# Trustworthy AI and Federated Learning for Intrusion Detection in 6G-Connected Smart Buildings
## 6 Data Pre-Processing and Engineering Module
### Data Sampling  
To achieve the sustainability goal of the developed scheme, a strategy for sampling the network and the sensor data output by the pre-processing scheme was defined. The goal of the sampling procedure is to reduce the amount of data that each client needs to store in a decentralized environment. This reduction in storage requirements is in line with the sustainability goal. Furthermore, sampling reduces the amount of data that the algorithm needs to infer, resulting in lower overhead for prediction. This approach differs from the conventional methodology employed in evaluations conducted on the ToN-IoT dataset, wherein each packet is treated as a discrete instance for training or prediction purposes. The considered sampling strategy is based on a rolling 10-s window with a 5-s offset. These two values were selected to align with the data extraction and pre-processing offset. This characteristic permits direct sampling of the pre-converted data. The final stage of the proposed methodology considers the extraction of novel data and metrics for each feature within a specified temporal window, relative to the selected time frame. This last stage is denoted as \"aggregation\". Sampling and aggregation are implemented using the resample and aggregate Pandas tools [59; 60]. The method of aggregation depends on the characteristics of the feature under consideration. In the case of _numeric_ features, three new metrics are extracted from the feature values within the specified time window: minimum, maximum, and mean. In the case of _(ex) categorical_, three new metrics are extracted from the feature values within the specified time window: the most frequent, second most frequent, and least frequent values. _Binary labels_ are aggregated using the \"any\" logic. Consequently, if a single instance of a capture is identified as malicious, the entire dataset is subsequently labeled as malicious. In the case of _multi-class labels_, aggregation is performed using the \"most frequent\" logic. Consequently, the window label is assigned as the most frequent \begin{table}
\begin{tabular}{l c} \hline \hline
**Traffic Type** & **Total Data Records** \\ \hline Backdoor & 508,116 \\ \hline DDoS & 6,165,008 \\ \hline DoS & 3,375,328 \\ \hline Injection & 452,659 \\ \hline MITM & 1052 \\ \hline Password & 1,718,569 \\ \hline Ransomware & 72,805 \\ \hline Scanning & 7,140,161 \\ \hline Xss & 2,108,944 \\ \hline Normal & 796,380 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Network attack distribution. value. If the most frequent value is identified as \"normal\", yet at least one instance of an attack is present, the second most frequent value is then assigned. Upon completion of the aggregation procedure, each feature is represented by three distinct features, thereby reducing the data in the time dimension while simultaneously expanding them in feature space. Table 4 shows the reduction in the number of instances generated by the sampling procedure, while Table 5 illustrates the increase in the number of features resulting from the aggregation procedure. Figure 3 shows the sampling and aggregation process, referred to simply as \"sampling\" in the remainder of this paper. The figure illustrates a timed job that runs the sampling process using a Python script. The job produces both sensor- and network-sampled data over a window of size <WINDOW-SIZE> in csv format every <OFFSET>. Concerning the data sensors, the aforementioned procedure is applied to the data stream generated by each sensor. A subsequent step is required to consolidate the data streams produced by the array of sensors into a single csv file. In this manner, each instance of the file represents the overall state of the IoT sensor system at a given time. In some cases, a sensor may not be present in the overall state, which is indicated by all the values of that sensor being NaI. Aggregation of the sensors is conducted after sampling, as this methodology streamlines the data aggregation process by associating the data with five-second intervals.