# A Systematic Review on Hybrid AI Models Integrating Machine Learning and Federated Learning
## 2 Methodology
### Data Extraction and Synthesis Methods  
Data extraction was conducted systematically to ensure the accurate and consistent collection of key information from all included studies. A predefined data extraction template was utilized to gather critical details such as authors, publication year, study objectives, the specific FL+ML/DL techniques employed, reported evaluation metrics, and the cybersecurity application domains addressed [20]. This structured approach facilitated a coherent comparison of methodologies and outcomes across diverse studies. The key techniques extracted included various machine learning (ML) algorithms (e.g., CNN, RNN, SVM, random forest), federated learning (FL) architectures (e.g., horizontal FL, vertical FL), and the specific configurations of their hybrid frameworks. These models were assessed for their application in cybersecurity, focusing on areas such as intrusion detection systems (IDS), malware detection, anomaly detection, and broader network security analysis. The systematic extraction of these methodologies enabled a structured comparison of different approaches, highlighting their reported effectiveness in addressing modern cybersecurity threats. The performance of these models was evaluated based on five critical evaluation metrics, each reflecting a distinct dimension of model utility:  
* Accuracy: The model's reported ability to distinguish between normal and malicious activities with high precision, ensuring reliability in threat detection;
* Privacy Preservation: The reported capability to protect sensitive data during model training and inference, particularly significant in federated learning environments where raw data remains decentralized;
* Scalability: The reported capacity to handle large-scale datasets and real-time traffic analysis, a necessity for deployment in large networks and cloud infrastructures;
* Explainability: The reported transparency in decision-making processes, which is crucial for regulatory compliance and stakeholder trust; This metric assesses how well models provide interpretable insights into their decisions;
* Robustness: The reported resilience of the models against adversarial attacks, data perturbations, and variable operational environments, ensuring stable performance even in hostile conditions. Figure 2: Study selection process. After the rigorous data extraction process, the collected information was systematically synthesized to derive comprehensive insights into the current state of federated learning and machine learning hybrid models in cybersecurity. This synthesis involved several steps. A qualitative thematic analysis was performed, where extracted data points related to the employed techniques, specific applications, reported performance, and discussed challenges across the five-evaluation metrics were grouped into thematic categories. This allowed for the identification of recurring patterns, common strengths, specific limitations, and emerging trends within each dimension. A comparative analysis was then conducted, where a cross-study comparison for each evaluation metric contrasted the reported performance and characteristics of standalone ML models, standalone FL models, and the identified hybrid FL+ML/DL models. This comparison aimed to highlight the synergistic benefits, specific trade-offs, and unique advantages of integrated approaches in different cybersecurity contexts. Finally, through critical evaluation and gap identification, existing research gaps, unaddressed challenges, and promising future directions were systematically identified from the synthesized findings. Particular attention was paid to areas where current hybrid models demonstrated limitations (e.g., generalizability of high accuracy claims, true real-world scalability, comprehensive explainability beyond basic tools) or where further research could yield significant advancements.