# CGFL: A Robust Federated Learning Approach for Intrusion Detection Systems Based on Data Generation
## 3 Methods
### Data Generation Module  
Using the label-corrected training set, \(\tilde{D}_{\text{train}}\), the data generation module is designed to create new training samples through the generator network \(G\). This module expands the training dataset by synthesizing both normal and malicious samples consistent with the underlying data distribution. Notably, new malicious data is expected to appear in two specific regions of the data distribution. The first region, referred to as \(B_{M}\), represents the boundary area of normal data. Since sophisticated attackers often mimic normal behavior to evade detection, emerging malicious samples may increasingly resemble normal data, situating themselves near the outer boundary of the normal data distribution. The second region, termed \(B_{O}\), lies outside the original dataset. Novel attack techniques, such as zero-day exploits, can lead to harmful data that is entirely distinct from both normal and previously known malicious data, appearing in areas beyond the original dataset's scope. However, generating additional malicious training samples exclusively in \(B_{M}\) and \(B_{O}\) could exacerbate data imbalance. An excessive volume of malicious samples in specific regions might cause the machine learning model's decision boundary to shift toward normal data regions, thereby increasing the likelihood of harmful predictions. To address this, the module also generates samples within the internal boundary of the normal data, referred to as \(B_{N}\). This approach reduces false positives and improves overall classification performance. Figure 4 illustrates the various data generation strategies. The paper then organizes the newly sampled training data from each target region into a standardized format, representing them as probability distributions. The reformulated training data can be expressed as follows:  
Figure 4: Introduction to three data augmentation strategies. \[P(x)= \begin{cases}C&\text{if }p_{M}(x)<\omega\text{ and }\varphi_{1}\leq p_{N}(x)< \varphi_{2},\\ \tau_{1}\cdot\frac{1}{p_{M}(x)}&\text{if }p_{M}(x)\geq\omega,\\ \tau_{2}\cdot p_{N}(x)&\text{if }p_{M}(x)<\omega\text{ and }p_{N}(x)<\varphi_{1},\\ \tau_{3}\cdot\frac{1}{p_{N}(x)}&\text{if }p_{M}(x)<\omega\text{ and }p_{N}(x)\geq \varphi_{2}.\end{cases}  \tag{3}\]  
\(C\) is a constant that is employed to guarantee the normalization of the distribution. Regularization terms \(\tau_{1}\), \(\tau_{2}\), and \(\tau_{3}\) are employed to regulate the regularity of the distribution and the diversity of sample generation. \(\omega\), \(\varphi_{1}\), and \(\varphi_{2}\) preset thresholds that regulate target area size and position. In traditional GANs, the discriminator network effectively differentiates between \"real\" and \"fake\" data when their distributions exhibit minimal overlap. Under these conditions, the generator network \(G\) often encounters issues such as gradient explosion or vanishing gradients during updates. To address these challenges, this research enhances the GAN model for data generation, enabling it to produce new data aligned with the distributions of the three target regions. Unlike conventional GANs that aim solely to replicate the original training data distribution, this improved model adapts the loss function to capture the target distributions, as illustrated in Figure 5. The model architecture includes three generator networks, one discriminator network, and a classifier network. Each generator specializes in generating data corresponding to a specific target distribution (\(P_{B_{M}}(x)\), \(P_{B_{O}}(x)\), or \(P_{B_{N}}(x)\)). The discriminator facilitates adversarial training by classifying the newly generated data. The classifier calculates the posterior probability \(P(c\mid x)\), where \(c\) represents the class label and \(x\) signifies the input data. This architecture enables the model to generate diverse and realistic data tailored to the target regions, effectively addressing the limitations of traditional GANs.