# A Systematic Review on Hybrid AI Models Integrating Machine Learning and Federated Learning
## 3 Background and Related Work
### Hybrid AI Models: A Conceptual Overview  
Hybrid AI models that combine the predictive power of machine learning (ML) or deep learning (DL) with the privacy preserving architecture of federated learning (FL) offer a compelling solution to emerging cybersecurity challenges. These models are especially suitable for distributed and sensitive environments such as IoT networks and cyber-physical systems, where ensuring data confidentiality and maintaining real-time detection capabilities are vital. As summarized in Table 3, ref. [61] provides a broad review of hybrid ML + FL architectures, highlighting improvements in detection accuracy and privacy compliance. In adversarial contexts, ref. [62] evaluates vertical federated learning (VFL) using SplitNN in grid systems under DoS and data injection attacks, and [63] proposes a multi-agent VFL framework combining reinforcement learning techniques for robust cyber-physical protection. Ref. [64] introduces a hierarchical hybrid FL architecture integrating VFL, HFL, and transfer learning to support adaptive analytics in cybersecurity domains. Several studies leverage hybrid DL models under FL. For example, ref. [65] uses CNN and BiLSTM within an HFL setting for zero-trust intrusion detection, and [66] merges HFL with gradient boosted trees to enhance interpretability. Moreover, refs. [67, 68] demonstrate how federated deep learning (FDL) architectures achieve high performance and efficiency for IoT intrusion detection. Generative adversarial networks (GANs) are increasingly integrated with FL to improve robustness, as illustrated by [69], which combines GANs and FL for intrusion detection. Further, ref. [70] integrates FL with GANs and differential privacy for UAV networks, and [71] incorporates blockchain and differential privacy with federated GANs to ensure robust and transparent collaborative IDS in cyber-physical systems. Despite these advancements, scalability, communication efficiency, and explainability remain open research challenges, underscoring the need for continuous innovation in hybrid AI frameworks for cybersecurity. Beyond the current applications and comparative performance, the landscape of federated machine learning (FML) in cybersecurity is continually evolving with new research directions and emerging trends. These advancements aim to overcome existing limitations inherent in standalone ML and FL approaches and to unlock novel capabilities for enhanced threat detection, robust privacy, and system resilience. By exploring more sophisticated architectural designs, novel algorithmic integrations, and synergistic combinations with other cutting edge technologies, FML is pushing the boundaries of what is possible in distributed and privacy sensitive cyber defense. Table 4 synthesizes these cutting-edge developments, categorizing them by their primary focus within the hybrid FL+ML/DL \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Ref.** & **Survey** & **Objective** \\ \hline
[38] & 2D federated learning model & Combines HFL and VFL for personalized human activity recognition in cyber-physical-social systems, with privacy-preserving homomorphic encryption. \\ \hline
[60] & Federated learning based approach to intrusion detection & Proposes an HFL-based IDS that increases detection rates across heterogeneous attacks while considering computational and bandwidth constraints. \\ \hline
[53] & An efficient federated learning system for network intrusion detection & Introduces dynamic weighted aggregation (DAFL) to improve HFL model accuracy and reduce communication overhead. \\ \hline
[56] & FedSBS: Participant-selection method for FL-based IDS & Enhances HFL by using score-based participant filtering to resist malicious clients and improve detection robustness. \\ \hline
[57] & Fed-FIDS: Federated learning for anomaly detection in IDS & Introduces real-time resource allocation and data selection modules to make HFL more efficient and accurate. \\ \hline \hline \end{tabular}
\end{table}