## 5 Results
### Discussion and Analysis  
The design and implementation of FedSAGE directly address the four core research questions proposed in Section 2.4:  
* (Q1) Distributed DGA detection with privacy: We utilize a _pre-trained VAE_ deployed for each client to map raw domain data into latent vectors without sharing raw data. These vectors are used for downstream clustering and anomaly detection, preserving privacy while enabling detection across decentralized IDS nodes (see Sections 3.1, 3.2 and 4.1). * (Q2) Handling non-IID and rare DGA data: The use of _affinity propagation clustering_ on VAE-derived latent vectors allows clients with similar data characteristics to be grouped together, ensuring _semantic diversity_ is preserved in training (Section 3.2). Moreover, the experiments in Section 5.1 demonstrate that the clustering aligns with true DGA zones, even under non-uniform data. * (Q3) Intelligent client selection under system heterogeneity: FedSAGE selects the _top-\(\rho\)% fastest clients_ in each cluster (Section 3.3), combining data-aware and computation-aware strategies. This ensures participation from diverse data regions without incurring delays from stragglers. The result is a balance between efficiency and representativeness (see Algorithm 1, Tables 4 and 5). * (Q4) Unsupervised novelty detection of DGA: The VAE, trained only on benign domains, enables _unsupervised anomaly detection_ in the latent space by identifying DGA domains that deviate from benign clusters (Sections 3.1 and 3.2). This eliminates the need for labeled DGA data, as shown in the clustering and accuracy results (Figures 6, Tables 4 and 5). Beyond answering the research questions, FedSAGE demonstrates:  
* Robust convergence with low communication cost (see Sections 5.1 and 5.2),
* Strong and lightweight adaptability to real-world non-IID data (see Section 5.3),
* Superior energy efficiency under strict system constraints (see Section 5.4). While our current testbed supports up to 30 clients, FedSAGE is inherently scalable. Each client transmits only a compact latent vector, and clustering is performed over these low-dimensional embeddings. This design significantly reduces computational overhead, enabling the system to accommodate a large number of clients with minimal additional cost. Moreover, since each client trains independently on its local data, the overall system scales efficiently. As long as a distributed orchestration framework is employed, the number of clients can be increased without increasing per-client computational load or imposing a significant burden on the server. These properties make FedSAGE especially suitable for deployment in edge-based IDS systems and potentially generalizable to other anomaly detection problems. However, despite its scalable design, we acknowledge several practical challenges that may arise in large-scale FL deployments. First, communication delays can become non-negligible when orchestrating updates from a large and geographically distributed client pool, especially under constrained or unstable network conditions. Although FedSAGE is a lightweight method that transmits only latent vectors, resulting in significantly lower communication cost compared to standard FL approaches, it can be further scaled to larger systems by incorporating transmission compression or asynchronous updates. Second, synchronization bottlenecks can occur when slow or unreliable clients delay the aggregation phase. FedSAGE partially addresses this through resource-aware client selection, but a more thorough analysis of gradient optimization strategies or adaptive waiting time allocation could further improve robustness. Third, the current client clustering relies on affinity propagation, which is favored thanks to its high clustering quality. However, it faces scalability challenges as the number of clients increases.