## 4 Intrusion Detection Systems Based on Federated Learning
### Comparative Analysis of Federated-Learning-Based Intrusion Detection Systems
#### 4.1.1 The Federated Learning-Based Intrusion Detection Systems for Smart Home Settings
For the edge case, the authors divided the BoT-IoT dataset into four smaller client datasets according to the source IP address. Each dataset then was divided into a training and testing set. _Experiments_. The authors compared the complexity of traditional neural network and the proposed Lockedge method. The experiments for different number of the neurons showed that that the neural network complexity is higher than Lockedge complexity, while the training time of Lockedge is lower than neural network. Then, the authors compared the performance of the centralized Lockedge with the neural network model (without the feature processing). They varied the number of neurons in the hidden layer from 6 to 46. The accuracy of the centralized Lockedge (about 0.999) is higher than NN (0.997). The authors also evaluated the average detection rate for each attack type using Lockedge, NN, DNN, recurrent neural network (RNN), and convolutional neural network (CNN). The comparison shown that the Lockedge demonstrates results better than, or close to, other methods, except the DoS-HTTP and data theft attack. The authors also compared the centralized Lockedge with such machine learning algorithms as K-nearest neighbors (KNN), decision tree (DT), random forest (RF), and support vector machine (SVM). The average detection rate of the centralized Lockedge is higher than the other methods in most classes. According to the paper, the precision of the centralized Lockedge, as well as F1-score, are higher than the values obtained by the other solutions. The authors also analyzed the performance of the training and detection at the edge. They performed feature extraction using joined training dataset, while the detection models were trained separately. They evaluated the resulting global model using four different test datasets after each communication round. The number of communication rounds is 1000 and the number of local epochs was set to 1. The accuracy stopped increasing and the loss stopped decreasing after about 350 communication rounds, giving results comparable to the centralized approach. In terms of F1-score, detection rate, and precision, some types of attacks (DoS-HTTP, DDoS-HTTP and theft-data) give worse results than in centralized mode. Finally, the authors evaluated the edge computing capacity. The authors loaded traffic of 400 to 2400 samples per second to the PI3. The rate of 2400 samples per second leads to 100% of the CPU usage of a core among a quad-core. The authors also found out that the CPU usage increases exponentially as the attack rate increases, and they conclude that the maximum attack rate for the Pi3-based edge is 9600 samples per second. The memory usage of the PI3 also increases with the attack rates growth. It can process up to 1800 samples per second. _Used metrics_:  
* Complexity of the algorithms;
* The training time performance (the time of reading data for the training phase);
* Accuracy (the total number of correctly predicted samples in all tests);
* Detection rate (DR) (the number of the actual positives that are predicted as positive);
* Precision (the ratio of true positives to the (true positive + false positive);
* Recall (the ratio of true positives to the (true positive + false negative);
* F1-score (2 multiplied by the ratio of (precision
* recall) to the (precision + recall));
* CPU and RAM usage. _Advantages_:  
* Novel attack detection mechanism LocKedge is introduced; the experiments show the higher performance of the proposed mechanism compared to other ML methods;
* The real traffic BoT-IoT dataset is used;
* The edge computing capacity is evaluated. _Limitations_: detection rate of DoS-HTTP, DDoS-HTTP, and theft-data attacks is lower than for other types of attacks. **A distributed ML-based IDS between organizations**[57; 71]**. In [57; 71] authors proposed a hierarchical distributed IDS based on FL. [PERSON] et al. [57] adopted FL to design a distributed ML-based IDS between organizations.