## 3 Intrusion Detection Systems
The hierarchical distributed architecture for the IDS is also proposed for attack and anomaly detection in cyber-physical systems such as smart grids [46; 47; 48]. Typically, the smart grids are composed of different collaborating entities, including power stations, end users represented by Smart Home energy management systems, and legal controlling entities. The hierarchy of the local IDS systems could be constructed either based on type of the collaborating entity [46; 47] or based on \"intrusion boundaries\" that limit the damage propagation in case of the successful attack [48]. Thus, it is possible to outline that modern IDS systems and FL-based systems share two common properties that define the choice of architectural solution: they are, namely, communication scheme (or topology) and requirements to the computational resources of the nodes with IDS agents. The architecture of the decentralized FL system correlates with the distributed IDS with peer-to-peer IDS agents, while centralized communication scheme of the FL system is close to the hierarchical IDS, in which local IDS agents or clusters of peer-to-peer agents communicate with the master IDS component to produce final decision. The characteristics of the cloud environment of the IDS are close to cross-silo FL settings,  
Figure 4: The high-level overview of the hierarchical distributed IDS for Smart Home systems. Figure 3: Basic IDS architecture. when the collaborating entities have enough computational and storage resources. An IDS for an IoT-based environment must consider similar constraints imposed by controlled devices as the FL system for cross device settings, i.e., power consumption, computing resources, and bandwidth availability. There is no obvious matching for data partition property of the FL systems, though this property is extremely important when designing analytical system based on the FL principles. The majority of the existing FL frameworks support horizontally partitioned data [49]. In terms of the intrusion and anomaly detection, the network-based IDS could be considered as clients with horizontally partitioned data, as they typically operate with a certain set of attributes extracted from the network traffic, and the case of host-based IDS could be considered as the case of vertically partitioned data, as they operate with logs from different applications that have different format. Similarly, IDS agents in the cloud environment tent to have similar sets of analyzed attributes, while IDS agents deployed in the IoT-based settings need to process various features characterizing same objects as they collect data from a large variety of heterogeneous sensors. The main benefit of the application of the FL technology for the IDS is the ability to reduce risks associated with sensitive and personal data processing. When the collaborating entities are presented by the commercial organizations, critical infrastructures, the usage of the FL increases the trust level between them and their security service provider as they also do not need to share their sensitive data, and at the same time they enable sharing knowledge about attacks and anomalies in the privacy-preserving manner. For the IoT-based environment, FL also allows reducing the network traffic which is an important factor in the condition of the energy-efficient networking and enables support of large scale of heterogeneous devices and sensors. At the same time, the application of federated learning imposes certain requirements on the computational power of the entity that performs local model training, as well as on its storage capacity in order to store the data for training. Therefore, when designing a system, it is extremely important to evaluate the throughput of the FL-based analysis system. The need to consider these issues determined the main goals of this study, and the evaluation criteria and the results of the research are presented in the next sections.