent realistic and diverse network traffic patterns, including both benign behavior and different types of cyber-attacks. The primary datasets integrated into the experimental setup are as follows:  
* CICIDS2017: This dataset, developed by the Canadian Institute for Cybersecurity, includes network traffic for benign activity and multiple attack types, such as DoS, DDoS, port scans, and web-based intrusions. The dataset was generated in a real enterprise environment using realistic scenarios and contains over 3 million labeled flows across more than 80 extracted features [14]. Figure 3: Experimental testbed architecture. * TON_IoT: This dataset, provided by the Cyber Range Lab of UNSW, includes telemetry data, network traffic, and system logs collected from various IoT and IIoT devices within smart environments. The dataset offers multi-source data for evaluating AI-based intrusion detection in heterogeneous IoT systems [38]. * NSL-KDD: NSL-KDD is a refined version of the original KDD'99 dataset that removes redundant records and balances class distribution. It remains a widely used benchmark for testing intrusion detection algorithms and includes four primary attack classes: DoS, Reverse to Local (R2L), User to Router (U2R), and Probe [39]. To simulate a non-IID data distribution among clients, each dataset was divided and randomly assigned to edge nodes, favoring specific attack types. This approach replicates the heterogeneity typical of real-world IoT environments, in which clients face different threat profiles. Each node executed a local preprocessing pipeline comprising the following steps:  
* Missing value imputation: Null or missing values in numerical features were replaced using feature-wise mean imputation to ensure data completeness while minimizing distributional distortion [1]. * Feature scaling (MinMax normalization): All numerical features were rescaled to the \([0,1]\) interval using MinMax normalization to ensure uniform feature influence during model training and accelerate gradient convergence [2]. * One-hot encoding of categorical features: Categorical variables (e.g., protocol type or service) were transformed into binary vectors via one-hot encoding to enable compatibility with neural network models while preserving non-ordinal relationships. * Attack label remapping for class balance: The original attack labels from the datasets (e.g., DoS, Probe, R2L and U2R) were remapped into broader categories to reduce class imbalance and enhance the classifier's ability to generalize. This relabeling aligns with standardized taxonomy schemes used in intrusion detection literature [3]. Preprocessing was performed locally on each node and included data cleaning, feature extraction, normalization, and one-hot encoding of categorical features. The data preprocessing pipeline is illustrated in Figure 4, which shows the transition from raw data ingestion to local model training augmented with privacy-preserving mechanisms. Figure 4 summarizes the pipeline adopted for dataset integration and preprocessing prior to federated training. First, the raw datasets--CICIDS2017, TON_IoT, and NSL-KDD--were parsed and cleaned to remove redundant or corrupted entries. Then, each dataset underwent a standardized preprocessing routine that included imputing missing values using statistical heuristics; normalizing via MinMax scaling to ensure uniform input ranges across features; and one-hot encoding for categorical attributes. This ensured compatibility with deep learning models. This preprocessing step was conducted locally on each client node to preserve data locality and prevent raw data leakage. Then, the processed datasets were fed into the local training modules. Here, privacy mechanisms, such as lightweight, AES-based symmetric  
Figure 4: Dataset integration and preprocessing workflow.