# Chained Anomaly Detection Models for Federated Learning: An Intrusion Detection Case Study
## 3 Accountable Federated Learning for Anomaly Detection
### Anomaly Detection through Federated Learning  
Rather than learning an anomaly detection model and evaluating it on a single high-end machine (as done in DeepChain [27]), we partition and distribute the CICIDS2017 dataset on a real network of desktop nodes and resource-constrained devices. They all will participate in the federated learning setup. This setup is depicted in Figure 3. In a centralized learning environment, the low-end and high-end systems, whose network traffic is being monitored, send their data to a centralized deep learning node that trains the neural network model. In a federated learning environment, \(K\) clients (acting as gateways for the monitored systems) learn a local model. Each of the \(k=1..K\) models has the same structure (i.e., number of layers and neurons per layer), but they are trained with different datasets originating from their own connected clients. Figure 4 depicts a high-level overview of the algorithm, with the pseudocode listed in Algorithm 1. \begin{table}
\begin{tabular}{l l l l} \hline \hline Destination Port & Flow Duration & Total FwdPackets & Total Backward Packets \\ Total Length of Fwd Packets & Total Length of BwdPackets & Fwd Packet Length Max & Fwd Packet Length Min \\ Fwd Packet Length Mean & Fwd Packet Length Std & Bwd Packet Length Max & Bwd Packet Length Min \\ Bwd Packet Length Mean & Bwd Packet Length Std & Flow Bytes/s & Flow Packets/s \\ Flow IATMean & Flow IAT Std & Flow IAT Max & Flow IAT Min \\ Fwd IAT Total & Fwd IAT Mean & Fwd IAT Std & Fwd IAT Max \\ Fwd IAT Min & Bwd IAT Total & Bwd IAT Mean & Bwd IAT Std \\ Bwd IAT Max & Bwd IAT Min & Fwd PSHFlags & Bwd PSH Flags \\ Fwd URGFlags & Bwd URG Flags & Fwd Header Length & Bwd Header Length \\ Fwd Packets/s & Bwd Packets/s & Min Packet Length & Max Packet Length \\ Packet Length Mean & Packet Length Std & Packet Length Variance & FINFlag Count \\ SYNFIag Count & RSTFlag Count & PSFH Flag Count & ACK Flag Count \\ URG Flag Count & CWEFIag Count & ECEFIag Count & Down/Up Ratio \\ Average Packet Size & Avg Fwd Segment Size & Avg Bwd Segment Size & Fwd Header Length \\ Fwd Avg Bytes/Bulk & Fwd Avg Packets/Bulk & Fwd Avg Bulk Rate & Bwd Avg Bytes/Bulk \\ Bwd Avg Packets/Bulk & Bwd Avg Bulk Rate & Subflow Fwd Packets & Subflow Fwd Bytes \\ Subflow Bwd Packets & Subflow Bwd Bytes & Init\_Win\_bytes\_forward & Init\_Win\_bytes\_backward \\ act\_data\_pkt\_fwd & min\_seg\_size\_forward & Active Mean & Active Std \\ Active Max & Active Min & Idle Mean & Idle Std \\ Idle Max & Idle Min & & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Network flow features of the CICIDS2017 dataset. To initiate the federated learning scheme, at \(t=0\), the parameter server initializes a master model with a first set of weights \(w\). Second, each of the \(k=1..K\) deep learning clients downloads this master model from the parameter server. Third, each of the \(k=1..K\) deep learning clients computes in parallel a new local set of weights \(w_{t+1}^{k}\) using the training data of its connected monitored systems. Last, the parameter server updates the weights of the master model \(w_{t+1}\) by aggregating the weights \(w_{t+1}^{k}\) of each client \(k\) (by weighted averaging) to create an improved master model. The cycle repeats, and a new epoch is started until a certain stop criterion is reached. Our methodology follows the design principles for federated learning using model averaging as proposed by [PERSON] et al. [6; 37]. They formalize the notion of federated learning as a problem of federated optimization where at time \(t\geq 0\), the parameter server distributes the model \(w_{t}\) to (a subset of) \(K\) clients of the federation.