## 2 Related Work and Motivation
### Research Gap and Motivation  
Despite the promising advances in applying FL to IDS, several critical gaps remain unaddressed. _First_, most existing FL frameworks assume homogeneous or mildly non-IID data distributions and tend to overlook clients that operate on rare or unique data samples. This is particularly problematic in DGA detection, where new attack patterns often emerge in isolated environments and are difficult to detect without specialized data. _Second_, while prior works have explored client clustering techniques, often based on model parameters or inference similarity, these methods require substantial training efforts, rely on auxiliary datasets, and fail to accurately capture the intrinsic characteristics of raw input data. _Third_, client selection in FL is typically driven by computational efficiency, resulting in the exclusion of resource-constrained devices (\"_stragglers_\"). Unfortunately, these stragglers may possess crucial information about novel threats, and their exclusion may compromise the robustness of the global model.  
In addition, traditional DGA detection models often require extensive labeled datasets and may not generalize well to previously _unseen domain_ patterns. Given the difficulty of acquiring labeled DGA data in real-world IDS deployments, there is a pressing need for unsupervised methods that can effectively detect anomalies and support intelligent client selection.  
To address these challenges, our work is motivated by the following core research questions  
* (Q1) How can DGA attacks be effectively detected in a distributed environment while preserving data privacy?
* (Q2) How can we mitigate non-IID data effects and ensure that even rare or novel DGA domains are learned by the global model?
* (Q3) How can client selection be optimized to balance computational efficiency and data importance, especially under system heterogeneity?
* (Q4) Is it feasible to perform novelty detection of DGA attacks in a label-free, unsupervised fashion?  
Figure 1: System architecture of the proposed Federated Learning-based Intrusion Detection System (IDS/IPS). Multiple IDS nodes (e.g., routers, edge devices) independently monitor local network traffic and train local detection models using their private domain data (e.g., malicious domains, benign domains). A central server coordinates the training process using the federated learning paradigm, where only model updates are exchanged to preserve data privacy. Aggregating updates from selected IDS nodes iteratively improves the global model.  
These questions underpin the design of our proposed FedSAGE framework, which leverages latent representations from a _pre-trained variational autoencoder_ to enable efficient client clustering and data-aware selection, ultimately improving both detection performance and system efficiency in FL-based IDS.  
Traditional FL research mainly emphasizes convergence speed and data efficiency. In contrast, our work tackles a critical cybersecurity issue: how to collaboratively defend against adaptive DGA threats without relying on labeled datasets or centralized data sharing. This reflects the broader trend toward decentralizing threat intelligence while preserving operational privacy and resource constraints.  
In summary, although various FL-based IDS frameworks and DGA detection methods have been proposed, they either incur high computational overhead, lack scalability to unseen attacks, or fail to integrate efficient client selection. These limitations drive the motivation for our work, which we detail in the next section.