# Federated Learning for Cybersecurity: A Privacy-Preserving Approach
## 7 Limitations and Future Work  
While the proposed FL framework shows promising results in intrusion detection for distributed IoT networks, several limitations must be acknowledged to guide future improvements. First, the system currently operates under the assumption of synchronous client participation and stable communication availability. This assumption may not hold in real-world deployments involving mobile, resource-constrained, or intermittently connected devices--common characteristics in smart cities and remote industrial facilities. This limitation highlights the need for asynchronous FL protocols that can tolerate communication failures and partial client participation without degrading global model accuracy. The existing threat model excludes several sophisticated adversarial scenarios such as client collusion, adaptive backdoor insertion, and multi-point gradient inversion attacks. Although lightweight encryption, gradient clipping, and differential privacy are included, the framework does not yet integrate more advanced cryptographic techniques such as homomorphic encryption, SMPC, or zero-knowledge proofs. These mechanisms provide stronger guarantees, but impose a higher computational overhead, which can make deployment in edge environments challenging. The integration of such cryptographic primitives must also be evaluated for compatibility with edge computing hardware accelerators, such as ARM TrustZone or RISC-V-based enclaves. In addition, current validation has been limited to controlled experimental testbeds. While results have demonstrated convergence within 8-10 rounds and privacy loss below 5%, the long-term resilience, scalability, and energy efficiency of the framework remain untested in large-scale, live IoT infrastructures. Beyond testbed simulation, field validation under real-world noise, hardware failures, and adversarial interference remains a critical benchmark for production readiness. Real-world testing in smart healthcare systems, autonomous vehicle networks, and industrial IoT is essential to assess system behavior under operational stress, regulatory constraints, and varying workload distributions. Another limitation is the lack of adaptive learning mechanisms. Static models may underperform in environments where client data distributions change rapidly due to seasonal patterns, new attack vectors, or changes in user behavior. A hybrid learning paradigm that combines meta-learning and continuous adaptation could provide resilience in scenarios where data distributions evolve rapidly or drift over time. Integrating continuous learning, meta-learning, and personalized model tuning can significantly improve model robustness and context awareness. The interpretability of federated models also requires attention. Incorporating explainable AI techniques such as SHAP values, Local Interpretable Model-Agnostic Explanationsor gradient-based saliency mapping could improve the transparency of detection decisions, thereby increasing stakeholder trust and facilitating compliance audits. Importantly, the social and ethical implications of federated cybersecurity systems--especially in public sector deployments--must be critically examined to ensure fairness, transparency, and non-discrimination. Future research will also explore cross-layer threat modeling and dynamic orchestration of federated agents within SDN/NFV architectures, enabling better scalability and responsiveness to distributed attacks. Finally, the integration of blockchain-based trust management can enable tamper-proof recording of model updates, improve reputation-based client filtering, and support traceability in multi-tenant FL environments. Systematically addressing these limitations will not only improve the resilience and interpretability of FL-based IDS, but also accelerate its adoption in large-scale, mission-critical infrastructures.