What 131 Studies Reveal About Federated Learning for Edge Cyberattack Detection

Analysis by the aitrendblend editorial team · Federated learning and AI privacy · About 13 minute read

Why centralized detection keeps failing at the edge

Edge computing exists because sending everything to the cloud is slow, expensive, and increasingly a privacy liability. Cameras, routers, industrial sensors, and vehicles now do a meaningful share of their own processing, which is great for latency and bandwidth. It also means the attack surface has moved with them. The review’s authors point to industry projections of roughly 75 billion connected IoT devices by 2025, and to Check Point’s Q1 2025 threat report, which found organizations facing an average of 1,925 weekly attacks each, a 47 percent jump year over year. Those numbers alone would justify better detection tools. The harder problem is that the obvious fix, training one big machine learning model on everyone’s traffic data, recreates the exact privacy and bandwidth problems edge computing was supposed to solve.

Traditional signature based systems catch what they already know and miss everything new, including zero day attacks, and they tend to throw a lot of false alarms in busy networks. Statistical anomaly detection is a step up but adapts slowly. Centralized machine learning solves the accuracy problem and then introduces three new ones, according to the review. Aggregating raw data creates privacy exposure. The compute demand of centralized training does not fit resource constrained edge hardware. And performance quietly degrades once the data across devices stops looking uniform, which in real deployments it always does. That third point, what researchers call Non IID data, turns out to be the thread that runs through almost every open problem the review identifies later on.

What federated learning actually changes

Federated learning, first proposed by McMahan and colleagues in 2016, flips the usual setup. A central server initializes a model and sends it out to edge clients. Each device trains on its own local data and sends back only the updated parameters, not the raw data itself. The server aggregates those updates, most commonly through an algorithm called FedAvg, and pushes the improved model back out for another round. Nobody’s camera footage or medical sensor readings ever leave the device. You can read the full open access paper directly on ScienceDirect via its DOI if you want the complete methodology and reference list behind everything summarized here.

This is not a new idea in machine learning generally, but applying it specifically to cyberattack detection at the edge brings its own baggage. Devices are heterogeneous, connectivity is intermittent, energy budgets are tight, and the data each device sees is shaped by whatever that specific device happens to be watching. A smart camera in a parking garage and one in a hospital corridor will learn very different notions of normal traffic. Building a detection system that generalizes across that variety, without asking every device to hand over its raw observations, is the actual engineering challenge this whole body of research is chasing.

How the review was built, and why the numbers are worth trusting

The authors, Zeseya Sharmin, Md Palash Uddin, Yong Xiang, and Feifei Chen from Deakin University’s School of Information Technology, followed the PRISMA methodology, the same reporting standard widely used in evidence based medicine research, adapted here for computer science. They searched five databases, Web of Science, Scopus, ACM Digital Library, IEEE Xplore, and ScienceDirect, covering January 2020 through July 2025. The initial search returned 1,334 records. After removing duplicates, non study items, other surveys, and irrelevant results, 131 unique primary studies made it into the final analysis. Two independent researchers screened titles and abstracts, then full texts, with disagreements settled through discussion or a third reviewer.

That funnel matters more than it might look. A lot of survey papers in fast moving fields quietly cherry pick studies that support a narrative. This one excluded surveys and reviews from its own primary study count precisely so it would not just be summarizing summaries, and it explicitly excluded studies that propose no concrete detection solution, keeping the focus on work with actual empirical or theoretical contributions. Table 1 in the paper compares this review against eight prior surveys and shows most of them covered one to four databases without any bibliometric or thematic analysis. This one covers five databases and adds both, which is a genuinely different level of coverage for this specific niche.

The seven ways researchers are approaching this problem

Rather than organizing the field by attack type or by dataset, the authors sorted all 131 studies into seven thematic buckets based on the core technical approach each paper takes. The distribution itself tells a story about where the field’s confidence and its anxieties currently sit.

The lead in security and trust management is not surprising once you sit with it. Federated learning by design invites a lot of untrusted clients into the same training process, and that openness is exactly what makes it useful and exactly what makes it exploitable. Blockchain integration shows up repeatedly here, most notably in a family of implementations the authors group under the FIDChain framework, which pairs FL with immutable logging so a tampered model update leaves a trace. Bierbrauer and colleagues applied it to edge network intrusion detection, Ceviz and colleagues extended it to drone networks with blockchain based voting for client participation, and Lee and colleagues brought it into healthcare IoT with tamper evident logging of detection events.

The privacy layer that most articles gloss over

Differential privacy gets talked about a lot in general AI coverage, usually as a checkbox feature. The review treats it with more nuance. It shows up as a spectrum, not a switch. Some implementations, like a satellite communication system reviewed here, use deep autoencoders with differential privacy purely to protect communication anomaly patterns. Others go further, like a smart grid transformer based detection model that layers a full Paillier cryptosystem on top, encrypting the gradients themselves so even the aggregation server cannot see intermediate values in the clear. Homomorphic encryption sits at what the authors call the most sophisticated tier of privacy protection, and it shows up in industrial control and healthcare deployments where the sensitivity of the underlying data justifies the added computational cost.

Resource limits are not a footnote, they decide what ships

Fourteen studies out of 131 focus purely on making the compute budget work, and reading through them you start to notice a pattern. Quantization, feature dimensionality reduction, and knowledge distillation come up again and again because the alternative is a model that simply cannot run on the hardware it needs to protect. One vehicle road cooperation system in the review used 8 bit quantization on a self attention residual network specifically to fit within onboard compute limits, and a botnet detection system for IoT zombie devices leaned on feature reduction for the same reason. The review’s own gap analysis notes that communication cost alone eats up somewhere between 60 and 80 percent of total federated learning overhead in edge environments, which is a striking number if you have not seen it stated plainly before.

What the data actually says about generalization

One of the more useful things this review does is look past the seven themes and ask cross cutting questions about the whole 131 study body. The answers are a little uncomfortable if you were hoping federated detection was a solved problem. 85.5 percent of studies report meaningful trouble with Non IID data, the situation where one device’s normal traffic looks nothing like another’s. That is not a minority concern, it is close to the norm. And 89.3 percent of studies rely entirely on experimental evaluation with no accompanying theoretical or convergence analysis, leaving only 14 studies that pair empirical results with formal mathematical grounding.

Dataset choice compounds the problem. CIC-IDS-2017 appears in 18 studies and NSL-KDD in another 15, and simulated datasets show up in 15 more. Both of the big two were built years before edge computing and IoT specific traffic patterns became the norm they are today, and neither was designed with federated partitioning in mind. Newer IoT specific datasets like N-BaIoT, Edge-IIoTset, and ToN-IoT are gaining ground, appearing in 11, 10, and 9 studies respectively, but the field still leans heavily on benchmarks that predate the exact problem it is trying to solve.

The lack of standardized federated partitioning schemes across these datasets hinders reproducibility, and future research should establish community accepted data splitting protocols with predefined Non IID partitions. Paraphrased from the review’s discussion of dataset standardization, Sharmin, Uddin, Xiang, and Chen, Computer Science Review, 2026

Who is actually doing this research

Academic institutions produce 65.5 percent of the studies in this review on their own. Pure industry work accounts for only 8.4 percent, and collaborative academia industry projects make up the remaining 26.1 percent. That split is worth sitting with if you are trying to gauge how close any of this is to production readiness. A field this heavily weighted toward academic settings tends to produce clever architectures validated on clean benchmark data, and it tends to underrepresent the messy realities of deploying across a real fleet of heterogeneous, sometimes offline, sometimes malicious edge devices. The 26.1 percent collaborative slice is probably the number to watch as an indicator of how quickly this moves from paper to product.

Publication trends back that framing up. The review counted just 2 papers in 2020, climbing steadily to 47 in 2024 and a partial count of 34 through July 2025 alone, with 18 additional studies expected to round out the rest of that year. The authors fit a regression model, trained strictly on complete year data through 2024 to avoid leaking partial year bias into the forecast, and it projects around 75 publications in 2026. Whatever you think of forecasting in general, that is a more careful methodology than most trend claims you will see in AI coverage, and the exponential shape of the curve so far backs it up.

The gaps the authors are most worried about

Buried in Section 5 of the paper is a genuinely useful nine part gap analysis, and two items stand out above the rest. Adversarial robustness gets singled out because federated learning’s open participation model is also its biggest liability. A malicious client can inject poisoned gradients, manipulate them subtly enough to bias the global model toward misclassifying specific attacks, or run inference attacks against gradients to extract information about other clients’ data, all without ever touching raw data directly. Standard FedAvg simply assumes honest participation and offers no defense against any of this. The fixes on the table, Byzantine resilient aggregation methods like Krum and trimmed mean, reputation based client scoring, and secure multi party computation, are all represented in the reviewed literature but none of them is close to a settled default choice yet.

Communication efficiency is the second flashpoint, and it connects directly back to that 60 to 80 percent overhead figure mentioned earlier. The authors recommend hybrid strategies, moderate compression somewhere in the 80 to 90 percent range paired with selective hierarchical aggregation for genuinely heterogeneous device fleets, rather than chasing maximum compression and eating the accuracy penalty. Hierarchical federated learning with edge level aggregation nodes cuts long distance communication by 70 to 85 percent in the studies that tested it, but it introduces its own aggregation latency, which matters a great deal if the whole point is catching an attack before it spreads.

Where this is realistically headed next

The forward looking section of the review reads less like speculation and more like a punch list. Generative models, GANs and diffusion approaches, for synthesizing attack data to fill the gaps left by real world data scarcity, a problem that shows up constantly in the classical FL with privacy theme, where studies like FedTSRGNet and FedGAD already combine generative components with federated training for exactly this reason. 6G enabled edge intelligence, using the lower latency and higher bandwidth of next generation networks to make real time collaborative detection actually feasible rather than aspirational. Zero trust architectures, which would mesh naturally with the reputation based client selection work already underway. Encrypted traffic analytics, detecting attacks without ever decrypting the traffic in question, which sidesteps a whole category of privacy tradeoffs. And quantum resistant federated security, preparing today’s cryptographic choices for a future where they may no longer hold.

None of these are guaranteed to pan out on the timeline the authors sketch, and the review is honest about that, noting explicitly that its own publication forecast should be read as a trend indicator rather than a hard prediction. But the direction of travel across all seven themes, toward more adaptive, more communication efficient, and more adversarially aware systems, lines up with what you would expect if you have watched edge deployments grow more hostile and more resource constrained at the same time over the past few years.

Honest limitations of this review

The authors are upfront about several constraints worth flagging here rather than glossing over. The search covered five major databases and English language publications only, which likely misses relevant work published in other venues or languages. The July 2025 cutoff means anything published after that point, including work that may already be responding to gaps this review identifies, is not captured. Grey literature and non archival sources, including many practical industry writeups, were deliberately excluded, which keeps the review academically rigorous but may undercount real world deployment experience that never made it into a peer reviewed venue. And as the authors themselves note, empirical validation of their own recommendations through large scale real deployments remains an open task for future work, not something this review itself could establish.

Reference implementation, a FedAvg style intrusion detector

This paper is a systematic review rather than a paper proposing one specific model, so there is no single architecture from the source to reproduce. What follows instead is a compact, runnable reference implementation of the pattern that shows up across most of the 131 studies discussed above, a simple neural classifier trained through federated averaging across simulated clients, with an optional differential privacy noise step on the aggregation, the way many of the classical FL with privacy preserving studies structure their pipeline. Treat it as a starting scaffold for experimenting with the ideas in this review, not as a reconstruction of any single cited paper’s proprietary code.

# Reference implementation only, illustrating the FedAvg pattern discussed in this article
# Not the code of any specific cited study, a generic starting point for experimentation

import torch
import torch.nn as nn
import torch.optim as optim
import copy
import random

class IntrusionClassifier(nn.Module):
    """A small feedforward network standing in for the DNN based classifiers used across the review's classical FL theme."""
    def __init__(self, input_dim=41, hidden_dim=64, num_classes=5):
        super().__init__()
        self.net = nn.Sequential(
            nn.Linear(input_dim, hidden_dim),
            nn.ReLU(),
            nn.Dropout(0.2),
            nn.Linear(hidden_dim, hidden_dim),
            nn.ReLU(),
            nn.Linear(hidden_dim, num_classes)
        )

    def forward(self, x):
        return self.net(x)


def make_synthetic_client_data(num_clients=6, samples_per_client=200, input_dim=41, num_classes=5, non_iid_skew=0.7):
    """Builds toy Non IID client datasets, echoing the heterogeneous device behavior discussed throughout the review."""
    clients = []
    for client_id in range(num_clients):
        dominant_class = client_id % num_classes
        X = torch.randn(samples_per_client, input_dim)
        y = torch.randint(0, num_classes, (samples_per_client,))
        skew_mask = torch.rand(samples_per_client) < non_iid_skew
        y[skew_mask] = dominant_class
        clients.append((X, y))
    return clients


def local_train(model, data, epochs=1, lr=0.01):
    """One client's local training round, the core loop that runs on every edge device."""
    local_model = copy.deepcopy(model)
    optimizer = optim.SGD(local_model.parameters(), lr=lr)
    criterion = nn.CrossEntropyLoss()
    X, y = data
    local_model.train()
    for _ in range(epochs):
        optimizer.zero_grad()
        outputs = local_model(X)
        loss = criterion(outputs, y)
        loss.backward()
        optimizer.step()
    return local_model.state_dict(), len(y), loss.item()


def federated_average(global_model, client_updates, client_sizes, dp_noise_std=0.0):
    """FedAvg aggregation, weighted by client data size, with an optional differential privacy style noise step."""
    total_samples = sum(client_sizes)
    new_state = copy.deepcopy(global_model.state_dict())
    for key in new_state.keys():
        weighted_sum = torch.zeros_like(new_state[key], dtype=torch.float32)
        for update, n_k in zip(client_updates, client_sizes):
            weighted_sum += update[key].float() * (n_k / total_samples)
        if dp_noise_std > 0:
            weighted_sum += torch.randn_like(weighted_sum) * dp_noise_std
        new_state[key] = weighted_sum
    global_model.load_state_dict(new_state)
    return global_model


def evaluate(model, X_test, y_test):
    model.eval()
    with torch.no_grad():
        preds = model(X_test).argmax(dim=1)
        accuracy = (preds == y_test).float().mean().item()
    return accuracy


def run_federated_rounds(num_rounds=10, num_clients=6, input_dim=41, num_classes=5, dp_noise_std=0.01):
    global_model = IntrusionClassifier(input_dim, num_classes=num_classes)
    clients = make_synthetic_client_data(num_clients, input_dim=input_dim, num_classes=num_classes)
    X_test = torch.randn(300, input_dim)
    y_test = torch.randint(0, num_classes, (300,))

    for round_num in range(1, num_rounds + 1):
        client_updates, client_sizes, losses = [], [], []
        for client_data in clients:
            state_dict, n_k, loss = local_train(global_model, client_data, epochs=1, lr=0.05)
            client_updates.append(state_dict)
            client_sizes.append(n_k)
            losses.append(loss)
        global_model = federated_average(global_model, client_updates, client_sizes, dp_noise_std=dp_noise_std)
        acc = evaluate(global_model, X_test, y_test)
        print(f"Round {round_num}, average local loss {sum(losses)/len(losses):.4f}, global accuracy {acc:.4f}")

    return global_model


if __name__ == "__main__":
    # Smoke test on dummy data, confirms the training loop runs end to end
    random.seed(42)
    torch.manual_seed(42)
    trained_model = run_federated_rounds(num_rounds=5, num_clients=4, dp_noise_std=0.01)
    print("Smoke test complete, federated averaging loop ran without errors.")

Conclusion

Strip away the seven category labels and the bibliometric charts, and what this review really documents is a field working through the same tension over and over. Every gain in privacy or in communication efficiency tends to cost something in detection accuracy or in robustness against a malicious participant, and every fix for one of those costs something else. That is not a criticism of the 131 studies catalogued here. It is what an honest maturing research area looks like, and the fact that a team could sort all of it into seven coherent, well populated themes says the field has moved well past its exploratory phase.

The conceptual shift worth sitting with is that federated learning stopped being a privacy nice to have somewhere in this literature and became the only realistic path to detection systems that scale to tens of billions of devices without centralizing everyone’s traffic data. Centralized machine learning was never going to survive contact with 75 billion connected devices, not on privacy grounds and not on bandwidth grounds. Federated approaches are not a perfect substitute yet, but they are the only approach in this review that even attempts to solve both problems at once.

The transferability question is worth a moment too. Almost nothing in the seven themes here is actually specific to cybersecurity. Blockchain backed reputation scoring, hierarchical aggregation, knowledge distillation for lightweight clients, these are general federated learning techniques that happen to have found a particularly demanding proving ground in intrusion detection, where the cost of a false negative is an actual breach rather than a slightly worse recommendation. Teams working on federated learning in other domains, healthcare diagnostics support tools, industrial monitoring, or consumer personalization, could reasonably borrow a lot of the resource efficiency and Non IID handling work catalogued here.

The remaining limitations are real and the authors do not hide from them. Nearly nine in ten studies still evaluate purely through experiment with no theoretical backbone, close to a third of all evaluations lean on two benchmark datasets that predate the problem they are being used to solve, and adversarial robustness against a genuinely motivated attacker remains more of an open research question than a solved engineering problem. None of that should be read as a reason to wait on federated detection. It should be read as a reason to pick your aggregation scheme, your privacy budget, and your evaluation dataset with real intention rather than defaulting to whatever the last paper you read happened to use.

If the 2026 forecast in this review holds anywhere close to accurate, the next twelve months alone will likely produce close to as many studies on this exact topic as existed in total before 2023. Whoever is building edge security systems right now has a genuinely narrow window to shape which of these seven approaches becomes the default rather than inheriting whatever wins by accident.

Frequently asked questions