## 5 Conclusions  
An IDS assists system administrators by preventing and actuating on potential threats to systems and data. Anomaly-based IDSs can use machine learning algorithms to classify events either as normal or anomalous. When using supervised learning, these algorithms learn how to classify records from classified datasets. In order to improve the performance of the classification algorithms, the datasets should be recent, contain data from different sources in a collaborative approach, i.e., from different companies, and be trained with multiple algorithms. In this paper, a centralized and vote-based architecture is proposed to generate classified datasets and improve the performance of a supervised learning-based IDS. The proposed architecture uses records from multiple IDS that are classified with multiple models, and it uses a majority vote system to generate richer and classified datasets. These datasets are then used to train, and the best models by service are deployed in each IDS. The performance of five machine learning algorithms (decision tree classifier, random forest classifier, K-nearest neighbors, simple logistics, and support vector machine) was assessed regarding their accuracy, precision, and elapsed runtime values, and three algorithms (decision tree classifier, random forest classifier, and simple logistics) were selected to validate the architecture. In order to test the performance of the proposed architecture, its components were implemented in Fed4 FIRE+ with Ray to distribute tasks by the available resources. Five samples of the CICDDoS2019 dataset were prepared and used in a testbed designed and deployed to assess the proposed architecture against a baseline scenario. From the results obtained, the proposed architecture was able to generate classified datasets and choose the best model in each iteration, enabling an increase of 11.5% in accuracy value and an increase of 11.2% in the precision value in the four tested iterations, when compared to the baseline scenario. This best model can then be applied to the IDSs of each company, to improve their attack detection performance. Future efforts may be developed to balance the trade-off between complexity and elapsed execution time against detection performance. Furthermore, the current proposal can be tested using deep learning models and against other types of attacks and datasets. Figure 9: Results of accuracy and precision for the baseline and the proposed architecture scenarios. \begin{table}
\begin{tabular}{c c c c c} \hline \hline  & **Baseline** & **Proposed** & **PA-B** & **PA-B** \\  & **(B)** & **Architecture** & **(P.p.)** & **(\%)** \\ \hline Sample \#1 & 91.76 & 91.76 & 0 & 0 \\ \hline Sample \#2 & 89.49 & 95.39 & +5.90 & +6.59 \\ \hline Sample \#3 & 90.22 & 95.77 & +5.55 & +6.15 \\ \hline Sample \#4 & 86.27 & 95.94 & +9.67 & +11.21 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Precision results of baseline and proposed architecture scenarios. **Author Contributions:** Conceptualization, D.T., S.M. and P.P. ; methodology, D.T., S.M. and P.P. ; software, D.T. ; validation, D.T., S.M. and P.P. ; investigation, D.T. ; writing--original draft preparation, D.T. ; writing--review and editing, D.T., S.M. and P.P. ; supervision, S.M. and P.P. All authors have read and agreed to the published version of the manuscript. **Funding:** This work was partially supported by the Norte Portugal Regional Operational Programme (NORTE 2020), under the PORTUGAL 2020 Partnership Agreement, through the European Regional Development Fund (ERDF), within project \"Cybers SeC IP\" (NORTE-01-0145-FEDER-000044). **Institutional Review Board Statement:** Not applicable. **Informed Consent Statement:** Not applicable. **Data Availability Statement:** No other data available from external sources. **Acknowledgments:** This study was developed in the context of a project in the Master in Cybersecurity at the Instituto Politecnico de Viana do Castelo, Portugal. **Conflicts of Interest:** The authors declare no conflict of interest.