Intrusion detection system using distributed multilevel discriminator in GAN for IoT system

The artificial intelligence‐based Internet of vehicles (IoV) systems are highly susceptible to cyber‐attacks. To reap the benefits from IoV applications, the network must be protected against numerous security threats. Attacks that have been reported by attackers within the IoV system are found using intrusion detection systems (IDSs). Instead of relying on a centralized server, a distributed classifier is required for large‐scale networks like IoV.Datasets are kept secret because managing sensitive information is a difficult task. Due to privacy concerns, devices are not intended to share information among themselves. This paper proposes a multilevel discriminator for the distributed model of IDS with generative adversarial networks (GANs) for IoV devices. Without relying on a centralized controller, the suggested architecture leverages a multilevel distributed GAN model to identify abnormal behavior. Each IoV device in the proposed architecture communicates with its neighbors in a peer‐to‐peer fashion to monitor its data and identify both internal and external threats on other devices nearby. Additionally, the proposed design makes sure that datasets do not need to be shared with other IoV devices, ensuring the privacy of all IoV system data, including sensitive data‐like vehicular data.


INTRODUCTION
The cyber-physical systems (CPSs) need to be monitored with high amount of substantial data from the large complex data centers, the some of the systems which is mentioned such as smart buildings, power plants, and factories, generates multivariate time series data from the source of networked sensors and actuators which in turn used to uninterruptedly observe the cyber physical systems for the anomaly detection on time with some working conditions 1 , so it can be progressed to address the issues with further investigation by the operators.The cyber physical systems with the manner of ubiquitous form of networked sensors and actuators (i.e., autonomous vehicles) can be more predominant with the Internet of Things (IoT), which leads to the variety of tasks possible autonomously in the networks by communicating with the multiple systems and devices.The CPS is known to be made for the critical mission-oriented tasks, so it can be mentioned that it is a crucial task for cyber-attacks.So it is significant to monitor the actions of the events of intrusions, closely to determine the anomaly detection with the time series data.
The attack/anomaly is usually represented using the points where it is deviated from the normal status in particular time steps.The behavioral status is monitored with respect to the previous behaviors in certain time steps. 2The objective is to identify the point where occurrence of anomaly occurs in which particular time steps it is occurred.In the conventional method, with statistical control such as EWMA, CUSUM and Shewhart charts are the solutions for finding the working states that are out of working range and also significantly monitor the quality of the process. 3Although the methods monitor the scenarios with abnormalities, the traditional system of detection methods are incapable of dealing with the data in streams with the quantity of multivariate produced by the outcome of progressively more complex cyber physical systems and high dynamic modern systems.As, it is familiar that researchers are exploring beyond the specification or the techniques based on the signature which starts to begin the activity of exploiting the techniques of machine learning to take advantage of system generated data with lump sum amounts of quantity. 4Because of the absence of tagged data, the detection of attacks/anomalies is said to be an unsupervised method of learning tasks.Yet, many of the methods following unsupervised methodology are framed with scheduling the linear type and the transformation which are difficult to handle and deal with the nonlinear latent internal interactions of multiple time series.Furthermore, the recent technique utilized a preliminary level of comparisons between present states and expected normal limits to explore inconsistencies, which is not able to cope up with high system dynamics.
Recently, the generative adversarial networks abbreviated as GANs is the model to generate the data which are similar to the realistic training dataset and it is simply called the generative models, the generator models produce the data with the same probabilistic distribution with input noise to the generator.Initially, the GAN is introduced by the author Goodfellow et al., in research work. 5The GAN is utilized for the applications to produce the pictures from the instance of descriptions with text, 6 and still images are taken as input to produce the videos, 7 the images can be improvised in terms of pixel resolution, 8 and also manipulate the images. 9Play games like chess 10 detection of anomalies and Intrusion detection system 11 are proposed, the above works which have many highlights and a lot of research work toward GAN with cross-domain interest.
A GAN consists of a deep neural network with the machine learning model, and the certain type of two deep neural networks are tightly coupled and work together in competent manner to provide good results in the above mentioned applications.Even though, it is projected that it is successful in many of the domain-like image processing such as good quality of images which looks similar to the realistic images, it is found that it is limited contributions in the area of anomaly detection which deals with the time series continuous data which utilized the GAN framework to date.According to the survey, there are only a few preliminary levels of research carried out on the GAN with sequences of data with continuous values, to the best of our knowledge.As we explored that it in earlier works, the framework of adversarial setup with GAN is provided the best system for time series generation sequences, and its proved that it either generate the music (polyphonic) with RNN base setup of adversarial mechanism of tightly coupled generator and discriminator, 12 or to make use of conditional GAN with recurrent version for generating the medical data with sequential time series. 13hese prior approaches with GAN framework for generating the realistic samples as the original one with high dynamic and complex datasets are the earlier success achieved, through which the adversarial training setup of generator and discriminator in the fashion is the motivation to proceed with the anomaly detection proposal using the GAN framework.
The proposed work manages the challenges faced by training GAN in the federated learning manner.The way in which the updating of weights in the generator with a flow of multilevel discriminators.The self-adaptive method has been followed with the multiple local discriminators with multiple local datasets in the phase of generator learning proposed the intrusion detection using the multilevel discriminator model to distinguish the attack traffic by continuously improving the quality of the generator to produce the attacks similar to the original network traffic.To experiment, the multilevel distributed GAN setup for anomaly detection is done with KDD dataset and SWAT dataset using GPUs.Furthermore, the computing complexities and analytic expectations of communication, this gives some exploration and the advantages of the proposed approach, with the outstanding properties of the multilevel distributed GAN and the adaption of federated learning approaches for the proposed multi-level distribution of GANs.
The research work is organized as follows.Section 2 , survey the methodologies proposed before with clear literature review.Section 3 describes the system model.In Section 4, we describe the distributed computation setup for GAN.In Section 5, we introduce the tested CPSs and datasets with detailed experimental setup and evaluation metrics.Section 5 presents the experimental results of our proposed GAN framework on real dataset KDD.Finally, Section 6, concludes the paper with summarization and the future work. 14

LITERATURE SURVEY
The employment of UAVs in a variety of contexts, including disaster management, surveillance, and wireless coverage enhancement, is discussed in Reference 15.The authors discuss various unsolved issues in the field of UAVs on wireless networks.For safe signal authentication in the IoT, 16 offer a dynamic watermarking method based on deep learning.The authors create a distinct watermark for each signal that may be used to confirm its legitimacy using a convolutional neural network (CNN).The suggested method is tested using a dataset of WiFi signals, and the findings demonstrate that it is highly accurate in identifying fake signals.To highlight the technologies and protocols used in IoT networks, such as wireless sensor networks (WSNs), RFID, and ZigBee, 17 explore several IoT applications, such as smart homes, healthcare, and industrial automation.Scalability, interoperability, and security issues as they relate to IoT adoption are all included in the survey.Saad et al. 18 discussed the potential uses for 6G systems, like holographic communication and intelligent transportation, and draw attention to the technology that will make these uses possible, including millimeter-wave communications, machine learning, and blockchain.suggested an IoT device intrusion detection system based on immunity.The study used a self-learning system to increase the detection precision of IoT devices.Mitchell and Chen 22 carried out a study on IoT-related cyber-physical intrusion detection methods.They examined a range of strategies, including ways based on signatures, anomalies, and specifications. 23developed a low-power wireless protocol called 6LowPAN that is based on an analysis of energy consumption to be used for IoT device intrusion detection.Summerville et al. 24 suggested a machine learning-based deep packet anomaly detection method for IoT devices.Unsupervised learning was employed in their strategy to find network traffic anomalies.A learning automata-based approach was suggested by Misra et al. 25 to stop distributed denial of service (DDoS) assaults in the IoT.In their method, they used a game-theoretic model to determine the best defense against DDoS attacks.For the purpose of identifying attacks on RPL-based network topology, Le et al. 26 suggested a specification-based intrusion detection system (IDS).Their method relied on a model of a state machine to identify intrusions based on departures from normal behavior.For wireless sensor networks that support IPv6, Amaral et al. 27 suggested a policy and network-based IDS.Their strategy employed a set of policies to find intrusions and a network-based model to locate the intrusion's origin.Ferdowsi and Saad 28 suggested a dynamic watermarking method based on deep learning for signal security and authentication in sizable IoT systems.Their method involved encoding a secret key in the transmitted signal and authenticating it at the receiver end using a deep neural network.A distributed internal anomaly detection system for IoT was suggested in the study. 29The system depended on a distributed design to enable scalability and fault tolerance and employed a rule-based method to detect anomalies.The efficiency of the system in identifying various sorts of abnormalities was demonstrated by the authors through simulations of the system evaluation.A technique for identifying sinkhole attacks in 6LoWPAN-based IoT networks was suggested in a different study by Cervantes et al. 30 In order to distinguish between normal and abnormal routing behavior, the system depended on the detection of anomalous routing behavior.A solution for anomaly detection and privacy protection in cloud-centric IoT was suggested in the work by Butun et al. 31 To identify abnormalities and safeguard privacy, the system used feature selection, clustering, and classification techniques.Abeshu and Chilamkurti 32 developed a deep learning-based method for fog-to-things computing's distributed attack detection.To identify attacks at the network edge, the authors employed a CNN, which decreased communication costs and increased system scalability.In a different study, Diro and Chilamkurti 33 presented a deep learning-based distributed attack detection system for the IoT.To increase the system's accuracy and scalability, the authors adopted a distributed architecture and a CNN-based anomaly detection algorithm.A distributed hyperspherical cluster-based anomaly detection system for wireless sensor networks was suggested in Reference 34.The sensor nodes were grouped by the system according to their typical behavior using a clustering algorithm, and anomalous nodes were found using a distance-based anomaly detection method.Kenarangi and Partin-Vaisband 35 suggested an independent twin gate finfet-based machine learning categorization system.The authors demonstrated how using finfet devices could enhance the classification process's accuracy and speed, which is essential for real-time anomaly detection systems.Ravanbakhsh et al. 36 suggested using GANs to create a system for abnormal event detection in videos.To identify anomalous occurrences and learn the video's typical behavior, the authors developed a GAN-based architecture.In a different work, Ravanbakhsh et al. 37 proposed an adversarial discriminator-based system for cross-channel anomalous event detection in crowds.To recognize anomalous events in many channels, including motion and appearance, the authors combined various sorts of discriminators.The system's usefulness in identifying various forms of anomalies was demonstrated by the authors through studies that tested the system.Schlegl et al. 38 suggested using GANs to create an unsupervised anomaly detection system for medical imaging.To figure out how the photos were distributed normally and identify abnormal images, the authors employed a GAN-based architecture.An effective GAN-based technique for anomaly identification is suggested by Zenati et al. 39 To create regular data samples and identify abnormal samples, they employ a conditional GAN.
Nowadays, GAN architecture is considered an efficient methodology using the unsupervised learning anomaly detection methods in time series applications and also in computer vision. 40,41Although, these time series work, using centralized GANs that grants access to the data.Hassan et al. 42 offered a trust-boundary security approach with deep learning capabilities for combative industrial IoT contexts.Their approach entails training a GAN to produce normal data, then using the difference between the input data and the closest generated normal sample to find abnormalities.Ferdowsi et al. 43 suggested a distributed intrusion detection solution based on GAN for IoT devices.Their approach entails integrating the outputs of many GANs that have been trained on various data subsets in order to find anomalies.An RNN-based technique for anomaly identification in CPSs is presented in Reference 44 As part of their approach, an RNN is trained to simulate the system's typical behavior, and anomalies are then identified by comparing the input data to the RNN's forecast.
On the contrary, there are some disadvantages in the centralized concept of GAN, like increased vulnerability due to high dependency on central units.The attacker can take advantage of central control for the attacks.The next most important cause is that it has high communication overhead due to the centralized nature of GAN.The distributed multilevel GAN architecture enables the system of IoTDs to free from vulnerabilities. 14

Contributions
• In this work, the multilevel discriminator approach is proposed training distributed GAN with sequential local discriminators.
• The proposed work manages the challenges faced by training GAN in the federated learning manner.The way in which the updating of weights in the generator with a flow of multilevel discriminators.
• The self-adaptive method has been followed with the multiple local discriminators with multiple local datasets in the phase of generator learning • Proposed the Intrusion detection using the Multilevel discriminator model to distinguish the attack traffic by continuously improving the quality of the generator to produce the attacks similar to the original network traffic.

SYSTEM MODEL
The GAN consists of two Deep Neural networks, the Generator "A" and Discriminator "B." Generally the input noise data, the random vectors similar to the original training dataset will be generated by the generator "A." The generator following the vector size of "v" follows the normal distribution D (0, 1). Figure 1 shows the Basic structure of GAN.
In GAN, the generative models used to make instances of data because in this case we are learning the distribution function of the data itself, which is not possible using the discriminator, we are using the generative model is to produce new data points that is we are producing fake data points using our generator and we are using this discriminator to tell if a given data point, is an original one or it has been produced by our generator.Now these two models work in an adversarial setup that means they compete with each other and eventually both of them get better and better at their job.The basic structure of GAN is presented in Figure 1.
Here in this structure, A and B are the multi-layered neural networks; here, we use neural networks because it can approximate any functions.Here, w and  are the weights.The distribution function of the original data is high-dimensional complex data (e.g., images).Now in the generator A, we sample some data from noise data D, we feed that to our generator A, as input and pass this D to our model generator A, it will produce A(z).Now the distribution of A(z) is the same as x, because we are using the domain of our original data as same as A(z).Because we are trying to replicate our original data p data .Now, the reconstructed data from the generator A and original data are given as input to the discriminator B, the output will be the single number, in which it mentions whether probability input belongs to the original data.So the discriminator here basically acts as a binary classifier.For the training purpose, we give original data as input to the discriminator, y = 1 and when we pass the reconstructed data, we mention the level is 0. The Discriminator B always tries to maximize the chances of predicting correct classes.But A will always try to fool G, thus we can say G and D always play the 1-1 minimax game in the standalone GAN.
The discriminator "B," goal is to discriminate the anomalous data from original data.The input to the discriminator "B" is noise denoted by z follows the normal distribution z ∼ D  and data space T, where "t" in that dataset follows distribution P data in the training dataset.In the learning phase, the discriminator was able to differentiate the generated data and original training dataset.The generator A follows the probability distribution as original data.With a sequence of iterations, the dataset arriving from the generator A looks closer to the original data distribution, thus making it difficult to differentiate between the generated data and the training data.
Let, the training dataset dataspace T, where "t" in that follows the distribution probability P data .
The GANs framework chained the system of 2 DeepNN, Generator A and the Discriminator B. Here, the GAN architecture as proposed by Goodfellow et al., 15 both learns the distribution.The generator function is given as A w : R  -> T, where the features are denoted with "w" of DeepNN in which the  and A w is fixed.
As we have mentioned already in a minmax game between the generator A and the discriminator B, the one player is trying here to maximize the probability of winning and the other player is trying to minimize the probability of winning for the first player.The minmax is described below with the mathematical model.
The discriminator function is shown as where the probability function is denoted by B  (t) and the data from the training dataset is denoted with "t," the θ is the features of the discriminator B  .The generator learns, by taking log for the log base 2, finding the parameter ŵ for the generator i and representing it in Equation (1). With and where P data is the distribution of real data, B  (t) is the discriminator network; A w (z) is the generator network; z∼D l is the distributor of generator; t is the sample from real data; and z is the sample from generator.
Where z ∼ D  , the random vector z follows the  dimensional for each entry similar to the normal distribution with fixed features.To maximize the M  , B adjusts its parameters  for optimal classification between the real data and classification between the generated data.Whereas, to minimize N +w (no impact on M), in which the minimization of the optimal classification of B.
The iterative function for learning is executed in two steps.
Discriminator learning : In the discriminator learning, the objective is to maximize M  + N +w with actual w, by approximating the parameter  with a fixed A w is the first step.The gradient descent function is used with Adam optimizer for finding the discriminator error is represented in Equation (2). With ) where T r is a batch of "s" randomly drawn data from the dataset and the batch "s" generated the data from the generator "A" is T b .In original GAN paper, the discriminator performs with gradient descent to determine the optimal  against the fixed A w .
Loss function : Each sample data s at (y = 1), it adds log(p(y)) to the loss, that is, the log probability of it being original data.Conversely, it adds log(1-p(y)), that is, the log probability of it being generated data, for each (y = 0).Loss Function and Weight Update represented in Equation 3 and Equation 4.
Weight update : where ŵ is the new weight; η is the learning rate; L/w is the Derivative of error w.r.t weight; and w is the old weight Generated learning: The generator learning step consists in adapting w to the new parameter .As it is done in Step 1 it is achieved by error function (gradient descent)

DISTRIBUTED COMPUTATION SETUP FOR GAN
Consider the multiple IoT devices belonging to the IoT system, Let us say set N of n IoTDs in which it operates with single "A," hosted on the server.Each discriminator shares the data split to each IoTD to ease the process and to remove the high workload to the server.The discriminators are exclusively hosted in each IoTD, and it communicates between then in peer-to-peer mode, Each IoTD n operates with its own discriminator B n with parameter  n .Distributed of GAN architecture is presented in Figure 2. The Generator A is trained using S, and in our proposed distributed GAN architecture, the discriminator B placed on the server utilizes each IOTDs and their local dataset for training.It is a 1 Vs N game, where a generator placed on server A confronts all B n , that is, "A" attempts to generate data that all IoTDs assume to be true.IoTDs use their local databases S n to differentiate the data generated from the actual data.Global learning repetitions are compared in four steps.
1.The server creates a set V of " v " batches V = { T (1) , .. .. T (v) } with v ≤ N.Each T (i) is made of s data from A. The central server, sending two different batches named as T (i) and T (j) to the IoTD n , locally renamed as T (a) n and T (b) n .2. Each IoTD n "L" makes learning repetitions on its discriminator B n using T (a) n and T (r) n where T (r) n from S n .3. Using B n each IoTD n calculates an error feedback U n on T (a) n and sends this error to the server by calculating the loss function and update the weights minimizing In each global iteration, the server receives erroneous feedback U n from each IoTD n to the error made by A. 4. Once the gradient is calculated, the server can update its parameters.As a common way to integrate compliant processed updates, we choose to integrate feedback updates through the average process.Using the Adam optimizer using B n each IoTD n calculates an error feedback U n on T (a) n and communicates the error to the central server.In each global iteration, server receives erroneous feedback U n from each IoTD n to the error made by A correspondingly.More formally, U n is composed of "s" vectors where k n i is given by where t i is the i th data of batch T (a) n .The gradient Δw = N * is deducted from all U n as follows: where Δw j is the j th element of Δw.The term ) parameters w i ∈ w at iteration "h" denoted by w i (h) here is computed as follows: The gradient Δw j is calculated by using the Adam Optimizer function.
The new IoTDs can join the learning iterations, if it is trained with a pretrained discriminator from the neighboring IoTD discriminator.

Intrusion detection using distributed GAN
The layered GAN architecture creates artificial packets of network attacks by exploiting the mutations of the real attack traffic.It is based on a formula that provides optimal integration of the error reduction process.As shown in Figure 3, the Multilevel GAN structure consists of three components: generator, discriminator, and analyzer.Initially, uniform random distribution is used during GAN training to run synthetic models.The generating network then modifies the artificial models in an attempt to make them identical to the real attacks.Then artificial attacks are sent to the discriminator.The discriminator tries to distinguish real attacks from artificial ones.Provides feedback to the network dramatically improve the quality of the generator.At the end of the GAN training, only the generator is used to create artificial attacks.Finally, the gradient boosting classifier, the estimator, attempts to distinguish between actual and generated attack packets using standard criteria based on square root error.We chose to use the score improvement method because it makes it easier to identify related features that are used to classify traffic.Figures 3 and 4 show the architecture and distributed architecture of multi-level GAN of anomaly detection using GAN, respectively.Table 1 provides a comprehensive list of notations Architecture of anomaly detection using GAN.

F I G U R E 4
Distributed architecture of multi-level GAN for anomaly detection.

I
Training iterations V X (1) , … X (v) batches generated by A during single iteration

U n
The feedback error computed by IoTD n E Epocs used in the paper and also serves as a useful reference point for the reader to quickly look up any unfamiliar notation encountered in the paper.

EXPERIMENTAL SETUP
In terms of implementation details, we have implemented the multilevel distributed GAN using the Tensorflow library, The 100 hidden units are used in the research with RNN-LSTM and depth 3 is used for the generator.The specification of hidden 100 units with depth 1 is a very easy task that can be implemented in the environment of the LSTM network for the discriminator.The latent space dimension is found at the source; here in our work, we also implement the different dimensions and determine that better samples specifically for continuous sequence generation have been achieved using the higher latent space dimension.In our research study, the latent space dimension is fixed as 15 for latent space.
The GAN infrastructure is designed with LSTM-RNN to handle the continuous time series data, the Generator A and discriminator B are designed as two long-short-term recurrent neural networks, the diagram clearly represents the middle part as shown.Following a typical GAN framework, the generator (A) and intended to generate the sequence of time series data fake, with the source as the random latent space, and that has been given as the input to the discriminator B from the generated sequence from the generator A. And as we are familiar that it is adversarial set up to identify and classify the output generated from generator A, as fake sequence and also actual datasets which have been given as original training dataset.Despite considering the dataset individually, our model with multiple discriminators is used for the concurrent process of considering the complete variables set to capture the interactions of space allocated randomly among the models.As we generate the multivariate time series of data, we divide the sequences into the sub-sequences with reference to the window; name it as sliding window before the classification process with the discriminator (B).The next task, to identify the optimal length for the window, the input data to be represented as sub-sequences.We utilize the many different sizes of window on status with various resolutions, represented as As given in the conventional GAN setup with adversarial framework, the parameters of A and B are updated with respect to the output generated from B, by using this step, the discriminator B, in turn will get trained to be with improved accuracy to assign the right labels for the inputs from the generator and actual datasets, fake and real respectively.Since, as we have already discussed on the adversarial setup, the generator also get smart and trained in turn to fool the discriminator B (i.e confuse the discriminator B, so that it could not allocated the labels accurately whether it belongs to fake and real) after some specific number of iterations.The generator meanwhile produces the samples as realistic ones.A representation of the generator imitates the real hidden multivariate data distributions of the data sequences for training and can be seen as the inherent model with normal status.Meanwhile, as mentioned, the discriminator is also capable of discriminating the real and fake better and better with a sequence of iterations with high accuracy.In our proposed model, we exploit both A and B, for the purpose of anomaly detection by 1. Reconstruction: the reconstructed samples from the generator A, residuals with respect to the realistic set of dataset with testing samples is exploited to the GAN latent space 2. Discrimination: the discriminator B is to discriminate the time series and it is explicitly depicted.The latent space is utilized in the mapping back the testing samples for calculating the loss of reconstruction correspondingly, by identifying the difference on the testing samples of reconstructed and actual one.In the meantime, testing samples are given as input to the discriminator B, to calculate the loss of the discriminator.The sub-sequences of multivariate series of testing data are divided and given by a sliding window to be given as input to the proposed detection model.We proposed the novel multi discriminator B for the discrimination and the reconstruction with the anomaly score to merge the multiple loss scenarios to have a better system of detecting anomalies potentially in the data.

KDD99:
The evaluation of methods with the network dataset KDD99 is fed into the system which is utilized to prove that our model built up with GAN framework outperform well in high dimensional and also the non-image data.The experimental setup for this KDDCUP99 and the dataset from the UCI repository, which chosen repository of the outliers with the proportion, of data with usual behaviors, is considered as the anomalies in this scenario.The 20% top samples with the high score of anomaly A z (t) are classified as anomalies, with the evaluation metrics precision, recall and F1 score.For the purpose of training data samples 50% selected randomly from the complete dataset and other 50% for the testing.For the purpose of training, the data samples from the usual behaviors from the normal set are utilized with the training module.So, that it is explicit, the samples of behaviors with anomalies in the training set split are removed at the end.The proposed model has proved best competitive results and attains the higher recall with other state of art methods.Dataset 1 used in the research is described in Table 2 in detail.The KDDCUP99 dataset, which includes information about the number of variables or features in the dataset, the quantity and length of attacks, the size of the training dataset, which only contains normal data, the size of the testing dataset, which also includes normal and attack data, and the proportion of the normal dataset in the total dataset.

Dataset 2
For the dataset SWAT, with 11 days observation it measured sensor readings and states with 51 variables.The samples of 496 800 with normal conditions of working, the raw data were collected; it represents the data collected for a week time.The sample of 449 919 is the representation with some cyber-attacks inserted and it is collected with the attacks were subsequently inserted into the system.In this dataset, we removed a certain number of samples 21 600 for the purpose of training with normal state.It is observed that it took some 5-6 h of time for the system to reach the state of stabilization, by the time the system gets turned on for the first time.During the process of detection technique of anomalies, the sliding window is used by dividing the sequences into the series of data with raw streams of data.Next task is to decide on the optimal window size for the sequence length of the sub sequences for the time series study to attain the best results.We experimented with the different length of windows with different resolutions for capturing the status of the system called S w = 30 × i; i = 1,2, … 10.The test dataset with S s = 10 as shift length, for capturing the dynamics of relevant SWAT dataset.The amount of data and composition of the SWAT dataset utilized in the study are detailed in Table 3 along with other pertinent information.Understanding the study's findings and how the suggested anomaly detection methods performed on this dataset depends on this information.

Evaluation metrics
The standard metrics Precision (Pre), Recall (Rec), and F 1 scores, are used to evaluate the performance of anomaly detection using the proposed model of distributed Multi-level GAN.Equations 5, 6, and 7 show the Multilevel GAN's F1 score, recall, and precision. ) where TP is represented as correctly detected anomaly which is true positive, FP (False Positive) is the falsely detected anomaly, TN (True Negatives) is identified as normal accurately, and FN (False Negatives) is identified as anomaly, which is really normal data.

Anomaly detection performance.
The KDDCUP99 dataset, a well-balanced dataset, was used in this application of the GAN model with distributed multi discriminator.With this dataset, the suggested model achieved an F1 score of 0.77, an accuracy value of 98.92%, and a recall value of 98.98%.Although our proposed model outperforms the current system of GAN model of EGAN with KDD dataset, the findings of the existing work EGAN for the KDDCUP99 dataset are better.Additionally, experimental evidence shows that our suggested system performs best in comparison to EGAN in terms of assessment metrics for the KDDCUP99 dataset.Due to its sufficient capacity for learning data with complex time series, we implemented the LSTM-RNN in our model and discovered that it performed better than CNNs used in the conventional EGAN technique.We used the well-balanced SWAT dataset with the GAN model with a distributed multi discriminator.
Comparatively to unsupervised detection techniques, the suggested model consistently performs well.The proposed model's slight downside is that LSTM-RNN takes more time to process large sub-sequences; for example, the model may sluggish down when the length of the sub-sequence S w exceeds 300.Therefore, it is also mentioned that by taking into account the temporal collection and the optimal choice of subsequence length to be used in the future work, we can examine the other neural network options.On the basis of their precision, recall, and F1 score on the KDDCUP99 dataset, various anomaly detection techniques are compared in Table 4 for the purpose of comparison.EGAN, proposed Model #, proposed Model ##, and proposed Model ### are the four approaches listed in the table.
Table 4 demonstrates that the suggested model, which selects results based on best F1 score, outperforms the other techniques in terms of F1 score (0.22), demonstrating that it is a model with a more balanced ratio of precision (81.58%) to recall (98.98%).The results, however, also illustrate the difficulties in reaching high accuracy in anomaly identification, as the precision and recall scores of various approaches fluctuate greatly.
Figures 5-7 with results of evaluation metrics on KDDCUP99 dataset, with metrics as precision, recall and F1 with the different sub-sequence lengths.The chart with box type clearly represents that it's shown as the performance with the fixed iterations of 100.The line which is represented in is the values of median in all the figures.The symbol of triangle represents the mean values and all which is connected with the lines.On the SWAT dataset, Table 5    that the suggested model outperforms EGAN in terms of precision, recall, and F1 score, demonstrating that it is a more efficient technique for finding anomalies in the SWAT dataset.We can see from the table that both techniques had excellent precision and recall ratings.With a precision score of 99.00% and a recall score of 98.92%, the suggested model surpassed EGAN, yielding an F1 score of 0.97.EGAN, on the other hand, received precision, recall, and F1 scores of 92.00%, 95.82%, and 0.74 respectively.Figures 8-10

F I G U R E 5 8
Precision of the proposed model with KDDCUP99.F I G U R E 6 Recall of the proposed model with KDDCUP 99.F I G U R E 7 F1 of the proposed model with KDDCUP99.TA B L E 5 The comparison results of anomaly detection methods with metrics on SWAT dataset.Precision of the proposed model with SWAT dataset.

F I G U R E 9
Recall of the proposed model with SWAT dataset.
use the SWAT dataset to illustrate the accuracy, recall, and F1 of the suggested model.

F I G U R E 10 F1 6 CONCLUSION
of the proposed model with SWAT dataset.Critical mission-oriented tasks are frequent in cyber physical systems, which leaves them open to cyberattacks.As a result, keeping an eye on incursion occurrences is essential for time series data anomaly The suggested work intends to solve the problems encountered during federated learning-based GAN training.Multilevel discriminators are employed in the generator to update the weights.In the generator learning phase, a self-adaptive approach is used using several local discriminators and numerous local datasets.The multilevel discriminator model for intrusion detection is presented to separate attack traffic by continuously enhancing the quality of the generator to make attacks that resemble legitimate network traffic using GPUs, the multilevel distributed GAN configuration for anomaly detection is tested, and the computing challenges and analytical communication requirements are investigated.The excellent qualities of Multilevel Distributed GAN and the adaptation of federated learning methodologies emphasize the benefits of the proposed approach.The suggested strategy outperforms other unsupervised detection techniques, including other GAN-based systems.The paper also covers the stability of potential GAN model techniques and identifying the ideal subsequence length.The selection of the latent dimension and PC dimension can be the topic of the future research, and a thorough analysis of the stability of the model can be established for spotting anomalies.
compares the performance of the proposed model and EGAN, two different anomaly detection methods.The table demonstrates The comparison results of anomaly detection methods with metrics on KDDCUP99 dataset.
a Results chosen by best Precision.b Results chosen by best Recall.c Results chosen by best F1 Score.