###### Abstract  
In order to provide an accurate and timely response to different types of the attacks, intrusion and anomaly detection systems collect and analyze a lot of data that may include personal and other sensitive data. These systems could be considered a source of privacy-aware risks. Application of the federated learning paradigm for training attack and anomaly detection models may significantly decrease such risks as the data generated locally are not transferred to any party, and training is performed mainly locally on data sources. Another benefit of the usage of federated learning for intrusion detection is its ability to support collaboration between entities that could not share their dataset for confidential or other reasons. While this approach is able to overcome the aforementioned challenges it is rather new and not well-researched. The challenges and research questions appear while using it to implement analytical systems. In this paper, the authors review existing solutions for intrusion and anomaly detection based on the federated learning, and study their advantages as well as open challenges still facing them. The paper analyzes the architecture of the proposed intrusion detection systems and the approaches used to model data partition across the clients. The paper ends with discussion and formulation of the open challenges. artificial intelligence; data partition; federated learning; Internet of Things; intrusion detection; machine learning; system architecture +
Footnote †: journal: _Algorithms_  
definition  
* Bias introduced by data owners' behavior, as the availability of the devices may change during the training process, and clients with more stable behavior may have a stronger impact on the results of training. * FL system parameters tuning such as resource use on clients, learning throughput (number of clients, model complexity, etc). The latter challenge tightly relates to the problem of the available datasets that could be used to train models and evaluate the parameters of the FL systems. FL has recently become a highly researched problem, and there are now numerous studies in the scientific literature devoted to various theoretical and applied FL aspects. For example, in [7; 8; 9], the authors study the problem of the local model aggregation to ensure its robustness to the non-IID distribution of data across clients. [PERSON] et al. [10] address this problem by applying techniques of contrasting learning that utilize embeddings of the feature or model space to some intermediate representation space [11]. The challenges of constructing communication-efficient FL protocols in the context of resource constraint clients are discussed in [12; 13; 14]. For example, [PERSON] et al. [14] focus on accelerating computation and reducing communication overhead in FL frameworks secured by homomorphic encryption. Other security and privacy aspects of the FL are studied in [15; 16; 17]. There are numerous studies that analyze the applicability of FL to different practical tasks. By now, the researchers have proposed various FL-based approaches to solve problems in digital healthcare [18; 19], security [20; 21; 22; 23; 24], e-commerce [25; 26; 27], etc. Though the FL is a relatively novel research field, there is a need for systematization of the developed approaches devoted to different FL aspects. In this paper, the authors research existing approaches for intrusion detection based on federated learning in the context of the outlined challenges with a particular focus on architectural solutions and datasets used to evaluate the suggested approach. In [28], it is noted that FL-enabled IDS approaches for the Internet of Things (IoT) have just begun to develop, and the main _motivation_ for this research is to understand what solutions for the problems mentioned above have been proposed, how efficiently they address them, and what obstacles are still needed to overcome.