Generative AI and Federated Learning for Intrusion Detection Systems: A Survey

• URL: http://arxiv.org/abs/2607.01305v1
• Date: Wed, 01 Jul 2026 16:37:49 GMT
• Title: Generative AI and Federated Learning for Intrusion Detection Systems: A Survey
• Abstract summary: Intrusion Detection Systems (IDSs) are essential for monitoring network traffic and identifying malicious activities.<n>Recent advances in generative artificial intelligence (AI) and Federated Learning (FL) provide new opportunities to address these limitations.<n>This survey provides a structured review of generative AI and FL techniques for IDS.
• Score: 2.5971299151274416
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Intrusion Detection Systems (IDSs) are essential for monitoring network traffic and identifying malicious activities in modern cyber-physical, Internet of Things (IoT), enterprise, and distributed network environments. However, developing reliable IDS models remains challenging because attack behaviors evolve over time, realistic datasets are difficult to obtain, traffic records may be incomplete, attack classes are often imbalanced, and privacy constraints limit centralized data collection. Recent advances in generative artificial intelligence (AI) and Federated Learning (FL) provide new opportunities to address these limitations. Generative models can support anomaly detection, synthetic traffic generation, data augmentation, data imputation, adversarial traffic generation, and IDS alert explanation. FL enables distributed IDS training without directly sharing local network traffic, making it suitable for privacy-sensitive and geographically distributed environments. This survey provides a structured review of generative AI and FL techniques for IDS. We first summarize representative IDS research directions, including adversarial machine learning, anomaly-based detection, IoT-oriented IDS, explainable IDS, and benchmark datasets. We then categorize generative AI applications in IDS according to model families and task objectives, covering autoencoder-based models, Generative Adversarial Networks (GANs), diffusion models, and Large Language Models (LLMs). Finally, we review emerging studies that integrate generative AI with FL-based IDS and discuss open challenges, including synthetic data quality, realistic traffic generation, dual-use adversarial risks, non-IID client distributions, communication-efficient model sharing, federated IDS benchmarking, and domain-specific LLMs for network security.

Related papers

• Understanding AI Methods for Intrusion Detection and Cryptographic Leakage [42.8384136157456]
  We evaluate how machine learning techniques can detect malicious network activity and identify potential information leakage in cryptographic implementations.<n>Our results demonstrate that AI models can achieve near-perfect detection accuracy within stable network environment.<n>We also observed that learned models identify patterns consistent with side-channel leakage, suggesting that AI can assist in uncovering implementation-level vulnerabilities.
  arXiv  Detail & Related papers  (2026-03-26T18:42:57Z)
• Incremental Federated Learning for Intrusion Detection in IoT Networks under Evolving Threat Landscape [0.5161531917413708]
  This study provides a comprehensive performance analysis of incremental federated learning in enhancing the long term performance of non stationary IDS models in IoT networks.<n>Our results show that cumulative incremental learning and representative learning provide the most stable performance under drift.<n>The study aims to inform the development of more resilient IDS solutions considering the resource constraints in IoT devices.
  arXiv  Detail & Related papers  (2026-03-11T13:51:11Z)
• Federated Agentic AI for Wireless Networks: Fundamentals, Approaches, and Applications [60.721304295812445]
  Federated learning (FL) has the potential to improve the overall loop of agentic AI.<n>We first summarize fundamentals of agentic AI and mainstream FL types. Then, we illustrate how each FL type can strengthen a specific component of agentic AI's loop.<n>We conduct a case study on using FRL to improve the performance of agentic AI's action decision in low-altitude wireless networks.
  arXiv  Detail & Related papers  (2026-03-02T11:26:56Z)
• Multi-Agent Collaborative Intrusion Detection for Low-Altitude Economy IoT: An LLM-Enhanced Agentic AI Framework [60.72591149679355]
  The rapid expansion of low-altitude economy Internet of Things (LAE-IoT) networks has created unprecedented security challenges.<n>Traditional intrusion detection systems fail to tackle the unique characteristics of aerial IoT environments.<n>We introduce a large language model (LLM)-enabled agentic AI framework for enhancing intrusion detection in LAE-IoT networks.
  arXiv  Detail & Related papers  (2026-01-25T12:47:25Z)
• Agentic Satellite-Augmented Low-Altitude Economy and Terrestrial Networks: A Survey on Generative Approaches [76.12691010182802]
  This survey focuses on enabling agentic artificial intelligence (AI) in satellite-augmented low-altitude economy and terrestrial networks (SLAETNs)<n>We introduce the architecture and characteristics of SLAETNs, and analyze the challenges that arise in integrating satellite, aerial, and terrestrial components.<n>We examine how these models empower agentic functions across three domains: communication enhancement, security and privacy protection, and intelligent satellite tasks.
  arXiv  Detail & Related papers  (2025-07-19T14:07:05Z)
• Anomaly Detection and Generation with Diffusion Models: A Survey [51.61574868316922]
  Anomaly detection (AD) plays a pivotal role across diverse domains, including cybersecurity, finance, healthcare, and industrial manufacturing.<n>Recent advancements in deep learning, specifically diffusion models (DMs), have sparked significant interest.<n>This survey aims to guide researchers and practitioners in leveraging DMs for innovative AD solutions across diverse applications.
  arXiv  Detail & Related papers  (2025-06-11T03:29:18Z)
• INSIGHT: A Survey of In-Network Systems for Intelligent, High-Efficiency AI and Topology Optimization [43.37351326629751]
  In-network AI is a transformative approach to addressing the escalating demands of Artificial Intelligence (AI) on network infrastructure.<n>This paper provides a comprehensive analysis of optimizing in-network computation for AI.<n>It examines methodologies for mapping AI models onto resource-constrained network devices, addressing challenges like limited memory and computational capabilities.
  arXiv  Detail & Related papers  (2025-05-30T06:47:55Z)
• X-CBA: Explainability Aided CatBoosted Anomal-E for Intrusion Detection System [2.556190321164248]
  Using machine learning (ML) and deep learning (DL) models in Intrusion Detection Systems has led to a trust deficit due to their non-transparent decision-making. This paper introduces a novel Explainable IDS approach, called X-CBA, that leverages the structural advantages of Graph Neural Networks (GNNs) to effectively process network traffic data. Our approach achieves high accuracy with 99.47% in threat detection and provides clear, actionable explanations of its analytical outcomes.
  arXiv  Detail & Related papers  (2024-02-01T18:29:16Z)
• Effective Intrusion Detection in Heterogeneous Internet-of-Things Networks via Ensemble Knowledge Distillation-based Federated Learning [52.6706505729803]
  We introduce Federated Learning (FL) to collaboratively train a decentralized shared model of Intrusion Detection Systems (IDS) FLEKD enables a more flexible aggregation method than conventional model fusion techniques. Experiment results show that the proposed approach outperforms local training and traditional FL in terms of both speed and performance.
  arXiv  Detail & Related papers  (2024-01-22T14:16:37Z)
• Online Self-Supervised Deep Learning for Intrusion Detection Systems [1.2952596966415793]
  This paper proposes a novel Self-Supervised Intrusion Detection (SSID) framework, which enables a fully online Deep Learning (DL) based Intrusion Detection System (IDS) The proposed framework analyzes and labels incoming traffic packets based only on the decisions of the IDS itself. This approach avoids human errors in data labeling, and human labor and computational costs of model training and data collection.
  arXiv  Detail & Related papers  (2023-06-22T16:46:35Z)
• Federated Deep Learning for Intrusion Detection in IoT Networks [1.3097853961043058]
  A common approach to implementing AI-based Intrusion Detection systems (IDSs) in distributed IoT systems is in a centralised manner. This approach may violate data privacy and prohibit IDS scalability. We design an experiment representative of the real world and evaluate the performance of an FL-based IDS.
  arXiv  Detail & Related papers  (2023-06-05T09:08:24Z)
• Pervasive AI for IoT Applications: Resource-efficient Distributed Artificial Intelligence [45.076180487387575]
  Artificial intelligence (AI) has witnessed a substantial breakthrough in a variety of Internet of Things (IoT) applications and services. This is driven by the easier access to sensory data and the enormous scale of pervasive/ubiquitous devices that generate zettabytes (ZB) of real-time data streams. The confluence of pervasive computing and artificial intelligence, Pervasive AI, expanded the role of ubiquitous IoT systems.
  arXiv  Detail & Related papers  (2021-05-04T23:42:06Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.