## 4 Intrusion Detection Systems Based on Federated Learning
### Comparative Analysis of Federated-Learning-Based Intrusion Detection Systems
#### 4.1.1 The Federated Learning-Based Intrusion Detection Systems for Smart Home Settings
LimitationsUnfortunately, the paper does not provide the experiment results by attack types. While the approach is proposed for Industry 4.0, only one from the tested datasets is devoted to IoT and it contains traffic from the Smart Home IoT devices. While the authors conduct the performance evaluation, they do not provide the characteristics of the testbed for the experiments. Unfortunately, it is also impossible to evaluate privacy and time performance results as soon as the metrics used are not explained. The details of the privacy-preserving mechanism and dataset partition are not provided. FL-based intrusion detection in cyber-physical settings in the example of the water treatment facility [4]. In [4], authors also study the problem of the intrusion detection in cyber-physical settings in the example of the water treatment facility. The key distinction from the previous research is that the authors focus on the case of vertically partitioned data and propose a way to model it by grouping readings from the sensors on the basis of the stages of the technological process. Federated learning architectureThe authors propose to supplement every technological process with an intelligent agent-hub that not only registers data from sensors but also performs local training using them. These hubs are coordinated by an additional aggregating server located together with the central server of the SCADA system. This server is also responsible for controlling the global model performance and initiation of its training process. ImplementationTo implement the proposed approach, the authors used Federated AI Technology Framework [80] that is considered by the IEEE P3652.1 Federated Machine Learning Working Group as a standard-setting FL framework [15]. ML modelThe choice of the ML model was defined by the algorithms available in FATE framework for vertically partitioned data. The authors evaluated gradient boosting decision trees (GBDT) with Paillier homomorphic encryption. DatasetThe SWAT2015 dataset [81] was used in the experiments. This dataset models the functioning of the secure water treatment facility during 12 days and it contains both network data and data from sensors. In [4], a dataset with readings from physical sensors was used. To model vertically partitioned data, it was split into five groups based on technological process. Detected attacksThe SWAT dataset contains a set of attacks that are targeted to inject control signals in order to manipulate the system state and cause the sensor's degradation. ExperimentsThe authors performed two series of the experiments in which the goal was to compare the efficiency of the federated learning in CPS use case. In the first series, the authors modeled the FL settings with five clients with vertically partitioned data, and in the second case, they performed experiments on the initial dataset to evaluate the impact of the FL. Used metrics:
* Accuracy;
* Time of the training and inference time. AdvantagesPreserves the security and privacy of the model as the additional homomorphic encryption is implemented to secure clients inputs;
* The accuracy of GBDT in FL mode is comparable with GBDT in centralized mode, reaching 99% of the accuracy;
* The performance in terms of accuracy, privacy, and time is evaluated. LimitationsMajor limitation of the approach is the duration of the inference--it takes approximately 40 min, which is unacceptable for intrusion detection;* The choice of the metrics assessing the models are limited by the FATE framework;
* The aggregation algorithm does not tolerate clients' dropouts.