# FedDB: A Federated Learning Approach Using DBSCAN for DDoS Attack Detection
## 3 Methodology  
### Overview and Framework  
Our approach builds upon the FedMe [21] personalized federated learning framework, with modifications aimed at enhancing overall accuracy and incorporating an automatic adaptation mechanism. We have refined the model clustering method to improve the system's performance. FedMe facilitates model exchange between clients, enabling each client to train on local data with a personalized model. This approach allows for effective training even when clients utilize models with varying architectures, thereby supporting model adaptation and optimization tailored to each client's needs.  
In this setup, each client can adjust its personalized model based on the models exchanged with other clients. The decision to modify a personalized model is informed by the performance loss associated with exchanging models and local data. Additionally, FedMe features an automatic model architecture adaptation mechanism. This capability allows each client to modify the model structure according to the specific characteristics of its local data, thereby enhancing the accuracy of the model on the local dataset.  
Our methodology also incorporates deep mutual learning, wherein two models are trained concurrently by learning from each other's outputs. This approach leverages model clustering to mitigate the risk of overfitting due to noisy data. Specifically, we utilize the DBSCAN [22] clustering algorithm to group models into subsets with similar outputs. This grouping ensures that models with comparable behaviors are clustered together, enhancing the generalization ability and training efficacy of the federated learning system.  
Overall, FedDB offers a comprehensive solution for heterogeneous personalized federated learning by integrating model exchange, automatic adaptation, and model clustering mechanisms. These innovations collectively provide a robust framework for optimizing model performance across diverse client environments. Below are the implementation steps corresponding to the architecture diagram in Figure 1:  
Figure 1: FedDB architecture.  
The server initially distributes a model, and then the local clients generate personalized models;
2. Clients transmit their personalized models to the server for DBSCAN clustering;
3. The server decides which models to exchange with clients based on the results of model clustering and sends the exchanged models to the corresponding clients;
4. The server train personalized models and exchanged models using deep mutual learning;
5. The new exchange models are compared with the personalized models based on the loss values, and the better model is uploaded back to the server;
6. The server subsequently aggregates the better model (new personalized model) with the new exchange models to generate a new personalized model, which is finally distributed back to the local clients;
7. FedDB repeats steps 1 through 6 until the global communication count reaches the predetermined value T.  
We have adopted the CICDDOS2019 dataset for our research, which exhibits characteristics based on time-series data [23]. LSTM (Long Short-Term Memory) neural networks are particularly well-suited for handling sequential data, making them a fitting choice, especially for datasets with temporal dependencies. Thus, within the FedDB framework, we have selected the LSTM neural network for model training.