# Chained Anomaly Detection Models for Federated Learning: An Intrusion Detection Case Study
## 3 Accountable Federated Learning for Anomaly Detection
### Intrusion Detection with a (Deep) Neural Network-Based Anomaly Detection
Results reported in this paper were achieved under the following neural network configuration and parameters:  
* two symmetrical encoding and decoding parts each with three dense layers;
* the total amount of five dense layers including three hidden layers;
* the number of neurons per layer \(50\to 25\to 10\to 25\to 50\);
* the total amount of learnable weights (\(25\times 50\)) + (\(10\times 25\)) + (\(25\times 10\)) + (\(50\times 25\)) = 3000;
* a rectified linear unit (ReLU) as the activation function;
* the Adam stochastic gradient descent (SGD) optimization algorithm;
* the learning rate of 0.05;
* \(L_{2}\) norm (or the mean squared error) as the loss function;  
A different autoencoder structure or optimization algorithm may lead to better recognition results or a faster learning process, but these are not expected to influence the relative overhead of the blockchain interactions. The threshold to distinguish between benign and anomalous traffic optimally may change as well. However, only if the number of weights changes, there will be an impact on the network traffic towards both the parameter server and the blockchain. Note that the approach we describe in our paper is straightforwardly generalized to any neural network that uses backpropagation, including more sophisticated deep learning algorithms such as the feedforward convolutional neural network (CNN). The main impact on the federated learning algorithm in the case of substituting the neural network or adding more layers would be a change in the number of weights to share during model aggregation, e.g., in the case of intrusion detection directly on raw network traffic data rather than on 78 high-level features, more complex deep neural networks would be required to achieve anomaly detection rates comparable to the state-of-the-art. We refer to other recent related work using the same CICIDS2017 dataset for more details [35; 36]. For initial testing, we used the high-level Python-based Keras ([[https://keras.io](https://keras.io)]([https://keras.io](https://keras.io))) neural network library (on top of Tensorflow). For the implementation of the federated learning variant of the autoencoder, we used the Deeplearning4j (DL4J) ([[http://deeplearning4j.org](http://deeplearning4j.org)]([http://deeplearning4j.org](http://deeplearning4j.org))) library, which offers a Java API to implement deep artificial neural networks and uses a C++ backend for the computation. DL4J can import neural network models originally configured and trained using Keras. Furthermore, DL4J easily integrates with Java-based Big Data frameworks like Hadoop and Spark and mobile operating systems like Android. The federated learning component was implemented as a Spring Boot 2.0 application ([[https://spring.io/projects/spring-boot](https://spring.io/projects/spring-boot)]([https://spring.io/projects/spring-boot](https://spring.io/projects/spring-boot))) that runs within a Java 8.0 virtual machine. Each Spring Boot application instance provides a RESTful interface through which it processes one or more network flow traces of the CICIDS2017 dataset in order to learn a local learning model for the autoencoder. Each application is deployed on one and up to 12 desktop nodes and has its own identifier to select a proper subset of the dataset to use in the training. Additional functionality of this Spring Boot application will be described in the next subsections.