# A Systematic Review on Hybrid AI Models Integrating Machine Learning and Federated Learning
## 2 Methodology
### Search and Study Selection Strategy  
The literature review aimed to identify high-quality, peer-reviewed journal articles published between 2015 and 2024 that focused on the synergistic integration of federated learning and machine learning/deep learning for cybersecurity. To ensure a comprehensive and exhaustive search, a wide range of academic databases was covered, including IEEE Xplore, SpringerLink, MDPI, ACM Digital Library, Scopus, PubMed, Web of Science, Wiley Online Library, ScienceDirect, Taylor & Francis Online, and ProQuest. These databases were selected for their extensive coverage of peer-reviewed articles in cybersecurity, artificial intelligence, and data analytics, ensuring the inclusion of impactful research contributions. A systematic search strategy was meticulously developed using a precise combination of keywords to accurately capture the relevant literature on the integration of FL and ML/DL in cybersecurity. The primary search terms incorporated both general and specific terminology prevalent in the field, including (\"Federated Learning\" OR FL) AND (\"Machine Learning\" OR ML OR \"Deep Learning\" OR \"DL\") AND (\"Cybersecurity\" OR \"Threat Detection\" OR \"Intrusion Detection\" OR \"Malware Detection\" OR \"Fraud Detection\" OR \"Network Security\" OR \"Anomaly Detection\"), along with specific terms such as \"Federated Machine Learning\" (FML) or FML, \"Federated Deep Learning\" (FDL) or FDL, \"Horizontal Federated Learning\" (HFL) or HFL, and \"Vertical Federated Learning\" (VFL) or VFL. Boolean operators (AND, OR) were consistently utilized to refine these queries, ensuring the identification of studies that specifically addressed the combination of federated learning with machine learning or deep learning for various cybersecurity mechanisms. Figure 1, generated using VOSviewer version 1.6.20 [18], visually represents the co-occurrence of key research terms in the initial pool of identified papers, illustrating the interconnectedness of these areas and guiding the refinement of our search strategy. This structured approach facilitated the identification of research studies exploring key dimensions such as accuracy, privacy preservation, scalability, explainability, and robustness in cybersecurity frameworks [18; 19; 20]. To maintain scientific rigor and reliability throughout the review process, a stringent set of inclusion and exclusion criteria was applied. Studies published between 1 January 2015 and 31 December 2024 that were peer-reviewed journal articles and written exclusively in English were considered for inclusion. Furthermore, studies were included if they explicitly proposed or evaluated models combining federated learning (FL) with machine learning (ML) or deep learning (DL) and focused on the application of these combined models within cybersecurity contexts, such as intrusion detection systems (IDS), malware analysis, fraud detection, network security, or anomaly detection. Finally, included studies had to provide sufficient evaluation metrics or discussions related to the five key dimensions: accuracy, privacy preservation, scalability, explainability, and robustness. Conversely, non-peer-reviewed literature (including grey literature like unpublished reports, whitepapers, or preprints), articles not subjected to formal peer review, or duplicate publications were excluded. Studies focusing solely on machine learning or deep learning without the explicit integration of federated learning were also excluded, as were those primarily concerned with the security of federated learning itself (e.g., data poisoning attacks on FL models) rather than the application of FL for cybersecurity threat detection or defense. Articles that did not provide sufficient methodological detail or empirical results relevant to the specified evaluation metrics were also excluded.