Generative AI and Federated Learning for Intrusion Detection Systems: A Survey

2026-07-01

AI Summary

This study addresses the challenges confronting intrusion detection systems (IDS), including dynamically evolving attacks, data scarcity, class imbalance, and the difficulty of centralized training under strict privacy constraints. It presents a systematic review of the integration of generative artificial intelligence—encompassing generative adversarial networks (GANs), diffusion models, and large language models—with federated learning in IDS applications. The work covers key areas such as anomaly detection, synthetic data generation, data augmentation, and privacy-preserving distributed training. For the first time, it offers a structured synthesis of recent advances at the intersection of these two technological paradigms and outlines promising future directions, including domain-specific large language models and federated benchmarking frameworks, thereby establishing a novel paradigm for privacy-sensitive, distributed cybersecurity solutions.

Abstract

Intrusion Detection Systems (IDSs) are essential for monitoring network traffic and identifying malicious activities in modern cyber-physical, Internet of Things (IoT), enterprise, and distributed network environments. However, developing reliable IDS models remains challenging because attack behaviors evolve over time, realistic datasets are difficult to obtain, traffic records may be incomplete, attack classes are often imbalanced, and privacy constraints limit centralized data collection. Recent advances in generative artificial intelligence (AI) and Federated Learning (FL) provide new opportunities to address these limitations. Generative models can support anomaly detection, synthetic traffic generation, data augmentation, data imputation, adversarial traffic generation, and IDS alert explanation. FL enables distributed IDS training without directly sharing local network traffic, making it suitable for privacy-sensitive and geographically distributed environments. This survey provides a structured review of generative AI and FL techniques for IDS. We first summarize representative IDS research directions, including adversarial machine learning, anomaly-based detection, IoT-oriented IDS, explainable IDS, and benchmark datasets. We then categorize generative AI applications in IDS according to model families and task objectives, covering autoencoder-based models, Generative Adversarial Networks (GANs), diffusion models, and Large Language Models (LLMs). Finally, we review emerging studies that integrate generative AI with FL-based IDS and discuss open challenges, including synthetic data quality, realistic traffic generation, dual-use adversarial risks, non-IID client distributions, communication-efficient model sharing, federated IDS benchmarking, and domain-specific LLMs for network security.

Problem

• Intrusion Detection Systems
• data scarcity
• class imbalance
• privacy constraints
• attack evolution

Innovation

• Generative AI
• Federated Learning
• Intrusion Detection System
• Synthetic Data Generation
• Privacy-Preserving Machine Learning