## 3 The Proposed FedSAGE Framework for Federated DGA Detection
### Unsupervised VAE Clustering for Novelty Detection  
#### 3.2.1 Client Clustering Based on Latent Encoding  
Building on the latent vector \(\mu\) extracted from the pre-trained VAE, we perform an unsupervised client clustering approach, as illustrated in Figure 3. Before each local training round on client \(i\), a VAE model shared from the server is made available. The local training data on client \(i\) is passed through the VAE to obtain latent vectors \(\mu\). These latent vectors are then averaged into a representative value \(\overline{\mu_{i}}\), which characterizes the data distribution of client \(i\). Once all \(\overline{\mu_{i}}\) values from all clients are collected, a clustering algorithm is applied to group clients that share similar data characteristics.  
In FedSAGE, we adopt _Affinity Propagation (AP)_[35] as the client clustering method due to its unique advantages in handling latent representations of non-IID data. Unlike traditional clustering algorithms such as K-means, which require the number of clusters  
Figure 3: Clustering flow on each client by using the latent vector of VAE.  
to be predefined and assume spherical distributions, AP operates in a _fully unsupervised manner_ and _automatically determines the number of clusters_ based on pairwise similarity scores.  
AP operates on a similarity matrix \(S\in\mathbb{R}^{N\times N}\), where \(S(i,k)\) indicates the similarity between data points \(i\) and \(k\). In our context, each data point corresponds to a client's latent vector \(\mu_{i}\) extracted from the VAE, and the similarity is defined as the negative squared Euclidean distance:  
\[S(i,k)=-\|\mu_{i}-\mu_{k}\|^{2} \tag{3}\]  
The algorithm iteratively updates two types of messages between data points:  
* Responsibility \(r(i,k)\): how well-suited point \(k\) is to be the exemplar for point \(i\),
* Availability \(a(i,k)\): how appropriate it would be for point \(i\) to choose point \(k\) as its exemplar.  
These messages are updated using the following:  
\[r(i,k)\gets S(i,k)-\max_{k^{\prime}\
eq k}\{a(i,k^{\prime})+S(i,k^{\prime })\} \tag{4}\]  
\[a(i,k)\leftarrow\min\left\{0,r(k,k)+\sum_{i^{\prime}\
otin\{i,k\}}\max\{0,r(i ^{\prime},k)\}\right\} \tag{5}\]  
The diagonal element \(r(k,k)+a(k,k)\) reflects the evidence that point \(k\) should be an exemplar. After convergence, each point is assigned to the exemplar \(k\) that maximizes this combined value.  
In our FedSAGE framework, Equations (4) and (5) allow clients with similar latent features to naturally form clusters without predefining the number of groups, while clients most central to each cluster (exemplars) serve as suitable representatives for training. This makes it ideal for dynamic FL settings, where data distributions are unknown and continuously changing. AP clusters clients by iteratively exchanging real-valued messages between data points until convergence, effectively identifying _exemplars_ that represent the most central members of each cluster. These exemplars are especially valuable in FL, as they can act as representative clients for both training and analysis.  
Furthermore, AP is well-suited for _high-dimensional latent spaces_ generated by the VAE, where client data may not be linearly separable or uniformly distributed. It avoids reliance on explicit distance thresholds or centroid initialization, making it _more robust and adaptive_ to the statistical variability present in federated IDS systems.  
In addition to detecting novel DGA attacks by conducting distance-based analysis within the latent space, new or unknown samples are encoded into the same latent space, and their distances to existing cluster centroids or distributions are calculated. Samples that lie far from known clusters are identified as potential novel threats, enabling effective anomaly detection based on learned representations.