# A Systematic Review on Hybrid AI Models Integrating Machine Learning and Federated Learning
## 3 Background and Related Work
### Federated Learning: Principles and Challenges  
Federated learning (FL) presents a decentralized paradigm that enables collaborative model training across distributed entities without sharing raw data, making it highly suitable for privacy-sensitive domains like cybersecurity [37; 38]. As detailed in Table 2, FL is increasingly leveraged for diverse cybersecurity applications, including privacy-preserving threat detection in edge and cloud environments [37], real-time attack detection and trust management [39], and robust intrusion detection systems (IDS) even under adversarial conditions [40]. FL models are also actively applied for intrusion detection in heterogeneous IoT networks [41; 42], enhancing overall IoT cybersecurity [43; 44; 45], and demonstrating superior performance over centralized methods in detecting cyber threats [46]. Specific implementations include RNN-based federated models for distributed intrusion detection [47; 48], reviews of FL solutions for IoT intrusion detection [49; 50], and systems integrating digital twins with FL for zero-day threat detection in IoT [51]. FL also supports scalable vertical learning frameworks for cybersecurity analytics [52] and offers general support for cybersecurity fundamentals, applications, and opportunities [38]. Despite its potential, FL still faces significant implementation challenges. These include high communication overhead, which can lead to network congestion and latency due to frequent model exchanges [43; 53]. This complexity is compounded by data heterogeneity across distributed devices, making synchronization and consistent training a challenging task [54; 55]. To address these issues, studies such as [53] propose dynamic aggregation to reduce bandwidth consumption, while [56] enhances model robustness through intelligent participant selection. In parallel, ref. [57] introduces real-time resource and data allocation strategies to improve efficiency in federated anomaly detection systems. A growing subset of FL research focuses on Vertical Federated Learning (VFL), where features--not data \begin{table}
\begin{tabular}{c c c} \hline
**Ref.** & **Survey** & **Objective** \\ \hline
[25] & Cybersecurity risk analysis in the IoT: & Examines IoT security risks and ML applications in threat detection, identifying gaps in authentication and data protection. \\ \hline
[33] & Machine learning and deep learning techniques & Highlights challenges and opportunities in ML/DL-based intrusion detection and anomaly detection methods. \\ \hline
[34] & A survey on security threats and defensive techniques of ML & Systematically reviews security threats like data poisoning in ML systems and categorizes defensive measures into assessment, training, and inference techniques. \\ \hline
[35] & Machine learning approaches to IoT security & Surveys ML applications for IoT attack detection, focusing on real-time and near-real-time threat mitigation. \\ \hline
[36] & Survey on machine learning applications in cyber security problems & Summarizes ML techniques for intrusion detection, network traffic analysis, and malware detection, providing insights into the state of the art. \\ \hline
[26] & AI in cybersecurity education: A systematic & Investigates AI applications in cybersecurity MOOCs, identifying challenges in teaching ML applications for threat detection and privacy management. \\ \hline
[16] & Building a thematic framework of cybersecurity: A systematic literature review approach & Develops a cybersecurity framework for risk management, identifying organizational and technological factors that influence cybersecurity implementation. \\ \hline \end{tabular}
\end{table} 
Table 1: Cont. samples--are partitioned across entities [52; 54]. These VFL frameworks are evaluated for their potential in handling distributed, vertically fragmented data in adversarial and real-world cybersecurity scenarios [54]. Collectively, these works emphasize the need for scalable, interpretable, and communication-efficient FL frameworks to meet the demands of modern cybersecurity landscapes.