# MDIFL: Robust Federated Learning Based on Malicious Detection and Incentives
## 3 Materials and Methods
### Node Selection
\begin{table}
\begin{tabular}{c c} \hline \hline
**Symbol** & **Description** \\ \hline \(p\) & Collection of participants \\ \(\beta\) & Reputation weighting factor \\ \(mP_{i}\) & Malicious participant \\ \(gP_{i}\) & Suspected as malicious participant \\ \(gP_{i}\) & Good participant \\ \(\Delta\omega_{g}^{t}\) & Global gradient of round t \\ \(\Delta\omega_{i}^{t}\) & Local gradient of participant \(P_{i}\) in round t \\ \(R_{i}^{t}\) & Cosine similarity between \(\Delta\omega_{g}^{t}\) and \(\Delta\omega_{i}^{t}\) \\ \(\lambda_{1}\) & Threshold for judging malicious nodes 1 \\ \(\lambda_{2}\) & Threshold for judging malicious nodes 2 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Symbol table. participates in global aggregation, which may eventually degrade the performance of the entire model. Equation (2) shows the judgment method of malicious nodes. \[P_{i}=\left\{ \begin{aligned} mP_{i},&\quad if \quad R_{i}^{t}<\lambda_{2}\\ sP_{i},&\quad if\quad\lambda_{2}\leq R_{i}^{t}<\lambda_{1}\\ gP_{i},&\quad if\quad R_{i}^{t}\geq\lambda_{1}\end{aligned} \right. \tag{2}\]  
\(mP_{i}\), \(sP_{i}\) and \(gP_{i}\) refer to identified malicious nodes, suspected nodes and high-quality nodes, respectively. Here, we need to set two thresholds as \(\lambda_{1}\) and \(\lambda_{2}\) as a criterion for judging malicious nodes. This can be divided into three situations:  
Case1: When \(R_{i}^{t}\) is less than \(\lambda_{2}\), the participant \(P_{i}\) is set as the malicious node \(mP_{i}\) and the node is prohibited from continuing to participate in this federated learning model training task. Case2: When \(R_{i}^{t}\) is greater than \(\lambda_{2}\) and less than \(\lambda_{1}\), the participant \(P_{i}\) is set as the suspected node \(sP_{i}\). At this time, the participant may be malicious, or may have low cosine similarity due to low-quality local data or low computing power, but it has little impact on model training. Such actors cannot appear more than once, otherwise it will degrade the performance of the whole model. Therefore, when the number of suspected nodes \(sP_{i}\) is greater than 3, it is also forbidden to continue to participate in this federated learning model training task. Case3: When \(R_{i}^{t}\) is greater than \(\lambda_{1}\), the participant \(P_{i}\) is set as a high-quality node \(gP_{i}\), and is allowed to continue to participate in this federated learning model training task. In addition, you need to pay attention to the setting of the threshold \(\lambda\). If the threshold \(\lambda\) is set to be small, malicious nodes cannot be accurately identified, but if the threshold \(\lambda\) is set large, it is easy to judge high-quality nodes as malicious nodes. Here, we have obtained a relatively suitable value range of the threshold \(\lambda\) based on a large number of test experiments and experience. At the same time, the threshold \(\lambda\) can also be set to an appropriate threshold \(\lambda\) according to the security expectations of different schemes and different data. Similarly, the allowed number of occurrences of \(sP_{i}\) can also be set according to the safety expectation. When the safety expectation is low, multiple occurrences of \(sP_{i}\) can be allowed, and on the contrary, the number of occurrences of \(sP_{i}\) will be reduced. The malicious node detection mechanism we proposed effectively avoids the situation where participants do not do evil in the early stage, accumulate a large number of reputation scores, and then destroy the global model to a large extent. It also allows participants to appear as case2 no more than three times, so as to avoid misjudgment. The specific detailed implementation is given in Algorithm 1.