## 3 The Proposed FedSAGE Framework for Federated DGA Detection
### Variational Autoencoder Architecture  
Autoencoders (AEs) [31] are neural network models widely used for unsupervised representation learning, especially in tasks that require dimensionality reduction or feature extraction. An AE learns to encode input data into a compressed latent vector and then reconstruct the original input from this compact representation. This self-supervised learning process makes it possible to capture essential patterns and structure in the original data. In clustering applications, the latent space produced by AEs often reflects meaningful groupings of data, making them particularly useful for discovering hidden structures or anomalies without supervision. The Variational Autoencoder (VAE) [32] is introduced as an upgraded version of AE, which shows a probabilistic extension by modeling the latent space as a distribution rather than fixed points. Unlike standard AEs that map each input to a single latent vector, VAE maps inputs to a mean and variance vector, enabling sampling from a learned distribution. This methodology leads to a more continuous and regularized latent space, mapping similar inputs to nearby regions. The result is improved generalization, smooth interpolation between samples, and a latent space more suitable for clustering and anomaly detection. As shown in Figure 2, the architecture of VAE consists of three primary components: encoder, probabilistic latent space, and decoder. The encoder, known as the probabilistic encoder, does not map input data to a fixed vector like in the AE formulation but instead estimates a probability distribution over the latent space. This change introduces uncertainty, which enhances the model's ability to generate diverse yet coherent samples. The latent space in VAE is designed as a continuous, probabilistic space rather than a deterministic bottleneck, distinguishing it from traditional autoencoders. Let a domain name \(x\) be encoded to obtain a latent mean \(\mu(x)\) and variance \(\sigma(x)\). VAE employs the reparameterization trick, which allows gradients to flow through the stochastic sampling process by re-expressing the sampled latent variable \(z\) as shown in Equation (1):\[z=\mu(x)+\sigma(x)\cdot\epsilon,\quad\epsilon\sim\mathcal{N}(0,I) \tag{1}\]  
Equation (1) ensures that the latent variable remains differentiable, thereby allowing for efficient gradient-based optimization. Among these four variables, the latent vector \(\mu\) is the only one that directly captures the characteristics of the input data within the latent space. Therefore, it is well-suited for use in unsupervised clustering algorithms [33; 34] to determine the underlying type or distribution of the data. This makes \(\mu\) particularly effective for tasks such as classifying DGA attack data and detecting previously unseen DGA variants in a fully unsupervised manner. In this system, the VAE is first pre-trained exclusively on _benign_ domain data. The objective is to construct a latent space that encapsulates the statistical and structural characteristics of legitimate domain names, such as typical domain lengths, entropy distributions, character composition, and morphological patterns (e.g., common suffixes like.com,.org). During training, the VAE learns to minimize the _reconstruction error_, typically a combination of mean squared error (MSE) for reconstruction fidelity and Kullback-Leibler (KL) divergence for latent regularization, allowing the model to accurately reproduce benign inputs from their latent representations. Let \(\mathcal{X}_{\text{benign}}=\{x_{1},x_{2},...,x_{N}\}\) denote a dataset of legitimate (benign) domain names. A VAE is trained on \(\mathcal{X}_{\text{benign}}\) to learn a probabilistic generative model \(p_{\theta}(x|z)\), where \(z\) is a latent variable sampled from a prior distribution \(p(z)=\mathcal{N}(0,I)\). The encoder \(q_{\theta}(z|x)\) approximates the true posterior and maps each input \(x\) into a distribution in latent space.