## 5 Simulation Results and Discussion
### Results Discussion
With an MSI of 97.5%, Accuracy of 99.0%, and FAR of 2.5%, FL ResVGG-SwinNet effectively detects malicious activities with few false positives. The model's hybrid architecture combines ResNet's robust feature extraction, VGG's deep layer refinement, and Swin-Transformer's contextual attention methods to improve performance. This lets the model capture complex attack patterns while being computationally efficient. The federated-learning architecture also enhances accuracy by adapting to diverse IoT settings. With an AUC of 99.3% and an OES of 93.0%, the model demonstrates good classification performance with minimum computational expense. The Recall (98.7%) and F1-Score (98.5%) demonstrate its balanced approach to identifying various attacks while minimising false negatives. These findings show the suggested method's accurate and scalable intrusion detection in federated contexts. The inability to properly utilise contextual dependencies or manage IoT traffic limits the performance of alternative models like Hybrid LSTM-GRU and FedAGRU. FedeX and FeDiToT perform well but struggle with sophisticated attack scenarios and resource optimisation. Table 5 highlights FL ResVGG-SwinNet's enhanced intrusion detection accuracy and efficiency with a specialised architecture and federated methodology. Figure 4:2 Confusion matrices for (**a**) CIC-DDoS2019, (**b**) UNSW-NB15, and (**c**) IoT23 datasets. Figure 4:3 ROC curve comparison across models. Table 6 details each client's contribution to the federated-learning architecture. The CIC-DDoS2019, UNSW-NB15, and IoT23 datasets include 109,433 to 112,700 samples from clients. Despite different data distributions, the federated-learning framework efficiently trains models with excellent accuracy, with local accuracy exceeding 96%. Weight update magnitudes are constant across clients, suggesting balanced global model contributions. Different dataset sizes and computing resources affect communication overhead percentages. These findings demonstrate how the federated strategy integrates disparate client contributions to create a robust global model without affecting client performance. \begin{table}
\begin{tabular}{l c c c c c c c c c} \hline \hline
**Model Name** & **Iteration** & **Clients (CL)** & **MS1 (\%)** & **Accuracy (\%)** & **FAR (\%)** & **Log Loss** & **AUC (\%)** & **OES (\%)** & **F1-Score (\%)** \\ \hline \multirow{6}{*}{FL-LSTM [12]} & \multirow{6}{*}{\(1\)} & CL = 1 & 83.5 & 91.8 & 8.9 & 0.19  
Table 7 displays the convergence of the global federated-learning model across 30 communication cycles. Loss drops from 0.310 in round 1 to 0.140 in round 30, but accuracy, precision, recall, and F1-Score rise. By round 30, the global model achieves an exceptional accuracy of 98.1% and F1-Score of 97.8%. These findings show that the system can use client contributions and improve throughout communication rounds for high-performance DDoS attack detection. Table 8 analyses optimisation efficiency for each client, including computation time, memory utilisation, energy consumption, and Optimisation Efficiency Score (OES). Computation times are 120-150 s, and energy usage is below 0.42 kWh. All customers' OES values surpass 0.89, demonstrating the system's efficiency in balancing computing needs across varied datasets. In Table 9, fairness in federated learning is assessed by analysing local model correctness, global model effect, and fairness index across three datasets and clients. Data