## 6 Conclusions and Future Works  
In this paper, we introduced FedSAGE--a novel federated learning framework that enhances intrusion detection systems through variational autoencoder-based clustering without requiring labeled data and novelty DGA detection from clients. Our approach addresses two critical challenges in federated learning: non-IID data distribution and system heterogeneity. By using the latent space representations through VAEs, FedSAGE effectively clusters clients, facilitating the robust detection of novel DGA attacks.  
Extensive experiments conducted on realistic multi-zone DGA datasets demonstrate that FedSAGE consistently outperforms traditional FL methods in terms of detection accuracy, clustering quality, convergence speed, and energy consumption. Additionally, with its lightweight capability in terms of capacity and execution time, our framework makes it especially well-suited for deployment in resource-constrained environments such as edge computing and IoT networks. Notably, the VAE used for client-side latent extraction achieves sub-second inference time even on 2-core CPUs, ensuring that feature extraction can be performed in real time without disrupting device responsiveness. This makes FedSAGE particularly suitable for time-sensitive federated security tasks such as malware detection, intrusion prevention, and traffic anomaly identification in edge environments.  
While the results are promising, several limitations remain. First, our experimental testbed is constrained to a limited-scale emulation environment due to laboratory hardware availability. Scalability to thousands of edge devices and cross-site evaluation on real-world infrastructure would further validate the applicability of FedSAGE in practical deployments. Second, our current pipeline assumes honest clients and does not explicitly address the problem of invalid or adversarial latent vectors \(\mu\), the VAE model, and the training model. In future versions, we aim to incorporate robust latent filtering mechanisms, such as certified embedding validators or outlier detection layers, to ensure the trustworthiness of the shared representations.  
FedSAGE offers a practical and scalable solution extendable to various anomaly detection tasks beyond DGA threats. For example, our framework can be extended to Botnet and C2 traffic detection, IoT behavior profiling, federated fraud detection, federated medical diagnostics, and others. In future research, we will specifically focus on optimizing client selection strategies by investigating suitable selection ratios under diverse operational scenarios, such as client computation or energy consumption. In addition, we will develop FL systems that enhance the security and reliability of latent vectors and model parameters against adversarial attacks. This direction is motivated by the observed sensitivity of FL performance to client selection ratios, underscoring the potential improvements in efficiency and accuracy that targeted optimization could deliver.  
Conceptualization, V.H. and N.H.T.; methodology, M.V.D.; software, P.M.D., T.T.P. and T.D.T.; validation, M.V.D. and T.D.T.; formal analysis, M.V.D. and N.H.T.; investigation, M.V.D. and T.D.T.; resources, M.V.D.; data curation, M.V.D.; writing--original draft preparation, M.V.D., P.M.D. and T.T.P.; writing--review and editing, M.V.D., V.H. and N.H.T.; visualization, M.V.D., P.M.D. and T.T.P.; supervision, N.H.T. and V.H.; project administration, M.V.D.; funding acquisition, N.H.T. All authors have read and agreed to the published version of the manuscript.  
This work was funded by Hanoi University of Science and Technology (HUST) under project no. T2023-PC-038.  
The original contributions presented in this study are included in the article. Further inquiries can be directed to the corresponding author.  
The authors declare no conflicts of interest.