## 4 Intrusion Detection Systems Based on Federated Learning
### Comparative Analysis of Federated-Learning-Based Intrusion Detection Systems
#### 4.1.1 The Federated Learning-Based Intrusion Detection Systems for Smart Home Settings
After that, the authors compared the results of the global model with CNN and DNN (100-iteration training) using AUC. The average AUC of the three models are 0.908, 0.849, and 0.899, respectively. _Used metrics_:  
* TP, FN, FP, and TN;
* Accuracy;
* Precision;
* Recall;
* F1-score;
* AUC (area under curve)--the area of ROC curve;
* Time. _Advantages_:
* Implemented;
* Preserves the security and privacy of the model;* Describes and analyzes privacy-preserving mechanism;
* Discusses the optimal block file segmentation size in the fabric storage scheme (64 KB);
* Outperforms other models selected for comparison considering the selected metrics;
* The following threats are considered: DoS, Probe, R2L, and U2R. _Limitations_: While the paper describes the IDS for IoT, the dataset selected for the experiments is not the IoT dataset. Data partition is not considered. 4.1.2 The Federated-Learning-Based Intrusion Detection Systems for Industrial Cyber-Physical Systems  
Some researches consider industrial cyber-physical systems case. **A federated deep learning for intrusion detection in industrial cyber-physical systems [21]. **  
In [21], the federated deep learning is used for intrusion detection in industrial cyber-physical systems. The authors propose a deep learning model based on a convolutional neural network and a gated recurrent unit designed for detection of the denial-of-service, reconnaissance, response injection, and command injection attacks. In addition, the authors develop a federated learning framework and a Paillier public-key cryptosystem-based secure communication protocol to ensure the security and privacy of model parameters. The proposed intrusion detection scheme incorporates the following stages: (1) system initialization; (2) local model training by industrial agents; (3) model parameters encryption by industrial agents; (4) model parameters aggregation by the cloud server; (5) local model updating by industrial agents. _Federated learning architecture_. The proposed framework includes three types of entities, namely, a trust authority (it bootstraps the whole system, generates public and private keys, and establishes secure communication channels), a cloud server (builds a comprehensive intrusion detection model), and industrial agents (builds a local intrusion detection model based on its own data and updates the parameters of the intrusion detection model via interaction with the cloud server). _Implementation_. The authors implemented the proposed attack detection model using the Keras API [73]. The federated learning framework was built using Python framework Flask.2. The authors used for the experiments the Ubuntu 18.04.3 LTS platform with an Intel Xeon E5-2618L v3 CPU and an NVIDIA GeForce RTX 2080 TI GPU (64 GB RAM). _Dataset_. The authors used a gas pipelining system's dataset for the experiments [74]. The authors divided the dataset into training part (80%) and testing part (20%). They further divided the training part into even partitions for the industrial agents to implement local model training. The authors considered the following attacks: DoS, DDoS, command injection, response injection attacks, reconnaissance attacks, response injection attacks, and command injection attack. _Experiments_. The authors implemented [PERSON]'s [75], [PERSON]'s [20], and [PERSON]'s [76] models and compared them with their solution. In addition, the authors compared them with the local intrusion detection models built by each industrial agent and with the intrusion detection model generated in the centralized mode. The authors used 3, 5, and 7 industrial agents for the experiments and 2, 4, 6, 8, and 10 communication rounds. They trained all models on the same testing data. The experiments demonstrated that the proposed intrusion detection model allows obtaining higher performance than other models selected for comparison, as well as the local intrusion detection models. Furthermore, its performance is close to the ideal model results.