## 3 Intrusion Detection Systems Based on the Federated Learning
Besides in the Segmented-FL system, the weighted aggregation function of parameters of local models is implemented. It considers the number of training set samples on each client. Such modifications of the federated learning allowed authors to construct an adaptive system of intrusion detection. The developed system is resistant to possible differences in network infrastructures. The open datasets CIDDS-001 and CIDDS-002 [36] were used as training test datasets. In [37], the authors researched how differences in the data distribution by clients influence the intrusion detection accuracy. They created three different attack scenarios based on the CIC-ToN-IoT dataset [38]. The dataset was distributed among the clients to simulate different data distributions with strongly skewed distributions in classes. The conducted research demonstrated that data distribution essentially influences the accuracy of the intrusion detection models. To solve this challenge, the authors proposed the algorithm for selecting local sample instances based on Shannon's entropy estimate. The proposed algorithm allows for increasing the total accuracy and obtaining similar results compared to the scenario where datasets are balanced across clients. Approach for Designing of the Intrusion Detection System in the Case of Vertically Partitioned Data  
In the case of vertically partitioned data, the clients store information on the same objects, but the set of data stored by each client is different in terms of attributes. The authors decided to use the model of the SWaT water treatment facility [39] as a prototype of a cyber-physical system with vertically partitioned data. The SWaT dataset was developed at the University of Singapore to simulate the attacks against cyber-physical systems. This testbed is a fully operational scaled-down water treatment plant. It models large modern water treatment systems that are used in the cities. Its main goal is to provide an opportunity for experimentally validated research on the development of secure cyber-physical systems. The SWaT facility models consist of the six basic processes corresponding to the physical and control components of a water treatment plant. The prototype facility incorporates a multilevel communication network, programmable logic controllers, human-machine interfaces, supervisory control and data acquisition workstation (SCADA), and the repository. The data from sensors are available in the repository of the SCADA system. They are recorded by the server for further analysis. Thus, the system is developed to implement the centralised data analysis. However, it can be converted to the system with vertically partitioned data. Each technological process of the facility could be considered as a separate element of the water treatment network. The parameters of all technological processes characterise the state of the system as a whole. Thus, the following architecture of the intrusion detection system for the cyber-physical system with vertically partitioned data can be proposed. In Figure 3, each technological process is implemented by process facility PF\(i\) that is supplemented with a special device--an intelligent agent-hub. It registers the data generated by the sensors and control devices of the process's facility. This hub also collects network data of the facility. In Zone B, the additional server is located together with the central server of the SCADA system. The additional server is responsible for training the global model in the system and coordinating the whole federated learning process as well as the inference process. It is referred to as an aggregation server. This server is also responsible for monitoring the model performance and initiation of the re-training of the global model if it is required. The training process looks as follows. The hub of each process facility collects both technological and network data.