# Federated Learning for Misbehaviour Detection with Variational Autoencoders
and Gaussian Mixture Models

Enrique Mármol Campos, Aurora Gonzalez-Vidal José L. Hernández-Ramos and
Antonio Skarmeta Enrique Marmol, Aurora Gonzalez-Vidal José L. Hernández-Ramos
and Antonio Skarmeta are with the University of Murcia, Spain. E-mail:
{enrique.marmol, aurora.gonzalez2, jluis.hernandez<EMAIL_ADDRESS>
###### Abstract

Federated Learning (FL) has become an attractive approach to collaboratively
train Machine Learning (ML) models while data sources’ privacy is still
preserved. However, most of existing FL approaches are based on supervised
techniques, which could require resource-intensive activities and human
intervention to obtain labelled datasets. Furthermore, in the scope of
cyberattack detection, such techniques are not able to identify previously
unknown threats. In this direction, this work proposes a novel unsupervised FL
approach for the identification of potential misbehavior in vehicular
environments. We leverage the computing capabilities of public cloud services
for model aggregation purposes, and also as a central repository of
misbehavior events, enabling cross-vehicle learning and collective defense
strategies. Our solution integrates the use of Gaussian Mixture Models (GMM)
and Variational Autoencoders (VAE) on the VeReMi dataset in a federated
environment, where each vehicle is intended to train only with its own data.
Furthermore, we use Restricted Boltzmann Machines (RBM) for pre-training
purposes, and Fed+ as aggregation function to enhance model’s convergence. Our
approach provides better performance (more than 80%) compared to recent
proposals, which are usually based on supervised techniques and artificial
divisions of the VeReMi dataset.

###### Index Terms:

Federated Learning, Misbehavior Detection, Variational Autoencoders

##  I Introduction

The application of Machine Learning (ML) techniques for cyberattack detection
has attracted significant interest in recent years [1]. However, most of the
proposed approaches are based on centralized deployments, which are intended
to manage massive amounts of data from different sources. Therefore, all the
data produced by such sources is typically shared through a data center. This
scenario sets out several issues related to the delay associated with the
centralized reasoning process that is usually carried out in the cloud, as
well as privacy concerns, especially in the case of sensitive data. Indeed,
recent works [2, 3, 4] state the importance of protecting clients’ personal
information, and the need to develop distributed ML approaches to cope with
the problems of centralized systems in terms of limited communication
bandwidth, intermittent network connectivity, and strict delay constraints
[3]. These aspects have motivated researchers to move toward more
decentralized ML learning frameworks [5]. In this direction, Federated
learning (FL) was proposed [6] as a collaborative ML approach where the
different data sources (or clients) train a common model, which is updated
through an aggregator entity. Therefore, data is not communicated to any
external entity and clients benefit from the training of other clients without
sharing any information about their dataset. The server aggregates all the
weights using an aggregation function and sends the result to the clients so
that they continue their training using the updated information.

An example of a cybersecurity problem that has recently gained significant
interest is the well-known misbehavior detection in vehicular environments
which usually refers to the detection of vehicles transmitting false
information that cannot be detected by typical cryptographic mechanisms [7].
However, the current state of the art for misbehavior detection is usually
based on supervised learning techniques [8, 9, 10] that need labelled datasets
to train a model. This process might require human intervention becoming a
very resource-intensive and time-consuming activity to have numerous labelled
examples in order to achieve a proper generalization [11, 12]. In the case of
vehicular environments, the creation of such labelled dataset could be
infeasible due to the impossibility to reproduce a real scenario. Furthermore,
supervised learning techniques are not appropriate to detect zero-day attacks,
which refer to previously unknown threats. Instead, the use of unsupervised
learning techniques could be used to mitigate such concerns [13, 14]. In
particular, unsupervised learning is used to extract information on the data’s
structure and hierarchy by using the data samples without the need for ground
truth files. The extracted knowledge representation can be used as a basis for
a deep model that requires fewer labelled examples [11, 15].

In spite of the advantages provided by unsupervised learning, we notice that
most of the proposed approaches for misbehavior detection are based on
supervised techniques using unrealistic data distributions considering an FL
setting [10, 16]. Indeed, some of the recent works [8] are based on artificial
divisions of vehicular misbehavior datasets, such as the Vehicular Reference
Misbehavior (VeReMi) dataset [17]. To fill this gap, our work proposes a
combination of clustering techniques and autoencoders (AE) for misbehaviour
detection. On the one hand, clustering algorithms use unlabelled data to
create clusters that achieve high inner similarity and outer dissimilarity,
without relying on signatures or explicit descriptions of attack classes. In
particular, we choose Gaussian mixture models (GMM) as clustering technique
since it adds probabilities, therefore, removing the restriction that one
point has to belong only to one cluster. Additionally, GMM-based clustering
also performs better in several scenarios where other clustering methods do
not provide suitable results [18]. On the other hand, we use a specific type
of AE called Variational Autoencoder (VAE) [19]. The main goal of an AE is to
reconstruct the input data and the variational version is based on a
stochastic encoder to map the input to a probability distribution. Since they
achieve great success in generating abstract features of high-dimensional
data, the detection of abnormal samples increases significantly [20].
Additionally, we implement Restricted Boltzmann Machines (RBM), which
represent a type of neural network (NN) used as pre-training layer for the VAE
to foster convergence during the federated training process. To the best of
our knowledge, this is the first work exploring the use of such techniques in
the scope of vehicular misbehavior detection. Furthermore, we use the VeReMi
dataset for evaluation purposes by considering a realistic FL setting where
each vehicle is intended to train with its local data. In our system, the
server (or aggregator) is hosted in the cloud, which will serve as a
centralized hub for refining and updating misbehavior detection models by the
aggregation of the data process carried out by the vehicles acting as clients.
By using a cloud-based approach, the system can easily scale to accommodate a
growing fleet of vehicles, making it a practical solution for large
deployments. Indeed, it is intended to store a track record of detected
misbehaviour attacks, and to provide real-time monitoring and analysis of
model performance across the entire set of clients. We carry out an exhaustive
comparison between regular AE and VAE, and unlike most existing FL-enabled
misbehavior detection approaches, we use Fed+ [21] as the aggregation function
to deal with non-iid scenarios [22]. Our contributions are summarised as
follows:

  * •

Unsupervised FL approach based on VAE and GMM considering a realistic
partition of the VeReMi dataset for misbehavior detection.

  * •

Use of RBMs to enhance the convergence of VAEs in the FL setting.

  * •

Application of Fed+ as aggregation function to improve the effectiveness of
the approach in the presence of non-iid data distributions.

  * •

Comprehensive evaluation to demonstrate the effectiveness of the proposed
approach and comparison with recent works using the VeReMi dataset.

The structure of the paper is as follows: Section II describes the main
concepts and techniques used in our work. Section III analyses other works
related to the application of GMM and AEs, as well as the use of AEs
considering FL settings. Then, in IV we provide a detailed description of our
misbehavior detection system. Section V describes the results of our proposed
approach and compares it with recent works using the same dataset. Finally,
Section VI concludes the paper.

##  II Preliminaries

In this section, we describe the main operation of FL, as well as the ML
models we used in our approach, including GMM, and VAE.

###  II-A Federated learning (FL)

Traditional ML approaches are characterized by centralized deployments where
different parties are forced to share their data to be analyzed. Such a
scenario poses significant issues around the needs of network connectivity,
latency, as well as compliance with existing data protection regulations. To
overcome such problems, FL [6] was proposed as a decentralised approach to
train a ML model ensuring that data are not shared. Indeed, Federated learning
(FL) scenarios are usually represented by two main components: the central
entity (or server), and the data owners (or clients). Communication between
these parts is essential for the correct creation of the model. The key of FL
is that clients are intended to create a model in a collaborative way by only
training with their local data and sharing the model updates through the
server.

Figure 1: Pictorial description of an FL setting

A visual description of the FL operation is displayed in Fig. 1 where (1)
clients train the model using their dataset. Next, (2) they send the weights
resulting weights from the local training to the server, which uses an
aggregation function (3) to update the clients’ incoming weights. Finally, (4)
the server sends the aggregated weights to the clients, which starts again
another training round through (1). For aggregating the weights in the server,
our approach is not based on the well-known FedAvg function [6], but on the
Fed+ [21], which is able to provide better performance in non-iid scenarios
compared to FedAvg [22]. The main characteristic of Fed+ is that parties are
not forced to converge to a single central point, as explained below. Hence,
the weights are uploaded following the following equation:

$W^{k+1}=\theta[W^{k}-\nu\nabla f_{k}(W^{k})]+(1-\theta)Z^{k},$ (1)

where $\nu$ is the learning rate, $\theta$ is a constant between 0 and 1 that
controls the degree of regularisation, and $Z^{k}$ is the average of clients’
weights. As the new weights are an average of local weights and global
weights, this means that each party has different weights and does not depend
on the fact that all clients converge to the same point.

###  II-B Gaussian mixture models

A Gaussian mixture model (GMM) is a probabilistic model that assumes all the
data points are generated from a mixture of a finite number of Gaussian
distributions with unknown parameters. Formally, a GMM of $K$ components is a
parametric probability density function represented as a weighted sum of $K$
normal distributions, i.e.:

$p(x|\mu_{1},\dots,\mu_{K},\sigma_{1},\dots,\sigma_{K},\pi_{1},\dots,\pi_{K})=\sum_{K}\pi_{i}\mathcal{N}(\mu_{i},\sigma_{i})$

where $\mu_{i}$ are the means, $\sigma_{i}$ the variances, $\pi_{i}$ the
proportions weights (which sum one and are positives), and $\mathcal{N}$ is a
Gaussian with specified mean and variance. A Gaussian distribution is
completely determined by its covariance matrix and its mean. The covariance
matrix of a Gaussian distribution determines the directions and lengths of the
axes of its density contours, all of which are ellipsoids. There are 4 types
of covariance matrix: full, tied, diagonal, and spherical. Full means the
components may independently adopt any position and shape, tied means they
have the same shape, but the shape may be anything, diagonal means the contour
axes are oriented along the coordinate axes, but otherwise the eccentricities
may vary between components, and spherical is a ”diagonal” situation with
circular contours. The purpose of using GMMs is the division of the dataset
observations into $K$ groups or clusters. Due to their probabilistic nature,
GMMs differ from other clustering methods such as K-means [23] in the fact
that an observation can belong to more than one cluster. More specifically,
GMMs estimate the likelihood of every observation belonging to each component
and assign the observation to the most likely one. In our work, we exploit
these probabilities to classify samples as anomalous or not anomalous.
Additionally, GMMs present other advantages such as adapting to the shape of
the clusters, handling missing data, and taking into account the variance of
the data. These properties are described in depth in [24].

Figure 2: AE’s pictorial description. It consists of a symmetric fully
connected NN where the input is compressed through the encoder to the latent
space to be reconstructed by the decoder.

###  II-C Variational autoencoder (VAE)

An autoencoder (AE) [19] is a particular case of NN where the input and output
dimensions coincide, and its layer structure is symmetric. AEs are used to
build models by using unlabelled data; therefore, they are an example of
unsupervised learning techniques. An AE consists of an encoder and a decoder,
as shown in Fig. 2. The encoder takes the input data and compresses it through
the hidden layers into a lower dimension code, called latent space ($Z$).
Then, the decoder reconstructs this latent space into its original state, that
is, the input data. The main goal of AEs is to create a copy as close as
possible to the original data. The difference between the input and output is
called reconstruction error, which is usually measured using the Root Mean
Square Error (RMSE). In a scenario for misbehavior or attack detection,
training the model with only benign data will produce a high reconstruction
error when attack data is passed. Hence, a threshold is set to decide which
samples are benign or could be considered as an attack.

A Variational AE (VAE) [25] is a type of AE whose encoding distribution is
regularized, i.e., it approaches a standard normal (or gaussian) distribution
during the training to ensure that its latent space is able to generate new
data [26, 27, 28, 29]. The main difference between a VAE and an AE is that the
VAE is a stochastic generative model that provides calibrated probabilities,
while a simple AE is a deterministic discriminative model without a
probabilistic foundation. AEs are not suitable to generate new samples so it
can cause the decoder to provide misleading results since all the information
condensed in the latent space is disorganised. For that reason, the VAE is
intended to map the encoder distribution $q(Z|X)$ to a standard normal
distribution for providing more order in the latent space. For this purpose,
the reparameterization trick is carried out. From this distribution $q(Z|X)$,
it takes its mean $Z_{\mu}$ and standard deviation $Z_{\sigma}$. With these
two latent variables, a sample is created to the latent variable $Z$ that is
sent to the decoder in order to create the predicted output $\hat{X}$. This
method also ensures that the network can be trained using backpropagation.

Figure 3: Pictorial description of a VAE. Similar to the AE, but the latent
space is changed by three layers to ensure the encoder follows a normal
distribution.

Once the VAE has been described, the loss function has to be set. The main
goal of VAE is to create a copy of an input vector. Hence, the RMSE has to be
minimized. At the same time, as said previously, the model distribution needs
to be as close as possible to a standard gaussian. For this, the
Kullback–Leibler Divergence [30] (KL-divergence) function is used. This
function measures how similar two distributions are. Hence, this difference
between the encoder distribution and a standard distribution using the KL-
divergence has to be as close as 0 as possible. Therefore, the loss function
of VAE is:

$Loss(X,\hat{X})=Loss_{RMSE}(X,\hat{X})+KL(q(Z|X),\mathcal{N}(0,1))$ (2)

One of the challenges associated with training AEs is the issue of
convergence, especially when starting from different initial states. This
problem becomes even more visible in a Federated Learning (FL) setting, where
non-iid data distributions are prevalent among the participating devices or
clients. To alleviate the convergence issues, researchers have turned to
Restricted Boltzmann Machines (RBMs) as a promising solution. RBMs have gained
recognition in the literature for their role in initializing AEs effectively,
as proposed by Hinton and Salakhutdinov in their work [31]. RBMs are a type of
stochastic neural network with a distinctive two-layer architecture. They are
characterized by symmetric connections between the layers and the absence of
self-feedback loops. Importantly, RBMs exhibit full connectivity between the
two layers while having no connections within a layer.

The two layers in an RBM are referred to as the visible layer and the hidden
layer. The visible layer contains the original input data, while the hidden
layer captures higher-level representations and features. This architecture
makes RBMs well-suited for various applications, including feature extraction,
pattern recognition, dimensionality reduction, and data classification.

The energy function of an RBM is defined as:

$E(\mathbf{v},\mathbf{h})=-\sum_{i=1}^{N_{v}}\sum_{j=1}^{N_{h}}w_{ij}v_{i}h_{j}-\sum_{i=1}^{N_{v}}a_{i}v_{i}-\sum_{j=1}^{N_{h}}b_{j}h_{j}$

Where:

  * •

$\mathbf{v}$ is the visible layer’s binary state vector with $N_{v}$ neurons.

  * •

$\mathbf{h}$ is the hidden layer’s binary state vector with $N_{h}$ neurons.

  * •

$w_{ij}$ represents the weight connecting visible neuron $i$ to hidden neuron
$j$.

  * •

$a_{i}$ is the bias of the visible neuron $i$.

  * •

$b_{j}$ is the bias of the hidden neuron $j$.

The joint probability of a configuration ($\mathbf{v}$, $\mathbf{h}$) in an
RBM is given by the Boltzmann distribution
$P(\mathbf{v},\mathbf{h})=\frac{e^{-E(\mathbf{v},\mathbf{h})}}{Z}$.

Where: \- $Z$ is the normalization constant (partition function) that ensures
the probabilities sum up to 1 over all possible configurations.

The conditional probability of the hidden layer given the visible layer is
defined as $P(\mathbf{h}|\mathbf{v})=\prod_{j=1}^{N_{h}}P(h_{j}|\mathbf{v})$.
And similarly, the conditional probability of the visible layer given the
hidden layer is
$P(\mathbf{v}|\mathbf{h})=\prod_{i=1}^{N_{v}}P(v_{i}|\mathbf{h})$.

Where the conditional probabilities for binary units are typically sigmoid
functions:

$P(h_{j}=1|\mathbf{v})=\sigma\left(\sum_{i=1}^{N_{v}}w_{ij}v_{i}+b_{j}\right)$

$P(v_{i}=1|\mathbf{h})=\sigma\left(\sum_{j=1}^{N_{h}}w_{ij}h_{j}+a_{i}\right)$

Here, $\sigma(x)$ is the sigmoid activation function:

$\sigma(x)=\frac{1}{1+e^{-x}}$

In this context, we adopt a similar strategy as outlined in previous studies
[32, 33, 34]. Specifically, we employ RBMs for pre-training Variational
Autoencoders (VAEs). This pre-training step helps the VAE initialize its
parameters in a way that is more likely to converge effectively during
subsequent fine-tuning. By leveraging RBMs for this purpose, we aim to enhance
the overall robustness and convergence behavior of AEs within the FL paradigm,
ultimately contributing to the successful deployment of federated machine
learning systems in non-iid data environments.

##  III Related Work

The use of ML techniques for misbehavior detection has attracted significant
attention in recent years [10]. However, as previously described, most of the
proposed works rely on centralized approaches using supervised learning
techniques. In this direction, [35] uses six different supervised techniques
along with plausibility checks to come up with a multiclass classification
approach on the VeReMi dataset. Using the same dataset, [36] also discusses
the use of different supervised techniques considering various feature
extraction methods. Additionally, [37] uses an optimized version of Random
Forest (RF), which is compared with other techniques such as K-Nearest
Neighbors (KNN) and Decision Trees (DT).

As an alternative to centralized ML approaches, recently the use of FL has
been also considered in the scope of misbehavior detection for vehicular
environments. Indeed, [8] proposes a federated approach based on neural
networks to build a multiclass classification approach for detecting the
attacks contained in the VeReMi dataset. Furthermore, [38] proposes a
federated approach using blockchain where several supervised learning
techniques are tested on an extended version of such dataset [39]. In the case
of [40], the authors propose an approach based on a semi-supervised model
using a neural network and a subset of labeled data for the initial training
phase. Then, new unlabeled data is used to improve the effectiveness of the
system. The approach is also applied to the extension of the Veremi dataset.

Unlike previous approaches, our work offers an unsupervised approach for
detecting misbehavior using a model based on the combination of VAEs and GMM.
Although this approach has been scarcely considered in this field, it has been
widely used for detecting different types of attacks and anomalies. In this
direction, a Deep Autoencoding Gaussian Mixture Model (DAGMM) for unsupervised
anomaly detection is proposed by [41]. DAGMM consists of a deep AE to reduce
the dimensionality of input sample, and a GMM that is fed with the low-
dimensional data provided by the AE. Furthermore, [42] describes an approach
based on AE and GMM in which the objective functions’ optimization problem is
transformed into a Lagrangian dual problem. Indeed, authors make use of the
Expectation-Maximization (EM) algorithm. Like in the previous work, AEs are
used for input’ dimensionality reduction. Then, an estimation network is
intended to estimate samples’ density, so that samples with density higher
than a certain threshold are identified as outliers. Moreover, the use of VAEs
and GMM is considered by [43]. The VAE first trains a generative distribution
and extracts reconstruction-based features. Then, the authors use a deep
belief network to estimate the mixture probabilities for each GMM’s component.
Based on these results, the GMM is used to estimate sample densities with the
EM algorithm.

While previous works are based on centralized settings, other recent
approaches were proposed considering the use of VAEs/AEs and GMM on a FL
scenario. Similar to the approach made by [43], however, in the context of
encrypted aligned data, the recent work [44] use VAE for reducing the
dimension of the data, and then GMM is applied for clustering the data and
selecting the correct samples. As we will see in section V, the application on
GMM without implementing VAE during the classification will lead to
misclassification to a certain types of samples. Looking at works using AEs, a
federated version of the previously described approach DAGMM is proposed by
[45], so that each client is intended to share the AE’s updated weights in
each training round. Other works, such as [46, 47, 48] also use AEs in a
federated scenario considering different contexts, such as wireless sensor
networks. Like in the previous case, anomaly detection is based on the
reconstruction error, so that samples with higher values are considered
anomalies. Moreover, [49] proposes MGVN that represents an anomaly detection
classification model using FL and mixed Gaussian variational self-encoder,
which is built by using a convolutional neuronal network.

In general, our analysis of existing literature reflects a lack of approaches
applying unsupervised learning techniques for misbehavior detection and other
cybersecurity-related problems. Furthermore, the described works are based on
similar approaches in which AEs are used initially and the resulting output
feeds the GMM. In our case, we initially train the GMM with the input data,
and the results are used by the VAE to carry out a federated training among
the vehicles acting as FL clients. To the best of our knowledge, this is the
first work considering the use of GMM and VAEs in the contest of vehicular
misbehavior detection. Furthermore, unlike existing works applying ML
techniques in this context, our approach considers a non-iid data distribution
scenario in which each vehicle trains on its local data. To mitigate the
impact on non-iid in the approach’s performance, we further apply an approach
to balance the dataset and use Fed+ as the aggregation function as described
in the following sections.

##  IV Proposed misbehavior detection system

This section provides a detailed description about our unsupervised FL-enabled
misbehavior detection approach. Furthermore, we describe the dataset used and
how it is preprocessed below.

###  IV-A Dataset and preprocessing

For evaluation purposes, we use the VeReMi [17] and VeReMi extension [39]
datasets. On one hand, VeReMi is a simulated dataset that was created using
VEINS and the Luxembourg SUMO Traffic (LuST) scenario [50]. On the other hand,
VeReMi extension make use of Framework For Misbehavior Detection (F²MD). F²MD
is a VEINS extension that enables the recreation and detection of various
misbehavior detection use cases. LuST is a traffic simulation scenario
validated with real driving data. VeReMi utilizes a subsection of the LuST
scenario. VeReMi dataset was created by simulating 225 scenarios considering 5
position forging attacks, 3 vehicle densities (low, medium and high), and 3
attacker densities (10, 20 and 30 percent), and each parameter set was
repeated 5 times for randomization. Finally, the dataset contains the log
messages of 498 vehicles. For VeReMi extension, it uses subsection of the LuST
network with a size 1.61 km² and a peak density of 67.4 Veh/km². Furthermore,
VeReMi extension contain two vehicle densities, one in the rush hour time
(7h-9h), and another in low traffic time (14h-16h). Each file maintains a
record of Basic Safety Messages (BSMs) received by a single vehicle (same ID)
from neighbouring vehicles (300-meter range) during its entire journey. The
files are converted to CSV format differentiating between benign and attack
samples.

Furthermore, we carry out a pre-processing of the VeReMi dataset to deal with
the impact of non-iid data distributions on the effectiveness of the
misbehavior detection approach. The main reason is that our approach (unlike
other recent works, such as [38]) considers each vehicle as an FL client using
its own data during the federated training process. Indeed, as shown in our
previous works [22], non-iid data distributions might have a dramatic impact
on the effectiveness of the FL-enabled system. For this purpose, we use SMOTE-
Tomek [51], which represents a combination of oversampling and undersampling
techniques to balance the class ratio. The new samples in the dataset are
created through SMOTE by making linear combinations between close points of
the less-represented class. Then, Tomek Links is in charge of removing
neighbour points that belong to different classes in order to make the classes
more differentiable. Initially, the balance of the clients’ dataset is 75%
benign-25% attack. After applying SMOTE-Tomek, the balance is nearly 50-50 in
all clients. Finally, as explained in section II, GMM are a sum of normal
distributions. Therefore, the dataset has to follow a Gaussian distribution.
In this sense, we normalise the dataset and check whether it fits to a
Gaussian distribution by applying the Shapiro-wilk test [52]. After applying
the Shapiro-wilk test we have a Shapiro-wilk score of 0.98 and $p$-value of
$0.99>0.05$, meaning that the dataset follows a Gaussian distribution.

###  IV-B System description

After describing the dataset and the pre-processing we carry out, below we
provide a detailed explanation of the proposed system, including the different
phases of the misbehavior detection approach.

####  IV-B1 Overview

A global overview of our system is shown in Fig. 4, which includes the
relationship between the different components and techniques previously
described. As already mentioned, vehicles act as FL clients performing local
training by using the VeReMi dataset and the global model that is updated in
each training round. In particular, our approach consists of 3 phases.
Firstly, during Phase 1 (Initialization), clients train the GMM with their
benign dataset. Then, this data is transformed into histograms that are used
to create the initial weights for training the VAE by using the RBMs. For each
sample, these histograms measure which features are within each group created
by the GMM. Once each client has initialized its corresponding VAE, Phase 2
(Federated learning) is carried out by following the steps described in
Section II, so that each client performs a local training by using its own
data in each training round. The server implements an aggregation method to
aggregate the local results from the FL clients, and the resulting aggregated
model is sent again to the FL clients to be updated through a new training
round. While the vehicles themselves act as FL clients, the server is intended
to be deployed on the cloud. Therefore, FL is employed to detect cyberattacks
locally in these vehicles, and the server in the cloud can then aggregate data
from various vehicles and further analyze it to gain a holistic view of the
cybersecurity landscape. It should be noted that this cloud service could be
also considered to store information about vehicles that were identified as
misbehaving entities by our detection system, so that it allows the system to
keep track of potential malicious vehicles. In Phase 3 (Local misbehavior
detection), after the federated training process is finished, each client has
a trained VAE to be used for classification purposes in order to detect
potential misbehavior. In particular, the GMM’s likelihood function [53] is
used to evaluate whether a point belongs or not to one of the groups
previously created in Phase 1. Depending on the likelihood value, the sample
is considered a benign sample (greater than 1) or an attack (0). In case of a
value between 0 and 1, a histogram is created for that sample, and the local
VAE is used to classify it depending on a certain threshold value. These
processes are further detailed in the following subsections.

Figure 4: Pictorial description of our misbehavior detection system. There are
three phases, the first one (1), is the initialization, where the clients
train the GMM and create the histograms subsequently. Also, it uses RBM to
create VAE’s initial weights. Then, in (2), clients create a federated
environment to train their VAE models. And finally, in (3), the local
misbehaviour detection is carried out, where each client classifies the
samples as benign or malign using the model trained and the threshold $th$
set.

####  IV-B2 Model training

As previously mentioned, the model training process is split into two main
phases: Initialization and Federated learning. Before starting this process,
it should be noted that, for each client, we pre-process its corresponding
dataset as described in subsection IV-A, and we use the 80% of the benign
dataset to train the GMM with the number of components previously optimised.
Toward this end, we use the Silhouette coefficient [54], which represents a
metric to calculate the performance of a particular clustering by examining
how separated and compact the clusters are. This optimization will lead to
each client will have different numbers of components, as it will be explain
in section V, due to this number of components define the structure of the FL
model, the clients are divided in groups regarding their number of components.
In this direction, although there will be several gruops, the model training
scheme will be the same in each case.

The model training process is further detailed in Algorithm 1. Firstly, in
Phase 1, for each client $n$, GMM is used to divide the benign dataset $B_{n}$
as many groups $G_{n}=(g_{n}^{k})_{1}^{K_{n}}$ as components $K_{n}$ are
previously computed (line 2). Then, the data is transformed into histogram
vectors [55] (line 3), which are used in our previous works [56]. This
technique creates a matrix $H_{n}$ containing the vectors
$h^{i}=(h^{i}_{1},h^{i}_{2},\dots,h^{i}_{K_{n}})$ (line 21), where $K_{n}$ is
the number of groups (equal to the number of GMM components), and each
$h^{i}_{k}$ is the number of features of sample $i$ that are within each group
$g^{k}_{n}$ divided by the total number of features (line 15). To calculate
it, for each feature $j$ of sample $i$ we check whether the value of this
feature is within the dimension $j$ of the cluster $g_{n}^{k}$ (lines 12-14),
i.e, whether is between the dimension $j$ of the center of this cluster
$g_{n}^{k}$ minus the standard deviation and the dimension $j$ of the center
of the cluster $g_{n}^{k}$ plus the standard deviation. The standard deviation
means the standard deviation of the points of $g_{n}^{k}$ Furthermore, it
should be noted that function $Dim_{j}(x)$ is only intended to take the
coordinate $j$ of point $x$. The resulting histogram $H_{n}$ is used by the
RBM to pre-train the VAE in order to get the initial weights $W^{0}_{n}$
(lines 4-5) for the next steps.

In Phase 2, the FL process is carried out by the different clients which have
the same number of components using the local VAE models (line 7), whose input
dimension is the number of components previously set. Each client is intended
to train locally its corresponding VAE model and share the resulting weights
in each training round (lines 22-32) with the server, as previously described
in Section II. Once this process is complete after a certain number of rounds,
we set the threshold as:

$th=mean(RE)+0.01*std(RE)$ (3)

where $mean(RE)$ and $std(RE)$ are the mean and standard deviation of the
VAE’s reconstruction error (RE) respectively (line 10). We use this formula
since it provides a value close to the 95-percentile.

Algorithm 1 Model training

0: $N$ set of clients with same number of components $K_{n}$, $B_{n}$ benign
dataset of client $n$, $GMM_{n}$ GMM of client $n$, $VAE_{n}$ VAE model of
client $n$, $rounds$ number of rounds in the FL environment, $threshold$ is
the eq. 3, $Fedplus$ is the eq. 1, and $\theta$ the Fed+ constant.

0: VAE model trained and threshold of each client(Phase 1)

1: for $n\in N$ do

2: $G_{n}=GMM_{n}(B_{n})=(g_{n}^{k})_{1}^{K_{n}}$

3: $H_{n}=$ Create histograms($B_{n}$, $G_{n}$)

4: $W^{0}_{n}=RBM_{n}(H_{n})$

5: Set $W^{0}_{n}$ to $VAE_{n}$

6: end for (Phase 2)

7: $FL((VAE_{n})_{1}^{N},(H_{n})_{1}^{N},rounds)$

8: $th_{n}=threshold(VAE_{n})\forall n\in N$ Create histograms($B_{n}$,
$G_{n}$):

9: for $i\in B_{n}$ do

10: for $g\in G_{n}$ do

11: for $j\in features(B_{n}$) do

12: Sup_bound = $Dim_{j}(Center_{g})+Dim_{j}(Std_{g})$

13: Inf_bound = $Dim_{j}(Center_{g})-Dim_{j}(Std_{g})$

14: if $j\in[Inf\\_bound,Sup\\_bound]$ then

15: $h_{g}^{i}+=\frac{1}{length(features)}$

16: end if

17: end for

18: end for

19: $h^{i}=(h^{i}_{1},\dots,h^{i}_{length(G_{n})})$

20: end for

21: return: $H=(h^{i})_{1}^{length(B_{n})}$
FL($(VAE_{n})_{1}^{N},(H_{n})_{1}^{N},rounds$):

22: for $r$ in [1,$\dots$, $rounds$] do

23: if $r>1$ then

24: Server sends weights $Z$ to clients, otherwise the clients use $W^{0}_{n}$

25: end if

26: for $n\in N$ do

27: Train $VAE_{n}$ with $H_{n}$

28: $\text{Get weights }W^{r}_{n}\text{ of }VAE_{n}$

29: $W_{n}^{r+1}=FedPlus(Z,W_{n}^{r},\theta)$

30: $Client_{n}\text{ sends }W_{n}^{r+1}\text{ to server }$

31: end for

32: Server aggregates all the $(W_{n}^{r+1})_{1}^{N}$ into $Z$.

33: end for

34: return:  $(VAE_{n})_{1}^{N}$ trained

####  IV-B3 Local misbehavior detection

After the previous steps are complete, each vehicle is equipped with a model
to detect potential misbehavior detection (Phase 3 in Figure 4) based on the
classification of samples during the testing process of the model. For this
purpose, each vehicle employs the portion of benign data that was not used for
training (i.e., 20%), as well as the same size of attack data. The process is
detailed in Algorithm 2, which is based on the calculation of the likelihood
function associated with the GMM for each sample of a vehicle’s testing
dataset (line 2). If this value is greater than or equal to 1 (line 3), it
means that such sample belongs to one of the groups created by the GMM, so it
is classified as benign (line 4). If it is equal to 0 (line 5), it does not
belong to a GMM group, so it is classified as anomalous (line 6). Then, the
samples whose value is between 0 and 1 (line 7) could represent attacks
mirroring normal traffic [55]. These samples are transformed into the
histograms (line 8) as previously described. Then, the VAE that was trained in
the previous phase is applied to reconstruct the histogram (line 9); if the
reconstruction error is higher than the threshold (line 11), it means that it
is anomalous (line 12), otherwise, such sample is considered as benign data
(line 14).

Algorithm 2 Local misbehavior detection (Phase 3)

0: $D_{n}$ Testing dataset of client $n$, $LF_{GMM_{n}}$ likelihood function
of gaussian mixture model of client $n$ $GMM_{n}$, $G_{n}$ groups created by
$GMM_{n}$, $VAE_{n}$ VAE model of client $n$, $RMSE$ is the Root Mean Square
Error, $th_{n}$ threshold set by the client $n$

0: Accuracy of the model $a$

1: for $x\in D_{n}$ do

2: $p=LF_{GMM_{n}}(x)$

3: if $p\geq 1$ then

4: $x$ is benign

5: else if $p=0$ then

6: $x$ is anomalous

7: else

8: $H=Histogram(x,G_{n})$

9: $\hat{H}=VAE_{n}(H)$

10: $RE_{n}(\hat{H})=RMSE(H,\hat{H})$

11: if $RE_{n}(\hat{H})>th_{n}$ then

12: $x$ is anomalous

13: else

14: $x$ is benign

15: end if

16: end if

17: end for

18: Calculate confusion matrix $M$ and get accuracy.$Histogram(x,G_{n}):$

19: for $g\in G_{n}$ do

20: for $j\in features(x$) do

21: Sup_bound = $Dim_{j}(Center_{g})+Dim_{j}(Std_{g})$

22: Inf_bound = $Dim_{j}(Center_{g})-Dim_{j}(Std_{g})$

23: if $j\in[Inf\\_bound,Sup\\_bound]$ then

24: $h_{g}^{i}+=\frac{1}{length(features)}$

25: end if

26: end for

27: end for

28: return: $h^{i}=(h^{i}_{1},\dots,h^{i}_{length(G_{n})})$

##  V Evaluation

For the evaluation of our misbehaviour detection approach, we employ a virtual
machine with processor Intel(R) Xeon(R) Silver 4214R CPU @ 2.40GHz with 24
cores and 196 GB of RAM. Furthermore, we use Flower [57] as the FL
implementation framework, the version 0.18. Flower provides an end-to-end
implementation and the possibility to customise several aspects of the model
for performing a more exhaustive evaluation. All the parameters related to our
federated scenarios are summarised in Table I. Furthermore, it should be noted
that we make the code and the dataset used publicly available for
reproducibility purposes111https://github.com/Enrique-Marmol/Federated-
Learning-for-Misbehaviour-Detection-with-Variational-Autoencoder-and-Gaussian-
Mixture-Mode.

Framework | Flower
---|---
Model | VAE / AE
Aggregation function | Fed+
Clients | From Fig. 5
Rounds | 30
Epochs | 1
TABLE I: Summary of parameter of our federated scenarios.

###  V-A Client division

The use of GMMs requires the specification of a certain number of components
(clusters) before training the model. Furthermore, such number will also
determine the input size of the AE/VAE. Instead of selecting a fixed number of
components for all the clients, we compute the optimal number of components
for each client using silhouette analysis as stated in Section IV.
Consequently, clients are grouped based on their optimal number of components
since different networks with different input sizes will be created (one per
group). In order to apply the GMM, we have to specify the type of the
covariance matrix. In our case, we choose the covariance type which fits
better to our model, which is diagonal. Fig. 5 shows the number of
clients/cars that resulted in having a certain number of components as
optimal. As shown, the most common number of components was 300. Hence, we
will have as many federated scenarios as groups of cars are created based on
their optimal number of components.

Figure 5: Number of clients per cluster depending on the number of components

As will be described in Section V-B, we provide an extensive analysis for the
group of clients whose optimal number of GMM components is 298. Such analysis
is also applicable for each group of clients with the same number of
components. In this sense, in order to avoid repeating the process 104 times
(as it is the total number of groups), we also provide the final results for
the rest of the groups with 5 or more clients (Section V-C). The reason for
choosing this grouping is to display a better picture comparing all clients’
performance. Although the group with 298 components has fewer clients compared
to the clusters of 300 and 299 components (20, 93, and 45 clients
respectively), the clients’ average sample size is similar between those
groups (20453, 19983, and 21004 respectively), as well as the standard
deviation (7677, 9760, and 10885). Therefore, the clients of this particular
case have a similar distribution, and having a small number of clients can
ease results’ interpretation and plotting.

Moreover, our analysis includes a comparison of the performance regarding the
autoencoder process depending on the learning rate (lr) using an AE or VAE. It
should be noted that both AE and VAE are built as similarly as possible to
ease their comparison. Specifically, the input layer’s size is the number of
GMM components. In the encoder, the first hidden layer is half the size of the
input layer. Then, the AE’s latent space and the VAE’s sample layer are third
of the size of the input layer. Finally, the decoder has two layers: the first
one is half of the size of the input layer, and the output layer has the size
of the input layer. All these layers use ReLU as the activation function
except the last one, which employs the sigmoid function, and both use RMSprop
as the optimizer. For the rest of the clusters, we compare the results
considering AE and VAE with the best lr.

###  V-B Particular case analysis: Clients with 298 components

As shown in Fig. 5, 20 clients are grouped with 298 components. In this
section, we analyse the impact of choosing between AE or VAE in the federated
setting, and we also compare the results with the distributed scenario where
clients only train locally, i.e., they do not share any result derived from
such training with the server. It should be noted that we distinguish between
AE/VAE accuracy (autoencoder part), the accuracy obtain during the application
of AE/VAE in phase 3 in IV, and the general model’s accuracy (total accuracy),
which is the accuracy obtained based on the use of GMM and AE/VAE. The reason
is that GMM process is nearly the same every round as it is not part of the
federated training, so we analyse the impact of the AE/VAE model in the
performance of the model.

Table II shows the accuracy values of the autoencoder part (that is, using
AE/VAE) considering different lr, marking in bold the best lr for each method.
According to the results, we best value obtained is for VAE when $lr=0.05$. In
particular, considering the best case for each setting, the federated VAE
reaches a value of 0.972 (lr = 0.05), whereas the distributed VAE, federated
AE, and distributed AE reach 0.928 (lr = 0.001), 0.923 (lr = 0.005), and 0.936
(lr= 0.005) respectively. Comparing the performance in particular of the best
cases of federated VAE and federated AE, in Fig. 6, we compare the accuracy of
each client specifically. In this figure, we see that in almost all clients,
the VAE reaches better performance than the AE. Having set the best lr for the
VAE, Fig. 7 shows the final metrics of the general model, that is, considering
the metrics obtained by applying GMM and the VAE. The accuracy of the model is
0.824, and the recall, precision, and f1-score are 0.968, 0.672, and 0.775
respectively.

Learning rate | Federated VAE | Distributed VAE | Federated AE | Distributed AE
---|---|---|---|---
0.001 | 0.920 | 0.928 | 0.90 | 0.921
0.005 | 0.892 | 0.915 | 0.923 | 0.936
0.01 | 0.767 | 0.792 | 0.893 | 0.911
0.05 | 0.972 | 0.853 | 0.455 | 0.3640
0.1 | 0.953 | 0.901 | 0.457 | 0.447
TABLE II: Accuracy of the autoencoder part of different methods varying the lr
in the 298-component cluster Figure 6: Comparison of accuracy of autoencoder
part between best case of VAE ($lr=0.05$) and AE ($lr=0.005$) in each client
of the 298-component cluster

In order to justify the grid of GMM components chosen in Section IV, Table III
provides a comparison of the time consumed by the principal processes of our
approach depending on the number of the GMM components and the accuracy
achieved. As the number of components increases, the time required is higher,
especially because of the silhouette analysis. Nevertheless, although the
accuracy also grows, the increase of each step is getting lower, from 0.62 to
0.824. Hence, we set the maximum number of components of the grid at 300,
since a wider range will consume an enormous amount of time for a reduced
improvement in terms of accuracy.

Number of components | 10 | 100 | 200 | 300
---|---|---|---|---
Silhouette analysis | 947 | 21357 | 54298 | 110132
Training GMM | 15 | 50 | 202 | 236
Training RBM | 28 | 286 | 1028 | 2122
Accuracy | 0.62 | 0.705 | 0.783 | 0.824
TABLE III: Time comparison (in seconds) of the main processes of our approach
depending on the number of GMM components, and accuracy Figure 7: Metrics of
the federated scenario using GMM and VAE of the 298-component cluster

Finally, we also compare our approach with a scenario where the GMM and
histograms are not used. In this case, the VAE is applied as a baseline
employing the benign dataset, so potential misbehavior is detected using the
reconstruction error. This method reaches 0.587 of accuracy, which supports
the need to use the combination of GMM and histograms with the VAE.

###  V-C General case: clusters with 5 or more clients

This section shows the results for all clusters (any number of components) of
Fig. 5 that contain 5 or more clients. Fig. 8 and Fig. 9 provide the accuracy
of the general model and the autoencoder part respectively, comparing when AE
or VAE is used. For each case, we select the best lr. As shown, the results
using the VAE are higher compared to AE for almost every cluster.

Figure 8: Comparison between accuracy of AE+GMM and VAE+GMM in all clusters
Figure 9: Comparison between accuracy of AE and VAE in all clusters

For the sake of completeness, we show the comparison of our method using
FedAvg as aggregation function in phase 2 mentioned in section II. In Fig. 10
and 11 show the total accuracy of the VAE and GMM, and the accuracy of the VAE
using either Fed+ or FedAvg. The lr used in these figures are the same of the
ones used in Fig. 8 and 9. In these pictures, we can clearly appreciate that
in all clusters FedAvg achieves worse performance than the case with Fed+.

Figure 10: Comparison between total accuracy of VAE+GMM using Fed+ of FedAvg
in all clusters Figure 11: Comparison between total accuracy of VAE using Fed+
or FedAvg in all clusters

Furthermore, we compare our evaluation results with recent works on the same
dataset. In particular, [38] uses several supervised ML algorithms, including
Support Vector Machines (SVM) K-Nearest Neighbour (KNN), Naïve Bayes, and
Random Forest. In general, we achieve similar results but with clearly higher
values for certain metrics, such as recall and f1-score in which they achieve
0.5 and 0.6 respectively, whilst we get 0.96 and 0.77, respectively.
Furthermore, it should be noted that the mentioned work achieves those results
using supervised learning approaches, and an artificial division of the VeReMi
dataset, which is split into five equally balanced clients, an iid division
that not reflect the real-case scenarios. In our approach, clients’ data are
based on the vehicles in the VeReMi dataset, so that each vehicle only trains
with its local data. In this sense, our division corresponds a more realistic
scenario, which is characterized by non-iid data distributions. We also
compare our unsupervised FL approach with the case of using a supervised MLP,
which provides an accuracy value of 0.88. It should be noted that even in this
case with non-iid data, the accuracy value is higher compared with the work
previously mentioned. The main reason is that we mitigate such aspect by using
SMOTE-Tomek to obtain a more balanced dataset, and Fed+ as aggregation
function.

##  VI Conclusions and future work

This work proposed an unsupervised FL approach for misbehavior detection in
vehicular environments based on the use of GMM and VAE. The resulting system
was exhaustively evaluated considering a realistic scenario where each FL
client is intended to train with its local data. Unlike most of existing
approaches, we deal with non-iid data distributions and convergence issues by
considering dataset balancing techniques, as well as alternative aggregation
functions. Our evaluation also measures the impact of the learning rate on the
federated training process, and compare the approach with recent works using
the VeReMi dataset. According to the results, our proposed system provides a
performance close to supervised approaches, which require labelled datasets
for training. As part of our future work, we plan to build VAEs to identify
different classes of misbehavior, that is, beyond binary classification.
Furthermore, as the choice of the learning rate could have a significant
impact on the performance, we will design an approach to dynamically set the
learning rate throughout the training rounds. Additionally, we also plan to
analyze the possibility of dynamically selecting specific clients to reduce
the bandwidth required during the federated training process.

## Acknowledgements

This work has been sponsored by the EC through H2020 ERATOSTHENES (g.a.
101020416) and the European Union’s Horizon Europe research and innovation
funding programme under the Marie Skłodowska-Curie grant agreement No
101065524. It also forms part of the ThinkInAzul programme and was supported
by MCIN with funding from European Union NextGenerationEU (PRTR-C17.I1) by
Comunidad Autónoma de la Región de Murcia - Fundación Séneca as well as by the
HORIZON-MSCA-2021-SE-01-01 project Cloudstars (g.a. 101086248) and ONOFRE
Project PID2020-112675RB-C44 funded by MCIN/AEI/10.13039/501100011033.

## References

  * [1] Z. Ahmad, A. Shahid Khan, C. Wai Shiang, J. Abdullah, and F. Ahmad, “Network intrusion detection system: A systematic study of machine learning and deep learning approaches,” _Transactions on Emerging Telecommunications Technologies_ , vol. 32, no. 1, p. e4150, 2021.
  * [2] C. Zhang, Y. Xie, H. Bai, B. Yu, W. Li, and Y. Gao, “A survey on federated learning,” _Knowledge-Based Systems_ , vol. 216, p. 106775, 2021.
  * [3] L. Lyu, H. Yu, and Q. Yang, “Threats to federated learning: A survey,” _arXiv preprint arXiv:2003.02133_ , 2020.
  * [4] M. Aledhari, R. Razzak, R. M. Parizi, and F. Saeed, “Federated learning: A survey on enabling technologies, protocols, and applications,” _IEEE Access_ , vol. 8, pp. 140 699–140 725, 2020.
  * [5] M. Billah, S. Mehedi, A. Anwar, Z. Rahman, R. Islam _et al._ , “A systematic literature review on blockchain enabled federated learning framework for internet of vehicles,” _arXiv preprint arXiv:2203.05192_ , 2022.
  * [6] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in _Artificial intelligence and statistics_. PMLR, 2017, pp. 1273–1282.
  * [7] R. W. van der Heijden, S. Dietzel, T. Leinmüller, and F. Kargl, “Survey on misbehavior detection in cooperative intelligent transportation systems,” _IEEE Communications Surveys & Tutorials_, vol. 21, no. 1, pp. 779–811, 2018.
  * [8] A. Uprety, D. B. Rawat, and J. Li, “Privacy preserving misbehavior detection in iov using federated machine learning,” in _2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC)_. IEEE, 2021, pp. 1–6.
  * [9] A. Boualouache and T. Engel, “Federated learning-based scheme for detecting passive mobile attackers in 5g vehicular edge computing,” _Annals of Telecommunications_ , vol. 77, no. 3, pp. 201–220, 2022.
  * [10] ——, “A survey on machine learning-based misbehavior detection systems for 5g and beyond vehicular networks,” _arXiv preprint arXiv:2201.10500_ , 2022.
  * [11] A. I. Károly, R. Fullér, and P. Galambos, “Unsupervised clustering for deep learning: A tutorial survey,” _Acta Polytechnica Hungarica_ , vol. 15, no. 8, pp. 29–53, 2018.
  * [12] R. Saravanan and P. Sujatha, “A state of art techniques on machine learning algorithms: a perspective of supervised learning approaches in data classification,” in _2018 Second International Conference on Intelligent Computing and Control Systems (ICICCS)_. IEEE, 2018, pp. 945–949.
  * [13] M. Usama, J. Qadir, A. Raza, H. Arif, K.-L. A. Yau, Y. Elkhatib, A. Hussain, and A. Al-Fuqaha, “Unsupervised machine learning for networking: Techniques, applications and research challenges,” _IEEE access_ , vol. 7, pp. 65 579–65 615, 2019.
  * [14] F. Zhang, K. Kuang, L. Chen, Z. You, T. Shen, J. Xiao, Y. Zhang, C. Wu, F. Wu, Y. Zhuang _et al._ , “Federated unsupervised representation learning,” _Frontiers of Information Technology & Electronic Engineering_, vol. 24, no. 8, pp. 1181–1193, 2023.
  * [15] Y. Jin, Y. Liu, K. Chen, and Q. Yang, “Federated learning without full labels: A survey,” _arXiv preprint arXiv:2303.14453_ , 2023.
  * [16] J. L. Hernandez-Ramos, G. Karopoulos, E. Chatzoglou, V. Kouliaridis, E. Marmol, A. Gonzalez-Vidal, and G. Kambourakis, “Intrusion detection based on federated learning: a systematic review,” _arXiv preprint arXiv:2308.09522_ , 2023.
  * [17] R. W. van der Heijden, T. Lukaseder, and F. Kargl, “Veremi: A dataset for comparable evaluation of misbehavior detection in vanets,” in _Security and Privacy in Communication Networks: 14th International Conference, SecureComm 2018, Singapore, Singapore, August 8-10, 2018, Proceedings, Part I_. Springer, 2018, pp. 318–337.
  * [18] V. Vashishth, A. Chhabra, and D. K. Sharma, “Gmmr: A gaussian mixture model based unsupervised machine learning approach for optimal routing in opportunistic iot networks,” _Computer Communications_ , vol. 134, pp. 138–148, 2019.
  * [19] C. M. Bishop, “Neural networks and their applications,” _Review of scientific instruments_ , vol. 65, no. 6, pp. 1803–1832, 1994.
  * [20] M. Said Elsayed, N.-A. Le-Khac, S. Dev, and A. D. Jurcut, “Network anomaly detection using lstm based autoencoder,” in _Proceedings of the 16th ACM Symposium on QoS and Security for Wireless and Mobile Networks_ , 2020, pp. 37–45.
  * [21] P. Yu, A. Kundu, L. Wynter, and S. H. Lim, “Fed+: A unified approach to robust personalized federated learning,” _arXiv preprint arXiv:2009.06303_ , 2020.
  * [22] E. M. Campos, P. F. Saura, A. González-Vidal, J. L. Hernández-Ramos, J. B. Bernabe, G. Baldini, and A. Skarmeta, “Evaluating federated learning for intrusion detection in internet of things: Review and challenges,” _Computer Networks_ , p. 108661, 2021.
  * [23] P. Awasthi and O. Sheffet, “Improved spectral-norm bounds for clustering,” in _Approximation, Randomization, and Combinatorial Optimization. Algorithms and Techniques_. Springer, 2012, pp. 37–49.
  * [24] D. A. Reynolds, “Gaussian mixture models.” _Encyclopedia of biometrics_ , vol. 741, no. 659-663, 2009.
  * [25] D. P. Kingma and M. Welling, “Auto-encoding variational bayes,” _arXiv preprint arXiv:1312.6114_ , 2013.
  * [26] K. Zhang, Y. Jiang, L. Seversky, C. Xu, D. Liu, and H. Song, “Federated variational learning for anomaly detection in multivariate time series,” in _2021 IEEE International Performance, Computing, and Communications Conference (IPCCC)_. IEEE, 2021, pp. 1–9.
  * [27] R. Yao, C. Liu, L. Zhang, and P. Peng, “Unsupervised anomaly detection using variational auto-encoder based feature extraction,” in _2019 IEEE International Conference on Prognostics and Health Management (ICPHM)_. IEEE, 2019, pp. 1–7.
  * [28] J. Sun, X. Wang, N. Xiong, and J. Shao, “Learning sparse representation with variational auto-encoder for anomaly detection,” _IEEE Access_ , vol. 6, pp. 33 353–33 361, 2018.
  * [29] J. An and S. Cho, “Variational autoencoder based anomaly detection using reconstruction probability,” _Special Lecture on IE_ , vol. 2, no. 1, pp. 1–18, 2015.
  * [30] J. M. Joyce, “Kullback-leibler divergence,” in _International encyclopedia of statistical science_. Springer, 2011, pp. 720–722.
  * [31] G. E. Hinton and R. R. Salakhutdinov, “Reducing the dimensionality of data with neural networks,” _science_ , vol. 313, no. 5786, pp. 504–507, 2006.
  * [32] X.-J. Wu, M.-D. Xu, C.-D. Li, C. Ju, Q. Zhao, and S.-X. Liu, “Research on image reconstruction algorithms based on autoencoder neural network of restricted boltzmann machine (rbm),” _Flow Measurement and Instrumentation_ , vol. 80, p. 102009, 2021.
  * [33] A. G. Pacheco, R. A. Krohling, and C. A. da Silva, “Restricted boltzmann machine to determine the input weights for extreme learning machines,” _Expert Systems with Applications_ , vol. 96, pp. 77–85, 2018.
  * [34] S. Saravanan and J. Sujitha, “Deep medical image reconstruction with autoencoders using deep boltzmann machine training,” _EAI Endorsed Transactions on Pervasive Health and Technology_ , vol. 6, no. 24, p. e2, 2020.
  * [35] P. Sharma and H. Liu, “A machine-learning-based data-centric misbehavior detection model for internet of vehicles,” _IEEE Internet of Things Journal_ , vol. 8, no. 6, pp. 4991–4999, 2020.
  * [36] O. Slama, B. Alaya, S. Zidi, and M. Tarhouni, “Comparative study of misbehavior detection system for classifying misbehaviors on vanet,” in _2022 8th International Conference on Control, Decision and Information Technologies (CoDIT)_ , vol. 1. IEEE, 2022, pp. 243–248.
  * [37] G. O. Anyanwu, C. I. Nwakanma, J.-M. Lee, and D.-S. Kim, “Real-time position falsification attack detection system for internet of vehicles,” in _2021 26th IEEE International Conference on Emerging Technologies and Factory Automation (ETFA)_. IEEE, 2021, pp. 1–4.
  * [38] T. Moulahi, R. Jabbar, A. Alabdulatif, S. Abbas, S. El Khediri, S. Zidi, and M. Rizwan, “Privacy-preserving federated learning cyber-threat detection for intelligent transport systems with blockchain-based security,” _Expert Systems_ , p. e13103, 2022.
  * [39] J. Kamel, M. Wolf, R. W. Van Der Hei, A. Kaiser, P. Urien, and F. Kargl, “Veremi extension: A dataset for comparable evaluation of misbehavior detection in vanets,” in _ICC 2020-2020 IEEE International Conference on Communications (ICC)_. IEEE, 2020, pp. 1–6.
  * [40] E. Kristianto, P.-C. Lin, and R.-H. Hwang, “Misbehavior detection system with semi-supervised federated learning,” _Vehicular Communications_ , p. 100597, 2023.
  * [41] B. Zong, Q. Song, M. R. Min, W. Cheng, C. Lumezanu, D. Cho, and H. Chen, “Deep autoencoding gaussian mixture model for unsupervised anomaly detection,” in _International conference on learning representations_ , 2018.
  * [42] P. An, Z. Wang, and C. Zhang, “Ensemble unsupervised autoencoders and gaussian mixture model for cyberattack detection,” _Information Processing & Management_, vol. 59, no. 2, p. 102844, 2022.
  * [43] W. Liao, Y. Guo, X. Chen, and P. Li, “A unified unsupervised gaussian mixture variational autoencoder for high dimensional outlier detection,” in _2018 IEEE International Conference on Big Data (Big Data)_. IEEE, 2018, pp. 1208–1217.
  * [44] Z. Zhao, X. Liang, H. Huang, and K. Wang, “Deep federated learning hybrid optimization model based on encrypted aligned data,” _Pattern Recognition_ , vol. 148, p. 110193, 2024.
  * [45] Y. Chen, J. Zhang, and C. K. Yeo, “Network anomaly detection using federated deep autoencoding gaussian mixture model,” in _International Conference on Machine Learning for Networking_. Springer, 2019, pp. 1–14.
  * [46] D. Preuveneers, V. Rimmer, I. Tsingenopoulos, J. Spooren, W. Joosen, and E. Ilie-Zudor, “Chained anomaly detection models for federated learning: An intrusion detection case study,” _Applied Sciences_ , vol. 8, no. 12, p. 2663, 2018.
  * [47] B. Cetin, A. Lazar, J. Kim, A. Sim, and K. Wu, “Federated wireless network intrusion detection,” in _2019 IEEE International Conference on Big Data (Big Data)_. IEEE, 2019, pp. 6004–6006.
  * [48] M. B. Alazzam, F. Alassery, and A. Almulihi, “Federated deep learning approaches for the privacy and security of iot systems,” _Wireless Communications and Mobile Computing_ , vol. 2022, 2022.
  * [49] D. Wu, Y. Deng, and M. Li, “Fl-mgvn: Federated learning for anomaly detection using mixed gaussian variational self-encoding network,” _Information Processing & Management_, vol. 59, no. 2, p. 102839, 2022.
  * [50] L. Codeca, R. Frank, and T. Engel, “Luxembourg sumo traffic (lust) scenario: 24 hours of mobility for vehicular networking research,” in _2015 IEEE Vehicular Networking Conference (VNC)_ , 2015, pp. 1–8.
  * [51] G. E. Batista, A. L. Bazzan, M. C. Monard _et al._ , “Balancing training data for automated annotation of keywords: a case study.” in _WOB_ , 2003, pp. 10–18.
  * [52] S. S. SHAPIRO and M. B. WILK, “An analysis of variance test for normality (complete samples),” _Biometrika_ , vol. 52, no. 3-4, pp. 591–611, dec 1965. [Online]. Available: https://doi.org/10.1093/biomet/52.3-4.591
  * [53] A. Etz, “Introduction to the concept of likelihood and its applications,” _Advances in Methods and Practices in Psychological Science_ , vol. 1, no. 1, pp. 60–69, 2018.
  * [54] P. J. Rousseeuw, “Silhouettes: a graphical aid to the interpretation and validation of cluster analysis,” _Journal of computational and applied mathematics_ , vol. 20, pp. 53–65, 1987.
  * [55] M. Zolotukhin, T. Hämäläinen, T. Kokkonen, and J. Siltanen, “Increasing web service availability by detecting application-layer ddos attacks in encrypted traffic,” in _2016 23rd International conference on telecommunications (ICT)_. IEEE, 2016, pp. 1–6.
  * [56] N. Garcia, T. Alcaniz, A. González-Vidal, J. B. Bernabe, D. Rivera, and A. Skarmeta, “Distributed real-time slowdos attacks detection over encrypted traffic using artificial intelligence,” _Journal of Network and Computer Applications_ , vol. 173, p. 102871, 2021.
  * [57] D. J. Beutel, T. Topal, A. Mathur, X. Qiu, T. Parcollet, and N. D. Lane, “Flower: A friendly federated learning research framework,” _arXiv preprint arXiv:2007.14390_ , 2020.