INTRUSION DETECTION BASED ON FEDERATED LEARNING – A REVIEW

Abstract

The lack of access to raw data during model training is addressed by privacy-preserving methods, but the construction of intrusion detection systems remains essential for federated learning. The recent increase in FL-based intrusion detection research between 2019 and 2025 is reviewed, covering study metadata, data types, FL architectural designs, communication architectures, model design, and performance results. We include 90 central studies in five tables, showcasing their areas of application, data and preprocessing, FL topology, client diversity and aggregation strategies, model design with privacy in mind, and performance and robustness outcomes. Our findings show that IoT and IIoT applications, horizontal FL, and FedAvg are common; non-IID data and class imbalance are frequent; and public benchmarks like NSL-KDD and CICIDS2017 are widely used. Nevertheless, standardized FL-IDS benchmarks, energy and latency reporting as well as strong aggregation techniques are not well studied. We single out such promising directions as hierarchical and personalized FL, federated data augmentation, privacy- and robustness-oriented aggregation, and cross-dataset benchmarks. This review aims to assist the researchers and practitioners to swiftly realize the present state of the field, the most important gaps, and concentrate on research that can hasten the implementation of dependable FL-based intrusion detection.