## 5 The Experiments and Discussion
The comparison of temporal characteristics of training in FL mode and centralized one is omitted as training time is less than 1 min for 30 trees. The inference time turned out to also be significant, reaching 40 min to make a decision on the input sample. Such a significant duration of training and inference is explained by the use of homomorphic encryption. To use homomorphic encryption, it is necessary to convert floating-point numbers to an integer representation. Machine learning algorithms require switching between arithmetic operations such as multiplication and addition and non-arithmetic operations such as approximate activation functions (such as the logistic function) and piecewise polynomial functions (such as RELU). The implementation of both types of transformations is computationally expensive [41]. The duration of the training process is not critical when building an intrusion detection model, since it can be implemented in the daemon mode. The achieved accuracy of the model is quite high, which allows for speaking about the applicability of federated learning for intrusion detection in scenarios when the transmission of initial data is critical. However, extremely long inference time, as well as the requirement of the availability of the agent-hubs make intrusion detection systems based on the current implementation of \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**No.**} & **SecureBoost** & \multirow{2}{*}{**Trees Number**} & **Analysis Model** & **Processing** \\  & **Encryption Type** & & **Accuracy** & **Time** \\ \hline
1 & Normal & 3 & 91.9\% & 02:45:08 \\
2 & Fast & 3 & 90.4\% & 01:45:37 \\
3 & Normal & 15 & 97\% & 14:34:29 \\
4 & Fast & 15 & 96\% & 04:30:48 \\
5 & Normal & 30 & 99\% & 27:05:37 \\
6 & Fast & 30 & 97\% & 09:52:40 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The parameters of the intrusion detection model training when training in federated mode. \begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**No.**} & **Trees Number** & **Analysis Model Accuracy** \\ \hline
1 & 3 & 99.98\% \\
2 & 15 & 99.99\% \\
3 & 30 & 99.99\% \\ \hline \hline \end{tabular}
\end{table} 
Table 3: The parameters of the intrusion detection model training when training in a centralized manner. federated learning frameworks practically inapplicable. The response time of the intrusion detection system is one of the critical parameters of the evaluating efficiency of such systems. Thus, it is the procedure of logical inference, which is the critical point when considering federated learning for intrusion detection in the case of the vertical data partition. Therefore, the authors can conclude that, to apply this technology in practice, it is necessary to study the algorithms used to infer an already trained model distributed among many clients. The authors assume that a possible solution may be the use of differential privacy techniques to protect the intermediate results of inference. These techniques do not use cryptographic transformations. The anonymization of the transmitted data is carried out by introducing random noise into them. Another promising solution is to develop techniques that allow transforming vertical data partitions into horizontal ones, by mapping different sets of features in one feature space.