## 2 Literature Review
Support vector machines (SVMs) are valued for handling high-dimensional data, while decision trees (DTIs) offer simplicity and interpretability. Random forest (RF), an association of decision trees, amplifies efficacy and deduces overfitting. Naive Bayes (NB) provides probabilistic classification with efficiency in large data sets, and K-nearest neighbors (KNNs) excel in instance-based learning for classification tasks. In DL, CNNs are highly efficient at pooling out complex hierarchical patterns from structured data, while gradient boosting (GB) and another updated version of GB, extreme gradient boosting (XGB), iteratively improve weak learners for superior predictive performance. These techniques [19; 29; 30] have demonstrated considerable success in advancing IDS capabilities. However, evolving cyber threats pose ongoing challenges, including scalability, real-time detection, and addressing imbalanced data, which require further research and innovation to enhance future IDS frameworks. Apart from traditional techniques, bio-inspired frameworks have been quite effective for IDS. Though there have been fewer works in this genre, some have proved the significance of bio-inspired techniques, particularly in anomaly detection. In an article [31], a bi-layer structure, with the initial stage eliminating recursive patterns and incorporating RF-based methodology (RF-RFE) and optimization approaches that are inspired by a biological style, is employed in the following layer. In an article [32], the support vector machine was optimized using Whale Optimization (WO), Grey Wolf Optimization (GWO), and Firefly Optimization (FO) algorithms. However, the detection rates of the irregularities using the optimized methodologies did not demonstrate optimal efficiency. In an article [33], a novel combination of deep learning and the Dendritic Cell Algorithm (DeepDCA) was integrated into the framework alongside a neural network that normalizes itself (SNN). However, the implementation utilized a relatively outdated and less diverse data set. In addition to traditional methods, FL has become a popular architecture for developing intrusion detection systems (IDSs), offering distributed training without allowing access to original data. Various studies have explored different FL-based approaches, including RF-based federated learning [22], shallow artificial neural networks (ANNs) with FedAvg for aggregation [23], CNNs and RNNs [34], and combinations of a multi-layer perceptron (MLP) with a CNN [35]. [PERSON] et al. introduced the CICIoT2023 data set, which has been widely used in experiments involving ML algorithms for classification [11]. Notable studies include [36], which proposed a convoluted structure depending on LSTM for attack detection, and [PERSON] et al., who explored DL models with different stages and functions that activate the model [37]. [PERSON] et al. deployed unbiased ML algorithms to detect irregularities, and [38] emphasized fairness and accuracy in model predictions. These efforts highlight the evolution of IDS using FL and advanced machine learning techniques. Although there exist advanced FL-based IDSs, these systems have their limitations, such as most of the infrastructure focusing only on identifying one type of malicious action, such as DDoS [25] or DoS [26], some being computationally costly [23; 26; 27], and some not performing well when the data volume grows [22]. On the other hand, centralized ML or DL approaches have always been prone to vulnerability in maintaining confidentiality and sometimes result in overfitting. Additionally, bio-inspired approaches such as DeepDCA [33] or combined optimization techniques have proven themselves promising, but their scalability and compatibility with FL environments are still subject to skepticism. Furthermore, the implementation of XAI has been isolated, rather than combined with a model, and the experimental surface is still narrow. At present, the most urgent limitation is the lack of an architecture that can ensure privacy, explainability, and effective efficiency.