## 1 Introduction  
Intrusion Detection Systems (IDS) are important components in modern cybersecurity infrastructures, designed to monitor network traffic and detect attacks, unauthorized access, or abnormal behavior [1]. One of the emerging threats in Internet access is the use of Domain Generation Algorithms (DGA), which enable malware to generate a large amount of pseudo-random domain names to establish command-and-control (C&C) communication [2, 3, 4]. More specifically, a benign domain might look like google.com, whereas a DGA-generated domain could be agsdjasa98.org, containing seemingly random characters and lacking the familiar grammatical structure that humans are accustomed to. This dynamic behavior makes traditional rule-based IDS ineffective, as they struggle to detect novel or previously unseen domains. At the same time, Federated Learning (FL) [5] has emerged as a promising approach to collaboratively train models across multiple decentralized devices without requiring raw data exchange. FL is particularly beneficial for IDS in distributed environments [6], such as edge computing or IoT networks, where data privacy and system scalability are crucial. However, FL introduces new challenges, particularly non-Independent and Identically Distributed (non-IID) data distributions, where each client's data reflects different local patterns and system heterogeneity--for instance, one router mostly sees corporate traffic while another sees home-user traffic, where clients vary in computational power and network conditions. Traditional FL approaches, such as FedAvg [5], often assume that all participating clients contribute equally. In practice, selecting clients solely based on computational capability may lead to the exclusion of \"_stragglers_\" (slow or resource-constrained devices) [7], some of which may hold critical or rare data, such as indicators of new DGA attacks. Several FL frameworks attempt to mitigate non-IID data by clustering clients according to the similarity of their model parameters (e.g., weight vectors) [8; 9; 10; 11], where similar parameters imply similar data distributions. However, this assumption often breaks down because, in order to improve the accuracy of clustering based on model parameters, the clients must be trained on their local data after each training round so that they can learn the characteristics of the data they possess. Therefore, these limitations may incur high communication and computational costs [12]. To overcome these challenges, we propose FedSAGE, a novel FL framework that integrates Variational Autoencoders (VAEs) for novelty client clustering. In our approach, each client leverages a shared VAE to project its local data into a compressed latent space representation. These latent vectors capture essential client data features and perform unsupervised clustering by using affinity propagation without requiring raw data sharing. This helps to group clients with similar data characteristics, especially in non-IID environments. Within each cluster, we apply a computation-aware selection strategy to choose only the fastest clients for participation in training, ensuring both training efficiency and energy savings. Consequently, this enables the system to detect different types of DGA attacks and avoid mistakenly removing clients that contain important attack-related data. The main contributions of this work are summarized as follows:  
* We introduce lightweight novelty detection where we leverage VAE latent space representations for accurate, privacy-preserving client unsupervised clustering for anomaly detection. * We propose FedSAGE, a federated clustering and client selection framework that jointly addresses data heterogeneity and system heterogeneity. * We evaluate our proposed method on a realistic testbed with multi-zone DGA for non-IID datasets and demonstrate the accuracy improvements in detection, clustering quality without sharing local data, and energy efficiency. These questions form the foundation of our proposed solution presented in the next sections.