## 4 Intrusion Detection Systems Based on Federated Learning
### Comparative Analysis of Federated-Learning-Based Intrusion Detection Systems
#### 4.1.1 The Federated Learning-Based Intrusion Detection Systems for Smart Home Settings  
There are several papers that consider Smart Home test cases. **An FL-enabled IDS approach based on a multiclass classifier [28]. **  
In [28], the authors evaluate an FL-enabled IDS approach based on a multiclass classifier. They consider different data distributions for the detection of different attacks in an IoT scenario. _Federated learning architecture_. The authors used centralized architecture. Namely, they applied an IBM framework for Federated Learning (IBMFL) [5]. It was set up for 10 clients that corresponded to 10 IoT devices and one aggregating server. _ML method_. The authors applied a multi-class probabilistic classification model using multinomial logistic regression (softmax regression) [58]. _Implementation_. The authors used the IBM framework for Federated Learning IBMFL [5] and FedAvg [59] and Fed+ [60] aggregation methods. To implement the logistic regression algorithm, the Scikit-learn SGDClassifier (stochastic gradient descent) was used. _Dataset_. The authors used the ToN_IoT dataset for the experiments [61]. They implemented three different partitions for the selected ToN_IoT dataset: (1) based on the destination IP address; (2) balanced the data considering the attacks across the clients; (3) hybrid approach, where the authors used the Shannon entropy to find the compromise between the attack types balance and the destination IP address [62]. The considered attacks are backdoor, DoS, DDoS, injection, MITM, password, ransomware, scanning, and XSS. _Experiments_. The authors used a Lenovo laptop with an AMD Ryzen 7 4800H with Radeon Graphics, and 16 GB of RAM for the experiments. Based on the different data distributions the authors created three scenarios of the experiments, namely, basic scenario using the partition (1), the balanced scenario using the partition (2), and the mixed scenario using the partition (3). The model was trained on 300 rounds for each scenario with aggregation after each epoch. Additionally, the authors measured the accuracy of the model trained by each client independently from other parties in a distributed scenario. Finally, they measured the accuracy of the model trained in centralized mode that is equal to 0.724 using multinomial logistic regression. The results of the experiments demonstrated that Fed+ provides higher average accuracy than FedAvg for the considered federated scenarios. For the basic scenario, accuracy is about 0.8725 using Fed+ and 0.8718 for the distributed method. For the balanced scenario, the accuracy is 0.9039 for Fed+ and 0.9065 for the distributed setting. For the mixed scenario, accuracy using Fed+ is 0.8869 and 0.877 for the distributed case. _Used metrics_:  
* Accuracy, which is calculated as ratio of (true positives + true negatives) to the (true positives + false positives + false negatives + true negatives);
* Precision, which is calculated as ratio of true positives to the (true positives + false positives);
* Recall, which is calculated as ratio of (true positives) to the (true positives + false negatives);
* F1-score, which is calculated as ratio of (recall \(\times\) precision) to (recall+precision) multiplied on 2;
* False positive rate (FPR), which is calculated as ratio of false positives to the (false positives + true negatives). _Advantages_:  
* The impact of non-independent and identically distributed data is considered;
* Different aggregation methods are considered;
* Different data distributions are considered;
* Different training rounds are considered;
* The attacks detection is considered to deploy the most effective countermeasures dynamically;
* The Fed+ is used firstly for the FL-enabled IDS for IoT. _Limitations_:
* The research is only focused on the impact of different data distributions;
* The network traffic from IoT_ToN dataset is used without consideration of the IoT devices telemetry. **A federated self-learning anomaly detection system for IoT--DIoT [20].