## 2 Related Work and Motivation
### Limitations of Existing DGA Detection Methods  
Domain names play a critical role in the functionality of Internet access. A normal domain name (also called _benign domain_) is a human-readable address used to identify resources on the Internet, serving as an accessible alias for complex IP addresses. They are made by humans and follow standard naming conventions, making them readable and understandable (e.g., google.com, youtube.com).  
On the other hand, _Domain Generation Algorithms (DGAs)_[2; 3] automatically generate domain names, often used by malware to generate an extensive quantity of random domains based on predefined rules. The primary purpose of DGAs is to enable malware, botnets, and other cyber threats to dynamically generate domain names for command-and-control (C&C) [23] communication and evasion of security measures. Attackers can leverage Command and Control (C&C) servers to remotely manage compromised devices. Through this channel, they are able to steal sensitive data, distribute additional malware, orchestrate botnets for Distributed Denial-of-Service (DDoS) attacks, monitor target systems, and maintain persistent unauthorized access to the victim's network [24]. In a typical cyber attack, malware or botnets require a reliable way to receive instructions from an attacker. However, using a fixed domain for C&C communication is risky for attackers, as the security system can easily blacklist or take down the domain and interrupt the attack. To overcome this, malware authors implement DGA, which dynamically generates thousands of _malicious domains_ (known as generative-domains) at regular intervals. The malware attempts to connect to malicious domains, and if the attacker registers one of them, the infected machine can establish a connection with the C&C server.  
Detecting DGA-based threats presents several challenges. Rule-based approaches, such as those based on domain entropy or n-gram patterns [25; 26], are limited in generalization and fail against adaptive DGAs. Classical ML methods like random forests and support vector machines [27] offer improved detection but depend on hand-crafted features and labeled data, making them susceptible to false positives and necessitating frequent retraining.  
Deep learning models have demonstrated exciting potential in detecting DGA domains by learning sequential domain patterns directly from raw inputs. Techniques such as Convolutional Neural Networks (CNNs) [28; 29] and Recurrent Neural Networks (RNNs) [30] achieve higher accuracy but introduce significant computational overhead and require large, labeled datasets, limiting their feasibility in resource-constrained or label-scarce environments.  
In the context of FL, as illustrated in Figure 1, each IDS node is equipped with an AI operator capable of making predictions on the received traffic, classifying it as either _benign_ or _malicious_ domains. Each model is independently trained on local traffic data specific to its respective zone, eliminating the need for data sharing across zones. Subsequently, a _Central Intelligence Server_ aggregates these locally trained models to produce a new global model. This process ensures that all zones are regularly updated and equipped with knowledge to detect emerging threats, such as new types of DGA attacks. While some studies have explored FL-based DGA detection [4], challenges remain regarding communication overhead, training convergence [7], and model generalization in non-IID settings. These issues motivate the development of lightweight, unsupervised, and data-aware approaches capable of detecting evolving DGA variants in federated IDS systems.