Survey on Federated Learning for Intrusion Detection System: Concept, Architectures, Aggregation Strategies, Challenges, and Future Directions

Intrusion Detection Systems (IDS) are essential for securing computer networks by identifying and mitigating potential threats. However, traditional IDS face challenges related to scalability, privacy, and computational demands as network data complexity increases. Federated Learning (FL) has emerged as a promising solution, enabling collaborative model training on decentralized data sources while preserving data privacy. Each participant retains local data repositories, ensuring data sovereignty and precluding data sharing. Leveraging the FL framework, participants locally train machine learning models on their respective datasets, subsequently transmitting model updates to a central server for aggregation. The central server then disseminates the aggregated model updates to individual participants, collectively striving to bolster intrusion detection capabilities. This article presents a comprehensive survey of FL applications in IDS, covering core concepts, architectural approaches, and aggregation strategies. We evaluate the strengths and limitations of various FL methodologies for IDS, addressing privacy and security concerns and exploring privacy-preserving techniques and security protocols. Our examination of aggregation strategies within the FL framework for IDS aims to highlight their effectiveness, limitations, and potential enhancements.