## 6 Conclusions  
One of the open challenges related to the security of systems built based on the Internet of Things technology is to ensure the security of critical data, such as data required for intrusion detection. A possible solution to this challenge is to use the principles of federated learning while generating the analysis model. The key idea of federated learning is a training of the analysis model using training data partitioned among different clients without data transferring. Research papers provide several solutions based on federated learning for intrusion detection. However, most of the research considers the case when partitioned data are described using the same attributes. In this paper, the case when the collaborating entities participating in the training process have data that are different in attributes is considered. The architecture of the intrusion detection system for vertically partitioned data that considers the principles of federated learning is introduced. It can be deployed in the cyber-physical system, for example, in the water treatment system. To evaluate the applicability of federated learning for this case, the authors conducted a series of experiments. To overcome the problem relating to the lack of the appropriate data sets that could be used to model vertically partitioned data in the intrusion detection task, the authors chose the SWaT dataset as the training dataset. It describes the operation of the water treatment system for 11 days, and contains both network data and data from sensors. To model vertical data partition, the authors suggested splitting the data set based on the technological processes they describe. The conducted experiments showed that the intrusion detection model trained in the federated mode demonstrates high accuracy with a high privacy guarantee that is achieved by using encryption of the input parameters. However, the computational efficiency of the learning and inference process is currently  
Figure 4: The comparison of the accuracy of gradient boosting decision tree model trained in centralized and federated mode with different encryption parameters (**a**), and duration of the training process for different settings of the encryption protocol (**b**). extremely low. According to the conducted experiments, the learning process can take hours and the inference process can take up to 40 min, while training decision trees in a centralized manner takes less than 1 min. It is explained by the use of homomorphic encryption to protect the transmitted model parameters. These indicators are the limiting factors to use this approach in practice for intrusion detection. To overcome this challenge, differential privacy techniques to protect the intermediate results of inference can be used or techniques that allow for transforming vertical data partition to a horizontal one, by mapping different sets of features in one feature space, should be developed. The scope of the future works includes several tasks. The first one relates to the analysis of the datasets that could be used to model vertically partitioned data for the network security tasks as this is an essential problem when evaluating the efficiency of the approaches based on federated learning. This task is closely related to another direction of the future works, and the authors are planning to investigate the approaches that allow for mapping different sets of features in one feature space. Conceptualization, E.N. ; methodology, E.N. ; software, E.N. and S.G.; validation, E.N. ; formal analysis, E.N. and E.D. ; investigation, E.N. and E.D. ; resources, E.N. and S.G.; data curation, E.N. ; writing--original draft preparation, E.N. ; writing--review and editing, E.N. and E.D. ; supervision, E.N. ; project administration, E.N. All authors have read and agreed to the published version of the manuscript. This research is being supported by the grant of RSF #22-21-00724 in SPC RAS. Not applicable. The authors declare no conflict of interest.