## 4 Intrusion Detection Systems Based on Federated Learning  
There are some reviews on federated learning for intrusion detection in Internet of Things. The theoretical and practical reviews can be outlined. For example, in [31], the challenges and future directions of FL-enabled IDS are considered, while in [28], the authors evaluate the FL-enabled IDS approach on an experimental basis.  
The review provided in [31] is rather broad. The authors analyzed 15 research papers related to the FL-based IDS, but they are focused on the peculiarities of the proposed approaches and do not compare them nor outline the FL-specific parameters for comparison (i.e., FL architecture, ML model, dataset partition, aggregation function, etc.).  
In [28], the authors outlined and compared 12 papers related to the application of FL to improve IDS efficiency. They considered attacks studied, datasets, ML model, FL implementation, aggregation function, training parties, and training rounds. However, the authors described them rather briefly and focused on the experimental evaluation of the FL-enabled IDS approach. Besides, while in [28] 12 papers are considered, only 5 of them use IoT datasets for the experiments [20; 21; 22; 23; 24].  
In this paper, we selected for comparison the last papers related to the FL-based IDS. We searched for the \"federated learning intrusion detection\" keywords on the ScienceDirect website. As a result we found eight papers. We excluded two papers related to the poisoning attacks against FL-based systems [50; 51] as in this paper we are interested in the existing FL-based intrusion detection solution. Finally we obtained six papers [28; 52; 53; 54; 55; 56]. In addition, we added to the review several papers from the considered reviews that use IoT datasets for the experiments and are valuable for the FL-based intrusion detection area: [20; 21; 22; 23; 57]. The final list of the analyzed papers is [20; 21; 22; 23; 24; 28; 52; 53; 54; 55; 56; 57].  
We formulated the following research questions (RQ) for our review:  
* Which FL architectures are used for the intrusion detection systems?
* Which data partitions and datasets are used to test the proposed solutions?
* Which types of attacks can be detected using the developed solutions?
* Which ML methods are used to detect attacks and/or anomalies?
* How do the authors implement their solutions?
* How do the authors test their solutions?
* What metrics do the authors use to validate their solutions?  
Considering the formulated questions we outlined the following aspects while reviewing the papers:  
* FL architecture, i.e., what communication topology (centralized or decentralized) is used;
* Data partition and dataset used;
* Attacks detected;
* ML method used to detect attacks and/or anomalies;
* Software implementation, including FL frameworks used;
* Conducted experiments;
* Used metrics and advantages.  
In the paper, we are focused on the FL-based intrusion detection systems for IoT. We do not experimentally test the approaches to evaluate them. We review them considering the outlined aspects to highlight the open challenges and research directions. As there are no designated datasets for evaluating FL, the authors paid particular attention to how the data partition across the clients was modeled, and if the authors modeled the bias in the test data to evaluate its impact on the ML model efficiency.