Technical Summary: Generative AI and Federated Learning for Intrusion Detection Systems: A Survey

Problem Statement

Intrusion Detection Systems (IDSs) are critical for monitoring network traffic in modern environments, including IoT, enterprise, and cyber-physical systems. However, developing reliable IDS models faces persistent challenges:

1. Data Limitations: Realistic datasets are difficult to obtain due to privacy constraints, leading to issues with data scarcity, class imbalance, incomplete records, and outdated attack signatures.
2. Privacy and Distribution: Traditional centralized training requires aggregating sensitive network traffic from distributed clients, which poses privacy risks and communication overhead.
3. Evolving Threats: Attack behaviors evolve rapidly, and static signature-based detection fails against zero-day or unknown threats.
4. Fragmented Research: While Generative AI (GenAI) and Federated Learning (FL) have been studied individually, their intersection in the context of IDS remains fragmented. There is a lack of systematic review regarding how GenAI can specifically support privacy-preserving, distributed IDS training and what technical challenges remain.

Methodology

This paper is a survey that synthesizes existing literature rather than proposing a new experimental model. The authors employed a keyword-based search strategy across Google Scholar and DBLP, supplemented by manual inspection of major security, networking, and machine learning venues.

• Search Criteria: Papers were selected based on relevance to applying generative model families (VAEs, GANs, Diffusion, LLMs) to IDS tasks or integrating these models with FL-based IDS.
• Scope: The review covers the last five to seven years for application-oriented studies while retaining foundational references for model architectures and early IDS concepts.
• Structure: The survey is organized into four main sections:
  1. IDS Background: Reviewing adversarial ML, anomaly-based detection, IoT-specific IDS, explainable IDS (X-IDS), and benchmark datasets.
  2. Generative Models: Categorizing applications by model family (VAEs, GANs, Diffusion, LLMs) and task objective (anomaly detection, data generation, augmentation, imputation, adversarial generation, and explanation).
  3. GenAI-Embedded FL-IDS: Analyzing how specific generative models are integrated into federated settings to address non-IID data, communication costs, and privacy.
  4. Challenges and Future Directions: Identifying open problems in synthetic data quality, realism, dual-use risks, and benchmarking.

Key Contributions

The paper provides a structured taxonomy and critical analysis of the intersection between GenAI, FL, and IDS. Its primary contributions include:

1. Structured Review of IDS Directions: It summarizes representative research areas (adversarial ML, anomaly detection, IoT, X-IDS) to establish the technical context for why GenAI and FL are necessary.
2. Taxonomy of GenAI in IDS: It organizes existing studies by model family and task:
   • VAEs: Used for reconstruction-based anomaly detection, latent representation learning, and data augmentation.
   • GANs: Applied to tabular data generation, class-imbalance mitigation, data imputation, and adversarial traffic generation.
   • Diffusion Models: Emerging for stable synthetic data generation, adversarial purification, and robustness improvement.
   • LLMs: Utilized for traffic-log analysis, natural-language alert explanation, and knowledge-guided tabular generation.
3. Analysis of GenAI-Embedded FL-IDS: It systematically examines how generative models support distributed training by:
   • Augmenting local data to mitigate non-IID distributions and class imbalance.
   • Reducing communication costs via compact latent representations (VAEs).
   • Addressing the dual-use risk where generative models can be used offensively to poison FL updates or evade detection.
4. Dataset and Benchmark Assessment: It summarizes commonly used IDS datasets (e.g., UNSW-NB15, CICIDS2017, FLNET2023) and highlights a critical gap: the lack of realistic, topology-aware, and federated benchmarks. Most existing datasets are centrally collected and do not reflect true client-level heterogeneity.
5. Identification of Open Challenges: The survey outlines specific unresolved issues, including the reliability of synthetic traffic (statistical similarity vs. network validity), dual-use adversarial risks in FL, communication efficiency of generative FL, and the need for domain-specific LLMs.

Results and Findings

The survey synthesizes findings from the literature to answer four research questions:

• RQ1 (Usage): Generative models improve IDS by compensating for limited, imbalanced, or incomplete data. VAEs and GANs are dominant for data augmentation and anomaly detection, while LLMs offer unique capabilities in explanation and log analysis.
• RQ2 (Reliability): Synthetic traffic is conditionally reliable. While distribution-level metrics (e.g., KL divergence, FID) measure statistical similarity, they do not guarantee that generated traffic preserves protocol constraints, temporal dependencies, or attack semantics. Low-quality synthetic data can distort decision boundaries.
• RQ3 (FL Support): GenAI can support privacy-preserving FL-IDS by augmenting local datasets without sharing raw traffic. However, this introduces dual-use risks where attackers could use generative models to create adversarial samples that poison global models. Communication efficiency remains a challenge, particularly for GANs and LLMs.
• RQ4 (Benchmarks): Current benchmarks are largely insufficient for evaluating federated and generative settings. Most are centrally collected. FLNET2023 is identified as a notable exception that explicitly supports federated evaluation, but the field lacks realistic, topology-aware federated datasets.

Significance and Claims

The paper claims significance as a systematic review that bridges the gap between three distinct fields: IDS, Generative AI, and Federated Learning.

• Contextualization: It establishes that while GenAI and FL are individually mature, their integration for IDS is an emerging and fragmented field requiring a unified perspective.
• Critical Gap Identification: The authors modestly claim that the field currently lacks realistic benchmarks for federated and generative IDS. They argue that future research must move beyond simple data generation to focus on network-level validity (protocol constraints, topology) and communication-efficient generative sharing.
• Dual-Use Awareness: The paper emphasizes the dual-use nature of generative models in FL, noting that the same tools used to improve IDS robustness can be weaponized to evade detection or poison federated models, a risk that is harder to detect in distributed settings than in centralized ones.
• Future Direction: The survey concludes that building reliable GenAI-enabled IDS requires a holistic framework combining accurate detection, realistic data generation, privacy preservation, and security-aware evaluation, rather than treating these components in isolation.