# A Systematic Review on Hybrid AI Models Integrating Machine Learning and Federated Learning
## 1 Introduction  
Cyber incidents, such as the Equifax data breach, which exposed the personal information of millions, and the WannaCry ransomware attack, which crippled critical infrastructures worldwide, exemplify the evolving landscape of cyber threats [1, 2, 3]. These are not isolated events but rather indicative of a broader trend: modern cyberattacks are becoming more sophisticated, dynamic, and persistent, outpacing the capabilities of traditional defense mechanisms. Conventional security tools such as firewalls and antivirus software are increasingly insufficient for detecting and mitigating advanced threats [4, 5]. This has created an urgent need for adaptive security systems capable of real-time detection and response. To this end, Machine learning (ML) has emerged as a transformative approach. ML models excel at analyzing vast amounts of network data and identifying subtle patterns that may signal malicious behavior, often surpassing rule-based systems in accuracy and adaptability [6, 7]. However, ML models typically rely on centralized data storage, raising concerns about data privacy, regulatory compliance, and the risk of data breaches [8, 9]. The aggregation of sensitive information in centralized servers creates a critical vulnerability, particularly in sectors such as healthcare, finance, and critical infrastructure. To address these privacy concerns, federated learning (FL) introduces a decentralized training paradigm. FL enables machine learning models to be trained across multiple edge devices or institutions without exposing raw data, thereby preserving privacy and supporting compliance with regulations like GDPR [10, 11]. Despite these advantages, FL suffers from several limitations, including communication overhead, non-IID data heterogeneity, and reduced effectiveness in real-time or large-scale environments [12, 13, 14]. To overcome these respective shortcomings and synergistically leverage their strengths, federated machine learning (FML) models, which explicitly integrate ML and FL techniques, have emerged as a promising solution. Such systems are particularly promising in decentralized, privacy-sensitive, and dynamic environments like Internet of Things (IoT) networks, cloud computing, and smart grids. This paper presents a systematic review of federated machine learning (FML) models that combine ML and FL techniques for cybersecurity applications [15, 16]. It critically evaluates these models across five key performance dimensions: accuracy, privacy preservation, scalability, explainability, and robustness to adversarial attacks. Unlike previous reviews that may have focused solely on ML or FL, or provided a broad overview of \"Hybrid AI\" without specific emphasis on the FL+ML/DL synergy, this systematic literature review provides an in-depth analysis of the unique architectural configurations, performance trade-offs, and critical research gaps specific to FML in cybersecurity [17]. By providing a nuanced understanding of these integrated approaches, this review aims to bridge existing knowledge gaps and identify novel future directions for robust and privacy-preserving cybersecurity solutions. To guide this investigation and provide novel insights into the field, we formulate the following research questions:  
* RQ1: What specific federated learning (FL) and machine learning (ML)/deep learning (DL) architectures and techniques are predominantly employed for various cybersecurity applications, and how do their configurations impact reported performance? * RQ2: What are the key performance trade-offs (e.g., between accuracy, privacy, scalability, and robustness) inherent in current federated machine learning (FML) approaches when applied to diverse cybersecurity use cases, and how are these trade-offs currently managed in the literature?