## 3 Proposed Method  
In conventional settings for anomaly detection, training data from the objects to be modeled is utilized to construct the model. However, the IIoT environment creates challenges for this method. As IIoT devices are primarily single-function devices with limited capabilities, they do not generate massive volumes of data. This makes it difficult to train a model using only data collected from a user's local network, as it may take some time to collect sufficient data for training a consistent model. This needs a method that combines training data from several users into a single local training dataset, thus accelerating the learning of a stable model. FL clients are those end devices (e.g., a local Wi-Fi router) that collect data from their respective connected IIoT devices. In a FL environment, each FL client trains a local model utilizing locally accessible training data, as opposed to transmitting data to a central entity as in a fully centralized learning architecture. After that, the learnings from those local trainings are transmitted back to the global server for aggregation. At the global server, the model is again improved by global training and distributed back to the local FL clients for the next FL iteration. By this way, both the global and local models get improved and can effectively classify the intrusions and benign traffic inside an IIoT dataset. This section describes and explains the operation of our proposed approach in detail.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Year** & **Reference** & **Dataset** & **Classifier/Algorithm/Framework** & **Findings** \\ \hline \multirow{4}{*}{2022} & \multirow{4}{*}{[22]} & \multirow{4}{*}{[23]} & \multicolumn{3}{c}{In order to identify cyber threats in smart IoT systems, including smart homes, smart e-healthcare systems, and smart cities, this federated DL intrusion detection system was proposed. In order to train the GAN network using augmented local data and serve as a classifier, they distributed it among IoT devices. By comparing the convergence and accuracy of the model, they showed that their model worked better and converged faster than most standalone IDS. \\ \hline \multirow{4}{*}{2022} & \multirow{4}{*}{[23]} & Car Hacking & \multirow{4}{*}{GRU with a RF-based ensemble unit} & This approach makes it possible to share computing resources and train using vehicular sensor devices. An RF-based ensemble unit and a group of GRU are used in the suggested method to improve the performance of attack detection. \\ \hline \multirow{4}{*}{2022} & \multirow{4}{*}{[25]} & TON\_IoT, Edge\_IIoTset, EMBER, and ECU-IoTHT & \multirow{4}{*}{LightGBM, BERT-based Transformer, and BiLSTM} & This method consists of two parts: an IDS for medical devices installed on the healthcare network and a malware detection system for data servers and medical staff devices. The goal was to protect the entire network, regardless of the devices and computers installed. The limitation is that it demands the installation of numerous systems across the healthcare network. Additionally, a correlation procedure is needed to compile the outcomes. \\ \hline \multirow{4}{*}{2023} & \multirow{4}{*}{[25]} & \multirow{4}{*}{Edge\_IIoTset} & We have proposed an FL approach for IIoT intrusion detection in order to train the models at the local device end and accumulate their learning to ensure enhanced security against unwanted attacks. We have deployed two deep learning classifiers, namely, CNN and RNN, for both centralized ML and FL. We have utilized the Edge-IIoTset dataset [7] (which contains real-world data about different types of attacks) to demonstrate a thorough evaluation and our method’s performance. \\ \hline \hline \end{tabular}
\end{table}
Table 1: _Cont._