# Enhancing Federated Intrusion Detection with Class-Specific Dynamic Sampling
## 3 DS-FedIDS
### Dynamic Sampling Formulations  
Dynamic Sampling Logic  
Let \(|\mathcal{D}k^{\mathcal{E}}|\) be the number of samples for class \(c\) at client \(k\). Define a target size \(T_{\text{class}}\) (e.g., average or user-defined). Then,  
\[\text{if }|\mathcal{D}k^{\mathcal{E}}|>T_{\text{class}}\quad\Longrightarrow\quad \text{downsample},\quad\text{else upsample}. \tag{1}\]  
This mitigates bias toward majority classes, leading to more robust learning of minority ones.  
In defining \(T_{\text{class}}\), our approach calculates \(T_{\text{class}}=|\mathcal{D}_{k}|/|\mathcal{C}|\), where \(|\mathcal{D}_{k}|\) represents the total number of samples for client \(k\), and \(|\mathcal{C}|\) is the number of unique classes in the local dataset. This data-driven threshold ensures that sampling adapts to the client-specific data distribution, balancing representation across classes while preserving the inherent characteristics of diverse traffic types. For example, in a client with 255,570 samples and 9 classes, \(T_{\text{class}}\approx 28,397\), dynamically adjusting to the dataset size and class diversity, thus mitigating the risk of distorting local traffic patterns through over- or undersampling.  
Algorithm 1 details how each client \(k\) modifies its local dataset \(\mathcal{D}_{k}\) by either downsampling or oversampling to achieve a more balanced training distribution. For each class \(c\), the sample count \(n_{c}=|\mathcal{D}_{k}^{c}|\) is compared against a threshold \(T_{\text{class}}\). If \(n_{c}\) exceeds this threshold, the algorithm randomly draws \(T_{\text{class}}\) samples (without replacement). Otherwise, it upsamples until \(T_{\text{class}}\) is reached by sampling with replacement. This straightforward procedure prevents a single majority class from dominating local training and ensures that minority (rare) classes receive sufficient gradient updates. Typically, \(T_{\text{class}}\) is chosen  
Figure 2: Sequence diagram of the DS-FedIDS training process, replacing pruning with dynamic sampling. Normal and attack data are used to compute balanced indices, enabling personalized local training while preserving global model insights.  
as the mean class size or a fraction of the maximum class size, or determined by other domain-specific heuristics. By facilitating balanced local training, this dynamic sampling strategy enhances personalized federated learning performance for intrusion detection, especially under severely imbalanced conditions.  
```
1:Local dataset \(\mathcal{D}_{k}=\bigcup_{c\in\mathcal{C}}\mathcal{D}_{k}^{c}\), class set \(\mathcal{C}\), target threshold \(T_{\text{class}}\) (e.g., mean or fraction of max)
2:Balanced dataset \(\mathcal{D}_{k}^{\prime}=\bigcup_{c\in\mathcal{C}}\hat{\mathcal{D}}_{k}^{c}\) (with up/down sampling applied)
3:\(\mathcal{D}_{k}^{\prime}\leftarrow\emptyset\)\(\triangleright\) Initialize empty balanced dataset
4:for all class \(c\in\mathcal{C}\)do
5:\(n_{c}\leftarrow|\mathcal{D}_{k}^{c}|\)\(\triangleright\) Count samples of class \(c\) at client \(k\)
6:if\(n_{c}>T_{\text{class}}\)then
7:Downsample:\(\hat{\mathcal{D}}_{k}^{c}\leftarrow\text{RandomSample}(\mathcal{D}_{k}^{c},\ T_{\text{class}},\ \text{replace}=\text{False})\)
8:else
9:Upsample:\(\hat{\mathcal{D}}_{k}^{c}\leftarrow\text{RandomSample}(\mathcal{D}_{k}^{c},\ T_{\text{class}},\ \text{replace}=\text{True})\)
10:endif
11:\(\mathcal{D}_{k}^{\prime}\leftarrow\mathcal{D}_{k}^{\prime}\cup\hat{\mathcal{D}}_ {k}^{c}\)
12:endfor
13:return\(\mathcal{D}_{k}^{\prime}\)\(\triangleright\) Final balanced dataset for client \(k\)
```  
**Algorithm 1** Dynamic Up/Down Sampling for Balancing Local Classes