## 4 Experiments, Results, and Discussion
### Performance Evaluation
#### 4.4.2 Intrusion Detection using Federated Method  
We deployed our model for FL experiments with three multiple client sets, \(K\), with \(K=3\) (first set), \(K=9\) (second set), and \(K=15\) (third set). We utilized two cases to provide data to our various clients:  
* Independent and Identically Distributed (IID): The distribution of data across the dataset corresponds to the distribution of data for each client. * Non-Independent Identically Distributed (Non-IID): The distribution of data across the dataset is inconsistent with the distribution of data for each client. Table 5 compares the accuracy outcomes of the global models, the best clients, and the worst clients after the 1 st and 50 th FL rounds using both the data distribution sets. As can be observed, the performance for all classes increased as the round increased. It is pretty common that in the case of IID, there is a smaller performance gap between the worst and best clients. The difference, however, is always quite large for Non-IID because some clients only have a few classes. As an illustration, for CNN with \(K\) = 9, the difference between the best and worst clients is quite large at the 1 st FL round, but it becomes less for IID as we get closer to the 50 th round. However, the gap for Non-IID is still big. Additionally, it can be seen that the detection accuracy is fairly competitive with the centralized learnings. We can therefore conclude that our FL model is extremely efficient and ensures increased privacy. Table 5 lists the Best Client Accuracy, Worst Client Accuracy, and Global Model Accuracy as letters B, W, and G, respectively. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**Class**} & \multicolumn{2}{c}{**Accuracy**} & \multicolumn{2}{c}{**Precision**} & \multicolumn{2}{c}{**Recall**} & \multicolumn{2}{c}{**F\({}_{1}\)-Score**} \\ \cline{2-9}  & **CNN** & **RNN** & **CNN** & **RNN** & **CNN** & **RNN** & **CNN** & **RNN** \\ \hline Normal & **0.93** & **0.94** & **0.94** & 0.92 & 0.93 & 0.93 & **0.93** & 0.92 \\ DDoS\_UDP Attack & 0.90 & 0.91 & 0.94 & **0.95** & 0.88 & 0.87 & 0.91 & 0.91 \\ DDoS\_ICMP Attack & 0.82 & 0.81 & 0.81 & 0.78 & 0.84 & 0.82 & 0.82 & 0.80 \\ Ransomware Attack & 0.90 & 0.91 & 0.89 & 0.87 & 0.89 & 0.88 & 0.89 & 0.87 \\ DDoS\_HTTP Attack & 0.64 & 0.54 & 0.59 & 0.57 & 0.68 & 0.63 & 0.63 & 0.6 \\ SQL\_injection Attack & 0.64 & 0.68 & 0.66 & 0.67 & 0.61 & 0.69 & 0.63 & 0.68 \\ Uploading Attack & 0.72 & 0.78 & 0.77 & 0.82 & 0.62 & 0.77 & 0.69 & 0.79 \\ DDoS\_TCP Attack & 0.91 & 0.92 & 0.92 & 0.92 & 0.90 & 0.92 & 0.91 & 0.92 \\ Backdoor Attack & 0.43 & 0.54 & 0.46 & 0.51 & 0.42 & 0.59 & 0.44 & 0.55 \\ Vulnerability\_scanner & 0.67 & 0.62 & 0.63 & 0.56 & 0.67 & 0.54 & 0.65 & 0.55 \\ Port\_Scanning Attack & 0.76 & 0.81 & 0.78 & 0.86 & 0.79 & 0.76 & 0.78 & 0.81 \\ XSS Attack & 0.52 & 0.69 & 0.56 & 0.72 & 0.44 & 0.58 & 0.49 & 0.64 \\ Password Attack & 0.77 & 0.68 & 0.73 & 0.65 & 0.86 & 0.79 & 0.79 & 0.71 \\ MITM Attack & 0.92 & **0.94** & 0.91 & 0.93 & **0.93** & **0.95** & 0.92 & **0.94** \\ Fingerprinting Attack & 0.63 & 0.65 & 0.61 & 0.71 & 0.66 & 0.68 & 0.63 & 0.69 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Evaluation of the Centralized Model in Intrusion Detection. \begin{table}
\begin{tabular}{c c c} \hline \hline \multicolumn{1}{c}{**Classifier**} & **Parameter** & **Value** \\ \hline \multirow{8}{*}{CNN} & Convolutional layers & 2–3 Conv1D \\  & Filters & 16–74 \\  & Kernel size & 5 \\  & Pooling layers & 1 Global Average Pooling1D \\  & Hidden nodes & 120–130 \\  & Hidden layers & 3–4 \\  & Dropout & 0.1–0.5 \\ \hline \multirow{4}{*}{RNN} & Hidden nodes & 20–80 \\  & Hidden LSTM layers & 2 \\  & Dropout & 0.3 \\ \hline \multirow{4}{*}{Global} & Batch size & 100 \\  & Local epochs & 20 \\  & Global epochs & 50 \\  & Learning rate & 0.01–0.5 \\  & Regularization & 12 \\  & Loss function & categorical\_crossentropy \\  & Activation function & ReLu \\  & Classification function & SoftMax \\ \hline \hline \end{tabular}
\end{table}