## 5 The Experiments and Discussion  
In [44], a detailed review of the frameworks with open source code is provided. It is demonstrated that currently two frameworks have a rather high level of technological readiness. They support both different analysis models and different communication schemes and data partitioning types. These frameworks are FATE and PaddleFL [45]. The PaddleFL framework supports training neural networks with dense layers only and linear regression models on vertically partitioned data, and the FATE framework supports training neural networks, gradient boosting decision trees (GBDT), and linear regression models. In both frameworks, all algorithms are secured using encryption-based techniques. For example, in PaddleFL, the multi-party computation protocol ABY\({}^{3}\) is used, and its application limits the number of the collaborating entities to the three ones, as it allows only three computational parties by the design [46]. To analyse vertically partitioned data, FATE implements two algorithms: HeteroNN and SecureBoost. The algorithm HeteroNN is a neural network training algorithm. It supports only two clients simultaneously because of the implementation features of the cryptographic transformations used to protect data belonging to different clients. The algorithm SecureBoost implements gradient boosting decision trees (GBDT), which is also supplemented by an additional privacy preserving mechanism to protect input data. In both cases, these mechanisms use [PERSON]'s homomorphic encryption scheme and its two lightweight versions [47]. The SecureBoost algorithm does not have limitations on the number of clients. The results of the open-source frameworks evaluation in [44] showed that PaddleFL framework shows unstable behavior in the model training process, which could be explained by the fact that it uses a proprietary Paddle library as a back end for machine learning. The FATE framework uses PyTorch and TensorFlow libraries as the back end for machine learning. Thus, to deploy the test stand to simulate the intrusion detection system for water treatment system, the framework of federated learning FATE v. 1.5.0. [48] was selected in this research. The SecureBoost algorithm was selected as an aggregation strategy to produce the global model. One of the serious challenges in evaluating the efficiency of federated learning is a lack of suitable data sets that model different types of data partition [10]. The most commonly used for the intrusion detection datasets such as CICIDS 2017 or Bot-IoT contain only network data either in packet-based or flow-based format [49]. To model horizontal data partition, it is possible to split the source data set into several subsets preserving or changing the distribution of attack classes if required. The authors assume that is one of the reasons why existing intrusion detection approaches based on federated learning focus on horizontally partitioned data. Modelling real world vertical data partition is a more complicated task. Data sets that contain only network data could not be used to model vertically partitioned data because splitting them into subsets by the attributes violates their semantic meaning. As a result, the authors focused on the search of data sets with data from sensors; as such, data could be grouped based on the sensor type, location, etc. There are not so many publicly available such data sets, and the SWaT dataset is one of the most suitable ones for these purposes [39]. It contains data from physical sensors and network traffic with 36 attack scenarios that are implemented against different technological processes. The total number of entries with data from physical sensors is 946,722. Each entry contains 51 attributes.