## 3 The Proposed FedSAGE Framework for Federated DGA Detection
### FedSAGEFederated Selection and Clustering for Anomaly and Generative-Domain Evaluation  
After clustering the devices as described in Section 3.2 to address data heterogeneity caused by non-IID distributions and simultaneously mitigating system heterogeneity by filtering out straggler devices in Section 3.3, we can define the complete operational workflow of the FedSAGE algorithm, which comprises three core components:  
* _Representation Learning_: Using a shared pre-trained VAE to encode client data into a meaningful latent space. * _Client Clustering_: Grouping clients via affinity propagation based on latent representations to capture data similarity. * _Efficient Selection_: Selecting the fastest client(s) within each cluster to ensure training efficiency without sacrificing data diversity. The proposed FedSAGE algorithm shown in Algorithm 1 and visualized in Figure 4 is designed to address both non-IID data and system heterogeneity in FL environments by combining data-aware clustering with computation-aware client selection. At the beginning of each training round, every client uses a shared VAE to map its local data into a latent representation. From each client data point, latent vectors (\(\mu\)) are computed and averaged from all local data to make the mean latent vector \(\overline{\mu_{i}}\), which captures the overall characteristics of its data. Then, this latent value is clustered using the affinity propagation algorithm, grouping clients with similar data distributions into clusters \(C_{1},C_{2},\ldots,C_{k}\). ```
1:Input: Total clients \(N\), selection ratio \(\rho(\%)\), total training rounds \(T\)
2: Initialize global model parameters \(w\)
3:for each round \(t=1\) to \(T\)do
4:// Step 1: Encode local data into latent vectors
5:for each client \(i\in\{1,\ldots,N\}\)do
6: Use shared VAE to compute latent vectors \(\mu_{i}\) from local data
7: Compute mean latent vector \(\overline{\mu_{i}}\) for client \(i\)
8:endfor
9:// Step 2: Cluster clients based on \(\overline{\mu_{i}}\)
10: Perform Affinity Propagation clustering on \(\{\overline{\mu_{i}}\}_{i=1}^{N}\)
11: Let \(C_{1},C_{2},\ldots,C_{k}\) be the resulting client clusters
12:// Step 3: Select \(\rho\) fastest clients in each cluster
13:for each cluster \(C_{j}\)do
14: Estimated the training time of each client
15: Select top \(\rho(\%)\) fastest clients from \(C_{j}\) as \(S_{j}\) (From Equation (6))
16:endfor
17:// Step 4: Local training
18: Aggregate selected clients \(S=\bigcup_{j=1}^{k}S_{j}\)
19:for each client \(i\in S\)in paralleldo
20: Perform local training on the client's dataset
21: Send updated model parameters to the server
22:endfor
23:// Step 5: Aggregation
24: Server aggregates updates and updates the global model \(w\)
25:endfor
```  
**Algorithm 1** FedSAGE: Federated Selection and Clustering for Anomaly and Generative-domain EvaluationWithin each cluster, the computation speed of every client is measured. The top \(\rho\) fastest clients in each cluster are selected to participate in the current training round, forming a selected set \(S=\bigcup_{j=1}^{k}S_{j}\). These clients perform local training using their private datasets and send the updated model parameters back to the central server. The server then aggregates the received updates to refine the global model \(w\). By incorporating both data representation and device capability into the selection process, FedSAGE ensures that important data, such as traces of new DGA attacks, is not excluded due to limited device performance while also improving training efficiency and energy savings. This makes it a suitable strategy for intelligent and sustainable FL systems. In real-world federated environments, client reliability and stability are often nondeterministic. While our method assumes honest but partially active clients, we implement simple yet effective mechanisms to handle common failure modes. Since clustering and model aggregation are performed only on a selected subset of clients in each round, the failure of a few clients reduces the participation set.