## 4 Experiment Setup
### Testbed Setup  
Figure 5 illustrates the operational architecture of our FedSAGE framework deployed in a federated learning environment with two phases: cluster and selection with green lines and components, and aggregation with blue lines and components. Each client (e.g., virtualized IDS node) holds private domain data and performs a local forward pass through a shared pre-trained VAE to generate a latent representation vector \(\mu_{i}\). \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Zone 1** & **Zone 2** & **Zone 3** & **Zone 4** \\ \hline banjori, corebot, recurs, ramnit, recnoyc & bumblebee, orchard, qadars, gozi, vawtrak & bazarbackdoor, fobber, ramdo, padcrypt, zloader & lucky, newgoz, ngioweb, dnschanger, pykspa \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The DGA families that appear in each zone. These latent vectors \(\{\mu_{1},\mu_{2},...,\mu_{n}\}\) are transmitted to the central server, which performs affinity propagation clustering to group clients with similar data distributions. As argued in Section 3.2.2, these latent representations are non-invertible and thus preserve data privacy. Within each cluster, clients are selected for local training based on their estimated execution time profiles. Selected clients then perform local model updates and return the trained weights to the server. Otherwise, if clients have not been selected (as shown with a dashed line), it will not perform this local training round. With the blue flow, the server aggregates the received model parameters to update the global model, which is broadcast to all clients for the next round. This iterative process ensures both data diversity and training efficiency while minimizing communication and computation overhead in heterogeneous environments. The details of the architecture of the VAE model are as follows. The encoder begins with an embedding layer that maps input tokens (representing characters of a domain name) into 16-dimensional vectors, then passes through a bidirectional LSTM layer with 64 hidden units in each direction. The final hidden states from both directions are concatenated into a 128-dimensional vector and processed through two fully connected layers to produce the mean and log-variance vectors, which parameterize the latent space. A latent vector is then sampled from this distribution using the standard reparameterization approach. The decoder reconstructs the input domain sequence from the sampled latent vector. It first projects the latent vector into an initial hidden state for a unidirectional LSTM decoder. This LSTM receives a sequence of start tokens (zeros) and generates an output sequence with the same length as the input. Each output step predicts a token using a fully connected layer over the vocabulary space. To deploy the three deep learning models (_CNN_, _BiLSTM_, and _Transformer_) mentioned in Section 4.1 and the VAE model in the actual testbed, we use the PyTorch framework with the Python programming language. The experimental setup includes the system configuration summarized in Table 3.  
For energy modeling, we approximate the per-round energy of client \(i\) as follows:  
\[E_{i}=P_{idle}t_{idle}+P_{c}t_{c}+P_{tx}\frac{B_{i}}{R_{i}}. \tag{7}\]  
Figure 5: Testbed architecture of the FedSAGE framework. Clients encode local data via the VAE, send latent vectors to the server for clustering and selection, and participate in federated training based on the selection criteria. Equation (7) breaks the total energy consumed by client \(i\) in a single FL round into three intuitive components:  
* Idle energy--\(P_{idle}t_{idle}\). Even when no training is underway, the device draws a baseline (static) power \(P_{idle}\) to keep fans, regulators, and memory alive. Multiplying this idle power by the time the device remains idle, \(t_{idle}\), yields the unavoidable \"background\" energy budget. * Computation energy--\(P_{c}t_{c}\).