# A Systematic Review on Hybrid AI Models Integrating Machine Learning and Federated Learning
## 5 Discussion
### Addressing Research Questions  
RQ1: What specific federated learning (FL) and machine learning (ML)/deep learning (DL) architectures and techniques are predominantly employed for various cybersecurity applications, and how do their configurations impact reported performance? \begin{table}
\begin{tabular}{p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt}} \hline \hline
**Metric** & \begin{tabular}{c} **Machine Learning** \\ **(ML)** \\ \end{tabular}  & \begin{tabular}{c} **Federated Learning** \\ **(FL)** \\ \end{tabular}  & \begin{tabular}{c} **Hybrid AI Models** \\ **Hybrid AI achieves** \\ the highest reported \\ accuracy by \\ combining ML’s \\ pattern recognition \\ with FL’s \\ distributed learning \\ capabilities. \\ \end{tabular}  & \begin{tabular}{c} **Key Insights** \\ **References** \\ \end{tabular}  \\ \hline Accuracy & \(\sim\)85\% & \(\sim\)90\% & Up to 95\% & Up to 95\% & \begin{tabular}{c} Federated learning \\ and hybrid AI \\ maintain privacy by \\ keeping data local, \\ preventing central \\ aggregation risks. \\ \end{tabular}  & \begin{tabular}{c} **Federated learning** \\ and hybrid AI \\ maintain privacy by \\ 66,70,71,82,107–109] \\ \end{tabular}  \\ \hline \multirow{2}{*}{ \begin{tabular}{} \end{tabular}  } & \multirow{2}{*}{Low} & \multirow{2}{*}{High} & \multirow{2}{*}{High} & \ \begin{tabular}{c} Federated learning \\ and hybrid AI \\ maintain privacy by \\ keeping data local, \\ preventing central \\ aggregation risks. \\ \end{tabular}  &
\begin{tabular}{c} **[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[** **[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[ **[**[**[**[**[**[**[**[**[**[**[**[**[**[**[**[[**[**[**[[**[**[[**[**  
Our review identifies a diverse range of FML architectures and techniques predominantly employed in cybersecurity. Federated deep learning (FDL) models, integrating DNNs, CNNs, RNNs, and BiLSTM, are widely utilized for intrusion detection [48; 65; 67; 68; 75; 77] and malware analysis [75]. Vertical federated learning (VFL) frameworks, often incorporating SplitNN [62] or reinforcement learning agents (e.g., DQN, A2C) [63], are applied in adversarial contexts and cyber-physical systems [62; 63]. Beyond deep learning, traditional ML algorithms like gradient boosted decision trees (GBDT) are hybridized with HFL for interpretable intrusion detection [66]. The configuration of these architectures, particularly the choice of local ML/DL models and FL aggregation strategies, directly impacts reported performance, with FML models consistently outperforming standalone ML or FL across various metrics [59; 67; 68]. RQ2: What are the key performance trade-offs (e.g., between accuracy, privacy, scalability, and robustness) inherent in current federated machine learning (FML) approaches when applied to diverse cybersecurity use cases, and how are these trade-offs currently managed in the literature? FML approaches inherently involve critical trade-offs. While FML achieves high accuracy (up to 99.9%) [67; 68] and strong privacy preservation [41; 42; 43; 48; 64; 66; 70; 71; 77; 82; 107; 108; 109], challenges arise when balancing these with scalability and communication efficiency [46; 47; 53; 57; 60; 70; 78; 97; 104]. For instance, implementing stronger privacy mechanisms (e.g., differential privacy, homomorphic encryption) can introduce computational overhead or affect model accuracy. Similarly, addressing the challenges of data heterogeneity across distributed devices for robust training often requires complex aggregation strategies that impact synchronization and overall efficiency [86; 87]. The literature manages these trade-offs through various optimization techniques, such as dynamic aggregation [53; 78], lightweight architectures, and intelligent client selection.