## 3 Intrusion Detection Systems Based on the Federated Learning  
Currently, machine learning methods are widely used in intrusion detection. By now, the researchers proposed various approaches based on different machine learning methods [13] including artificial neural networks such as adaptive resonance theory [14], self-organization maps [15; 16], radial basis function [16], multi-layer perceptron [17]; Bayesian networks [18], genetic algorithms [19], support vector machine [20], k-nearest neighbors [21], decision trees [22], clustering [23], fuzzy logic [24], deep networks such as convolutional neural networks [25; 26], recurrent neural networks [27], deep belief networks [28], deep auto-encoders [29], and Boltzmann Machine [30] et al. Intrusion detection approaches can be classified by data sources, used machine learning algorithms, and used machine learning schemes. In terms of machine learning schemes, it is possible to outline two schemes, namely, centralized learning schemes when all data are sent to the central server that implements analysis model training, and federated learning schemes when machine learning models are trained locally on the devices, and only their parameters are sent to the central server. Nowadays, centralized machine learning is the most common approach. However, it leads to privacy and security risks. A federated learning scheme allows for avoiding these risks. In this paper, the authors focus on learning schemes and compare these schemes on the example of the GBDT training model in terms of the accuracy and training time parameters. The goal of this comparison is to evaluate if the advantages of the federated scheme are not eliminated by the losses in accuracy and training time. One of the first research works proposing the idea of an intrusion detection system based on federated learning is the paper [31]. It describes the autonomous self-learning distributed system DIoT for detection of the compromised devices of the Internet of Things. The system generates the device profiles based on their network behavior. Federated learning is used to train the models that detect anomalies in the device's behavior. In [32], the authors also proposed the intrusion detection system for the devices of the Internet of Things. It is based on the federated learning of the convolutional neural network with the FedACNN memory mechanism. The conducted experiments show that this model can provide intrusion detection with high accuracy (up to 99.76%) with relatively good inference performance. The open dataset [33] was used as a training test dataset. However, the authors do not describe how the experimental environment with several clients has been simulated. The first intrusion detection system for the industrial cyber-physical systems is provided in [34]. The authors conducted a series of experiments with different numbers of clients and showed that the proposed intrusion detection model outperforms many other modern approaches in machine learning quality metrics, and all analysis models developed  
Figure 2: Types of data partition: horizontal (**a**), vertical (**b**). for different attack scenarios converge after a sufficient number of rounds of local model parameter aggregation. [PERSON] et al. proposed to apply segmented federated learning (Segmented-FL) to construct a more efficient intrusion detection system [35]. A key difference of the proposed Segmented-FL is splitting clients or data owners into groups (segments). Each group of nodes operates with a specific global model for adaptive learning. This scheme is used both to exchange the parameters between the clients and to group the clients automatically. The automated grouping is used to increase the adaptability of the system to various parameters of the network infrastructure. In particular, it implements a periodic local assessment of the model used for clients segmentation: clients with similar network infrastructure parameters are combined into one group.