## 4 Intrusion Detection Systems Based on Federated Learning
### Comparative Analysis of Federated-Learning-Based Intrusion Detection Systems
#### 4.1.1 The Federated Learning-Based Intrusion Detection Systems for Smart Home Settings
_Used metrics_:  
* Accuracy \(=\) 99.20% for three industrial agents, 99.20% for five industrial agents, and 99.20% for seven industrial agents;
* Precision \(=\) 98.86% for three industrial agents, 98.85% for five industrial agents, and 98.85% for seven industrial agents;
* Recall \(=\) 97.34% for three industrial agents, 97.45% for five industrial agents, and 97.47% for seven industrial agents;* F-score \(=\) 98.08% for three industrial agents, 98.13% for five industrial agents, and 98.14% for five industrial agents. _Advantages_:
* Implemented;
* Preserves the security and privacy of the model;
* The experiments are performed on a real industrial cyber-physical systems (CPS) dataset;
* Outperforms other models selected for comparison considering the selected metrics;
* The following threats are considered: DoS, DDoS, command injection, response injection attacks, reconnaissance attacks, response injection attacks, and command injection attack;
* The cyberthreats against a federated learning framework are considered: eavesdropping of data resources, eavesdropping of model parameters. _Limitations_: Limited with industrial CPSs. Unfortunatly, the paper does not provide the experiment results by attack types. **A collaborative learning model for attack detection in industrial IoT [24]. ** In [24], the collaborative learning model for IoT is proposed. The cores of the approach are the smart \"filters\" for attack detection and prevention on IoT gateways. _Federated learning architecture_. The authors propose to use data collected from the network to train the model on the gateway and then share it with other gateways using a center server that aggregates the models. Thus, the authors use centralized architecture. _ML model_. Deep neural network to train models on the gateways and the average gradient update algorithm to aggregate these local models into the global model. _Implementation_. Prototype for the experiments. _Dataset_. KDD [77], NSLKDD [78], UNSW-NB15 [79], and N-BaIoT [68]. _Detected attacks_. The authors used an anomaly-based approach; thus, they demonstrate an ability to detect the attacks from the selected datasets with rather high accuracy, namely, denial-of-service (DoS), attack from remote to local machine (R2L), unauthorized access to local administrator user (U2R), probing attack, Mirai, and BASHLITE. _Experiments_. The authors distribute the dataset into different subnetworks (two and three) to train the local models. Using the selected datasets, the authors conducted the experiments using their intrusion detection solution and the following methods for comparison: centralized learning model for classification and anomaly detection, K-nearest neighbors classifier, K-means, decision tree, multilayer perceptron, logistic regression, and support vector machine. According to the provided results of the experiments, the proposed solution outperforms the other methods on the selected datasets. _Used metrics_:
* True positive (\(TP\)), true negative (\(TN\)), false positive (\(FP\)), and false negative (\(FN\)). * Accuracy (\(ACC\)), which is calculated as follows: \[ACC=\frac{1}{M+1}\sum_{m=1}^{M+1}\frac{TP_{m}+TN_{m}}{TP_{m}+TN_{m}+FP_{m}+ TFN_{m}},\] (2) where \(M+1\)--the total number classes for normal and attack traffic. The obtained values are as follows: for two subnets: 97.52% for the KDD dataset, 93.99% for the NSL-KDD dataset, 95.6% for the UNSW dataset, and for N-BaIoT dataset from 67.53% to 99.84%, depending on the IoT device; for three subnets: 97.54% for the KDD dataset, 93.37% for the NSL-KDD dataset, 95.67% for the UNSW dataset, and for N-BaIoT dataset from 67.27% to 99.84%, depending on the IoT device. * Privacy. * Time. _Advantages_:
* Implemented;
* Preserves the security and privacy of the model;* Outperforms other models selected for comparison considering the selected metrics;
* Anomaly-based and thus can detect attacks of various types;
* The performance in terms of accuracy, privacy, and time is evaluated.