dataesr/scientific-paragraphs-categorization huggingface dataset:
Data storage: relies on IoT storage devices such as magnetic, optical, or mechanical media to preserve digital data and information for both ongoing and future operations on FL servers and among their interconnected clients. FL Data-based Attacks: are usually attacks being carried out to intercept, manipulate, or modify the intercepted and hijacked data, which can be done passively via eavesdropping or actively via man-in-the-middle attacks. As a result, several FL data-based attacks are presented below (see Table  4 ) as follows: Table  5  Coding-based Attacks and countermeasures. FL CLient-Server-based Attacks: communication attacks also occur, resulting in the total exposure of FL-IoT communications. As a result, these main attacks are presented below (see Table  6 ) with their suitable countermeasures as follows:  Smart Healthcare: FL allows hospitals to benefit from the available datasets of non-affiliated hospitals without having the data being centralized in a single location to overcome critical data-related issues such as privacy, security, and access rights  [80].
Smart Industry and Manufacturing: FL can be used to reach operational industrial systems and intelligent Industrial IoT (IIoT) applications that require centralized data collection and processing, by coordinating IIoT machines and devices to perform centralized AI training at the network edge with respect to data privacy, security, and confidentiality  [1]. Simultaneously, FL models are also being used to develop predictive equipment maintenance labels, especially for users with privacy concerns  [81]. Thus, ensuring the fusion of Federated Learning and the Industrial Internet of Things, while introducing the new notion of FL-IIoT  [82, 83]. Cyber-Physical Systems (CPS): are relying on FL to develop trustworthy smart services that rely on the dynamic and distributed nature of edge computing, such as smart connected vehicles, and smart logistics, with a high amount of real-time data being produced.
A solution called FengHuoLun, was presented in Ref. [84]  to implement smart services with MLs trained in a trusted Federated Learning framework, with CPS behaviours being monitored. Smart Cities: FL plays a key role in processing smart cities, especially with the development of AI and big data, by working on solving privacy and security issues while maintaining waste management, transportation, communications, traffic congestion, traffic lights, and logistics, etc  [85, 86]. Smart Agriculture (SA): is relying on low-cost and low-energy-consuming sensors and devices to enhance both quantitative and qualitative agricultural production while addressing big data security and privacy violation by presenting a solution called PEFL  [87]. PEFL is a deep Privacy-Encoding-based FL framework that uses a perturbation-based encoding and long short-term memory-auto-encoder technique to achieve the intended privacy and identify attacks.
Autonomous Robotics and Unmanned Vehicles: the adoption of FL and Distributed Ledger Technologies (DLTs) to ensure low-latency offloading and real-time collaboration of distributed devices with an advanced autonomy degree and intelligent autonomous systems in a safe, secure, and robust manner  [88]. This includes real-time traffic information, decision-making, collision avoidance, and self-driving vehicle prediction, as well as DL in perception, privacy-preserving, control, and other tasks  [89]. Smart Transportation: FL is now being implemented to tackle various issues and challenges that surround the smart transportation domain, such as communication delays, calculation processing, data privacy, equipment mobility, smart logistics, resource and system transportation  [85]. Smart Communication: FL algorithms are potentially close to becoming the leading 6G enablers, due to their built accurate models based on large decentralized and heterogeneous datasets on resource-constrained devices  [90].
The choice of FL is due to its ability to be coordinated by both centralized and distributed nodes. Digital Forensics and Threat Detection: are now more reliant on supervised ML approaches including FL for inferring system and network anomalies. The main aim is to ensure the interpretability of a model's decision-making process, such as the interpretable federated transformer log learning model presented in Ref. [91]  for threat detection, especially for IoT systems and devices  [92, 93]. Ethical Hacking: may well integrate the FL as a new potential solution to allow the maintenance of IoT users, clients, servers, devices, systems, and (big) data privacy and to avoid any privacy-related attacks and prevent any data exploitation or/and manipulation via AI-based and privacy-preserving solutions  [94].
Law Enforcement: started relying on the FL as a promising solution that improves the anti-financial-crime, anti-money laundering, and countering the financing of terrorism processes to achieve enhanced and accurate ML pattern identification and predictive power, without relying on any data sharing or compromising data privacy and security  [95]. This can improve the models' accuracy (reduced false positive and false negative rates) with a reduced overall operational cost. Military: seems to be interested in FL, especially since the army is using centralized ML approaches to train models that rely on servers that host trained models to make predictions. Such approaches require remarkable direct investments in data annotation and tactical model training that are less expensive, complex, and timeconsuming  [96].
Hence, the reliance on enhanced FL to keep local storage on edge devices to ensure that the exchange of military data is done on tactical central servers in a coordinated, secure, and private real-time manner with the least possible bandwidth consumption and latency  [97]. 3. Challenges and future opportunities for FL-IoT FL is a promising technique for IoT systems and can provide several benefits, as discussed previously (privacy preservation, scalability, and reduced data transfer). However, FL with IoT systems suffers from several challenges that are presented in Fig. 6. These challenges must be addressed to fully realize the potential of FL, such as: Addressing the heterogeneity of devices and data is a major research challenge in the FL approach. Model Updates: IoT devices may have different amounts of data, and some devices may not be available for training at all times.
Developing efficient updating model techniques for a distributed environment with less computation, communication, and resources is required. Fairness: Data distributions might be imbalanced or biased, which introduces fairness issues in the trained models that will impose a problem in the global model. Addressing fairness concerns in FL is mandatory and developing a lightweight fairness solution is necessary to be able to apply it with limited IoT devices. Optimization Algorithms: Trained local models at IoT/edge devices (decentralized) rely on optimization algorithms. However, existing optimization algorithms may not be suitable for IoT due to the IoT device constraints (computation and resource) in addition to the distributed nature of the data. Developing new optimization algorithms that can effectively train models on limited IoT devices and decentralized data that preserve high accuracy, precision, and convergence rates.
IoT Communication Overhead: FL involves communication between IoT/edge devices and the central server, which can be computationally expensive and time-consuming. Developing efficient compression and quantization solutions is critical to reducing the size of communicated data and consequently reducing the communication delay overhead. This is essential to better responding to IoT devices' constraints in terms of energy, computation, and memory. Non-Independent and Identically Distributed (IID) Data: FL assumes that the data on each source IoT/edge device is IID. However, in many real-world IoT scenarios, the data on each device can be non-IID because it is not sampled from the same distribution. This can occur for a variety of reasons, such as different device types, geographic locations, user demographics, or even temporal variations in data collection.
This will pose a hard challenge to FL since traditional ML solutions assume that the training data is IID. However, when the training data is non-IID, the traditional algorithms may not work well, as it will lead to poor model performance (accuracy and convergence rates). Therefore, to fix the issue of non-IID data, we need to develop a lightweight solution that can be based on clustering, meta-learning, or a model personalization technique that takes into account the underlying data distribution and the heterogeneity of the data. Generalization: FL is often used to train models based on a set of specific devices, which cannot be considered representative of the population as a whole. The same techniques that can solve the non-IID issue can also help solve the generalization issue. This solution should be efficient and robust to ensure that locally trained models can be applied to new devices and populations with high accuracy and precision.
This point can be considered one of the most important contributions required in the field of FL. Explainability: The trained local models are based on decentralized data, and the model cannot explain the model's predictions. This challenge refers to the difficulty of understanding and interpreting the decision-making process of the trained local model without having access to the individual data on each device. This issue is critical in several applications, especially those involving sensitive or highstakes decisions, such as healthcare or finance, where it is essential to understand how the model arrived at a decision. Therefore, we need to develop new, robust, and reliable extraction methods that can provide explainable models (explain the decisions made by trained models) without compromising privacy.
In fact, these challenges can be considered critical for future FL research directions. They should be addressed to fully realize the potential of FL in various IoT domains, such as healthcare and finance. However, current FL security and privacy issues still persist especially over IoT domains, such as data engineers being unable to access raw user data to clean it, identify missing values, and identify the data points that the model will be trained on. Another key issue includes the user's IoT device, especially during the training process, including heterogeneity, storage, computational ability, power consumption, connectivity issues, and communication bottleneck, which keeps the produced data local on each device  [98]. Therefore, as part of future directions, the focus should be on detecting and preventing poisoning and data injection attacks  [99].
Another solution includes the MLGuard, which employs a lightweight secret-sharing scheme and a novel poisoning attack mitigation technique  [35]. -Data Tampering/Modification Attack: aims to change or/and alter the training dataset to create a feature collision effect that merges two dataset classes to fool the ML model and consequently misclassify the targeted class  [127]. A Dynamic Redundant Path Selection (DRPS) was presented to detect and mitigate data tampering attacks on Cooperative Adaptive Cruise Control (CACC) systems while reducing the number of network paths during tampering detection  [36]. Another similar Dynamic Redundant Path Selection (DRPS) solution was presented to detect and mitigate data tampering attacks in networked control systems  [37]. -Free-Riding Attack: includes the intentional dissimulating participation in the FL process to collect the final model, mostly by inserting dummy updates without training the model with local data  [128].
To mitigate this threat, transfer models should often be retrained against custom datasets and object functions should be constantly updated, before being further tuned. Another method included the introduction of a novel Deep Transfer Learning (DTL) method that allows learning from data collected from multiple IoT devices while improving the accuracy in detecting IoT-related attacks  [51]. -Adversarial Machine Learning Attack: occurs when small variations in the model data inputs are found and exploited to redirect and result in having undesired model outputs  [135, 136]. To mitigate this attack, a robust Data Operations (DataOps) and MLOps solution can be adopted as a set of practices that aims to reliably and efficiently deploy and maintain machine learning models  [53]  and to improve quality, speed, and collaboration and promote a culture of continuous improvement  [52].
-Gradient Leakage and Gradient Manipulation Attacks: Gradient Leakage occurs when an attacker uses the gradient information uploaded by clients with the aim to steal and recover private, sensitive or confidential training data from the shared gradients  [137]. Gradient Manipulation occurs when the local model gradients are manipulated to compromise the global model performance, with the aim of targeting the overall accuracy  [120]. A novel practical Stochastic Gradient Descent (SGD) based poisoning attack approach named BadBatch was presented in Ref. [56] , to find bad batches that overfit the global model by manipulating local training batches that are provided by compromised clients in each local FL training. * -SQL Attack: which targets ML applications, especially when SQL query fragments are included in the attacker's data to retrieve or modify the submitted strings, which make up a part of the submitted query to the server either to gain an administrative privilege, extract details, modify databases or compromise users accounts.
Several recommendations were presented in Ref. [138]  such as using a parameterized Application Programming Interface (API), and a lookup mechanism to identify unparameterized objects, as well as avoiding the use of dynamic SQL with strings within the database to execute or create queries. This can be done using a fully automated technique that detects, prevents, and reports SQL-Injection Attack (SQLIA), while also capturing all malicious SQL queries  [139] , or using Knuth-Morris-Pratt (KMP) string matching algorithm to match user's input string with the stored pattern of the injection string to detect any malicious code  [57]. -Trojanned Model Attack: allows the attacker to upload a malicious model to an already pre-trained model pool to execute an arbitrary code whenever it is loaded or retrained for inference.
-Cross-Site Flashing Attack: occurs via the exploits of the vulnerabilities found in the browsers where the flash applications are often embedded at. One solution to mitigate and discover these vulnerabilities is the FlashOver  [63] , which is the first fully automated XSS attack discovery system, capable of statically and dynamically analyzing and identifying real-life Flash vulnerabilities. -Cross-Site Scripting (XSS) Attack: occurs when a malicious code/ script is injected by the client-side into websites that are displayed by a vulnerable browser. This can be mitigated using the pattern filtering approach  [141]  or using server-side approaches such as XSS-GUARD, which is a prevention mechanism against XSS attacks on the server side  [64]  and XSS-SAFE, which is an automated framework that detects and mitigates XSS attacks on the server-side  [65].
-Cascading Style Sheets (CSS) Injection Attack: injects an arbitrary CSS code into a website, before being rendered in the end user's browser. Depending on the CSS payload, it can be an XSS, User Interface (UI) or data modification/extraction attack. This can be mitigated using injected style sheets that identify a user's installed extensions  [66] , or SIACHEN, which is based on a white-list and browser-enforced security policy language that mitigates XSS attacks  [67]. -Client-Side Resource Manipulation Attack: results in an XSS attack by exploiting and controlling the URL that links to the other web page resources. This can result in a Content Spoofing attack which is a web security vulnerability that allows the end user to spoof or modify (via injection) the content found on the web page.
Moreover, a gradient compression mechanism was also used to reduce communication costs and improve communication efficiency by 50% without losing accuracy. Numerical results show that CNN-LSTM achieves the highest accuracy on all datasets, while significantly improving communication efficiency and reducing communication costs. Wu et al. presented an anomaly detection classification model that incorporates both FL and Mixed Gaussian Variational self-encoding Networks (MGVN) to form the FL-MGVN  [162]  to overcome low detection accuracy and high false alarm rates. Experimental results demonstrated that FL-MGVN has higher recognition performance and classification accuracy than other methods. Liu   [163]. Experimental results show that the AMCNN-LSTM model achieves high accuracy and that the introduced gradient compression mechanism can compress the gradient by 300 times without losing accuracy while reducing the communication overhead by 50%.
Other solutions The aim of this subsection is to present the other FL active countermeasures that are capable of not only detecting but also mitigating the presented attacks above. Here, these main countermeasures are presented as follows: Sanitized Training Data (STD): is used as an anomaly detector to filter out suspicious training data points. It was initially presented in Ref. [119]. This will secure the permanent erasure of sensitive data from the datasets beyond recovery, even when using forensics tools. It can be applied on large datasets with sensitive information and to clear end-of-life electronic IoT devices, which can be done via physical destruction or by using anti-forensics tools  [189]. Federated Distillation (FD): is used to only transfer model outputs with much smaller dimensions than the model sizes, relying on two foundational algorithms named Co-Distillation (CD) and Knowledge Distillation (KD)  [190, 191].
In fact, TEE applications are known as Trusted Applications (TAs). Batch Normalization (Batch Norm): is used to train artificial neural networks to become more fast and stable through the input layer normalization via re-centering and re-scaling  [204] , as well as to make attacks against local data more challenging, such as the privacy-preserving solution called FedBN, presented by Li et al. in Ref. [205]. In fact, Batch normalization also achieves a much higher learning rate with fewer initialization issues as described in Ref. [206]. Batch normalization is a technique used to improve the training of neural networks by normalizing the inputs (i. e convergence speed and generalization performance of models). Based on this, in the context of FL, batch normalization can solve the non-IID and generalization issues, in addition to being an effective countermeasure to mitigate a set of security issues since it reduces the impact of individual client data (malicious ones) on the model in case the training is done by using multiple data clients.
2) Dynamic Honeypots: FL heavily relies on the advantage of the decentralized private deep training to achieve models with real-data results  [216]. Introducing honeypots at the client's end or at the centralized server with the dynamic variable selection of vulnerabilities to ensure a higher level of protected deception technology that will be capable of increasing the detection level with a higher level of interaction. Thus, achieving a faster and more accurate ability to collect information about the attacker and analyzing it in a real-time manner. 3) Lightweight Intrusion Detection/Prevention Systems: Lightweight IDS should also be integrated into FL, but more precisely with adversarial and malware detection solutions, not only to detect malware signs, especially based on the anomaly, signature, and behaviour but also to be able to distinguish and detect polymorphic and zero-day exploits.
Management& policies 1) Adopting Training Procedures: it is challenging to be detailed about the adoption of mitigation techniques for adversarial perturbation attacks since they will depend on the circumstances. In this case, the attacker tries to create an input that will produce the desired result. This type of attack has been extensively investigated, where an attacker can use it against a global model in a broad range of situations depending on its goals and restrictions. Implementing a training procedure that produces models that are resistant to adversarial perturbation, together with authentication and rate-limiting to make these attacks traceable and slower, can offer some potential solutions. 2) Handling Sensitive Data: to mitigate against training data extraction, sensitive data should not be present in the local training dataset.
This means the application on the client's side should be refactored to remove/anonymize any sensitive feature of data from the local training set if possible 3) Enhancing Control Access and Accountability: the security of the entire FL-system's devices must be tested to detect and fix any exploitable vulnerability or security gap. Therefore, it is important to motivate all entities, boost confidence, and discourage bad actors to reduce the internal threat and create a safe and trustworthy environment by improving the accountability methods using deterrence policies and limiting the access of different users (i. e. by using the attribute control access scheme). At the same time, maintains users' responsibility and the ability to report any suspicious activities as early as possible. This also requires enhanced policies, especially for models that rely on pre-defined datasets without them being checked and examined before deploying them for testing.
Conclusion Federated learning has proven itself to be a new AI-based technology that has been introduced into the IoT domain using decentralized learning to improve model accuracy while preserving user/data privacy against a variety of threats and attacks. Thus, being able to extend the machine learning advantages is beneficial for IoT domains, especially for domains that rely on real-time data transmission and contain sensitive data. However, despite the remarkably unique advantages that the FL offers, both security and data privacy remain as persisting key issues. As a result, this paper provides a comprehensive study on both security and privacy threats, limitations, and challenges, while also presenting and analyzing recent solutions to mitigate their impact and reduce the likelihood of their occurrence.
Several taxonomies were also proposed for this purpose to explain the different threats, attacks, and countermeasures for each component in FL-IoT. However, limitations of IoT devices require defining new lightweight security and privacy solutions for the FL-IoT, of which we classify as either cryptographic or non-cryptographic ones. These solutions should reduce the required computation, communication, and resource overhead. Additionally, for cryptographic solutions, symmetric homomorphic cryptographic algorithms are required instead of asymmetric ones, since they require a high overhead. In parallel, efficient secret-sharing variants are also required to ensure data availability. As for non-cryptographic purposes, existing anomaly detection should be adapted to detect/prevent a set of specific ML attacks such as adversarial attacks.