## 3 Methodology
### FL with DNN  
FL is a decentralized machine learning approach where a global model is learned by combining locally trained models from data-generating clients, allowing a wide array of participants, such as smartphones and connected vehicles, to contribute to the learning process. The FedAvg algorithm, short for federated averaging, is a fundamental component of FL that facilitates the aggregation of these locally trained models. The process begins with the initialization of global model parameters, denoted as \(w^{0}\), and proceeds iteratively. Figure 3: Collaborative anomaly detection process in CIDS based on FL-DNN and DLT. During each communication round, every client \(i\) trains a local model using its data and the current global model parameters, represented as \(w_{i}^{l}\) at communication round \(t\). These local models are then shared with the server. The server receives a set of models \(\{w_{i}^{l}\}\) from all clients. The aggregation step occurs at the server, where the received local models are averaged to update the global model. The updated global model parameters are calculated as Formula (1). \[w^{(t+1)}=\frac{1}{N}\sum_{i=1}^{N}w_{i}^{t} \tag{1}\]  
where \(w^{(t+1)}\) represents the updated global model parameters after communication round \(t+1\), and \(N\) denotes the total number of clients participating in FL. This process repeats for several communication rounds until the model convergence criteria are met. FedAvg harnesses the collaborative power of decentralized data sources while ensuring the privacy of individual clients in the FL framework [26; 27]. Furthermore, this research presents a CIDS capable of monitoring heterogeneous setups from an IoT network. The strategy involves combining a DNN with FL. Network data are collected in each edge device. Individual DNN base classifiers, trained on these devices, capture network-specific patterns. The weight of DNN classifiers from each network is averaged using FedAvg in fog devices. The system continuously adapts to changing network dynamics by updating the global DNN classifiers with new weights from each edge and fog device. A DNN is a type of machine-learning algorithm that takes inspiration from the human brain. It comprises three main components: an input layer, an output layer, and one or more hidden layers. These hidden layers process input data from the input layer to generate output through a series of transformations. Each layer contains perceptrons, which are units that process data using input values (\(x_{i}\)) and weight values (\(w_{i}\)). The inputs and weights are combined using summation and bias addition, as shown in Formula (2) for a hidden layer. \[z=\sum_{i=1}^{n}(x_{i}\cdot w_{i})+b \tag{2}\]  
\[a=\text{ReLU}(z)=\text{max}(0,z) \tag{3}\]  
\[\hat{y}=\sigma(z)=\frac{1}{1+e^{-z}} \tag{4}\]  
The output of this summation and bias addition undergoes an activation process before being outputted. This study employs rectified linear unit (ReLU) activation in hidden layers and sigmoid activation in the output layer. ReLU aids in capturing intricate data patterns, while sigmoid in the output layer offers a probabilistic view of the model's predictions, making it suitable for classification tasks. By combining these activation functions, the neural network architecture becomes more robust and efficient. The ReLU activation in the hidden layer is represented by Formula (3), while the sigmoid activation in the output layer is shown in Formula (4). For training, this research focuses on a binary classification task related to cyber attacks. Stochastic gradient descent (SGD) is utilized as the optimizer during the DNN training process. SGD is an optimization algorithm commonly used in training neural networks. It updates model parameters iteratively based on minibatches of training data.