Federated Learning for Distributed Cyber Threat Detection: A Systematic Review of Architectures, Applications, and Open Challenges

Imagine the internet as a giant, bustling city where every house, factory, and car is constantly talking to its neighbors. Sometimes, these conversations are friendly, but other times, sneaky troublemakers try to sneak in and cause chaos. To stop them, we need "security guards" (computer programs) that can spot the bad guys. For a long time, the only way to train these guards was to gather every single piece of evidence—every log, every message, every secret—into one giant, central vault. But this is a terrible idea. It's like asking everyone in the city to mail their private diaries to a single post office; it clogs the mail trucks (bandwidth), takes forever to arrive (latency), and if a thief breaks into that one post office, they steal everyone's secrets at once. Plus, many people simply aren't allowed to share their diaries due to privacy laws.

Enter a clever new idea called Federated Learning. Instead of mailing the diaries, imagine the security guards staying in their own neighborhoods. They read their local diaries, figure out what a bad guy looks like, and then just send a tiny, anonymous "tip sheet" (a math update) to a central coordinator. The coordinator mixes all the tip sheets together to create a super-smart, global guidebook, which is then sent back to the neighborhoods. No secrets leave the house, but everyone gets smarter. This paper explores how we can use this "tip-sheet" method to build better security guards for our digital city, specifically looking at how different neighborhoods (like factories, cars, and home gadgets) can work together without sharing their private data.

---

The Paper's Mission: A Systematic Review

This paper, written by Joshua Babatola, acts like a massive detective's case file. The author didn't just invent a new security system; instead, they went on a hunt through thousands of scientific studies published between 2017 and 2025 to see what the world has already discovered about using Federated Learning for cyber security. They looked at research from major libraries like IEEE and Scopus, filtering through the noise to find the best studies that actually tested these ideas. Their goal was to map out the different "architectures" (blueprints) people are using, see where they work best, and figure out what problems are still keeping us up at night.

What They Found: The Good, The Bad, and The Tricky

The review found that Federated Learning is a promising hero, but it's not a magic wand. Here is what the detective work revealed:

• Different Blueprints for Different Neighborhoods: Just as you wouldn't build a skyscraper in a village or a mud hut in a city, the paper found that one security blueprint doesn't fit all.

  • The Simple Central Hub: Most studies still use a "central server" where one boss collects all the tip sheets. This works well for big companies with strong internet connections.
  • The Layered Approach: For places like self-driving cars or factories where speed is everything, researchers are using "hierarchical" systems. Think of this as having local team captains who gather tips from their small groups first, then send a summary to the big boss. This saves time and bandwidth.
  • The Trustless Ledger: In environments where no one trusts anyone else (like cars from different companies), some studies are using "blockchain" technology. This is like a public, unchangeable notebook that records every tip sheet so no one can cheat or lie about what they sent.

• The "Non-IID" Puzzle: The biggest headache the paper highlights is something called non-IID data. In plain English, this means that every neighborhood sees different things. A factory sees machine glitches, a home sees smart-fridge traffic, and a car sees road sensors. Because their "diaries" are so different, it's hard for the central coordinator to mix the tip sheets into a single, perfect guidebook. The paper suggests that this statistical mismatch is the main reason these systems sometimes struggle to agree on what is a "bad guy."

• The Sneaky Villains: The paper warns that the process itself has new weaknesses. Since the central boss can't see the actual data, a bad actor could pretend to be a helpful neighbor and send a fake tip sheet designed to poison the whole group's brain. This is called a "poisoning attack." The review found that while some defenses exist (like checking if a tip sheet looks weird compared to the others), these defenses often slow things down or make the system less accurate when the data is just naturally messy.

What the Paper Rules Out and Where It Stands

The authors are careful not to overhype the results. They explicitly state that while Federated Learning can match the accuracy of the old "central vault" method in many tests, it is not a solved problem yet.

• It's not a "Done Deal": The paper argues against the idea that we can just plug-and-play these systems today. The results are largely based on simulations and tests using old, public datasets (like NSL-KDD or CICIDS2017) that might not perfectly reflect the messy, real-world internet of 2025.
• No Magic Bullet for Trust: The paper suggests that simply adding blockchain or encryption doesn't automatically fix the problem of bad actors. If a hacker poisons the data before it's turned into a tip sheet, the fancy blockchain won't catch it.
• The Confidence Level: The findings are based on a "systematic review" of existing simulations and experiments. The authors are confident that the challenges (like non-IID data and poisoning) are real and significant, but they are less sure about the solutions because the studies vary so much in how they test them. They suggest that we need better, standardized ways to test these systems before we can say any specific design is the "winner."

The Bottom Line

In the end, this paper tells us that Federated Learning is a brilliant concept that lets us fight cyber threats together without giving up our privacy. However, the journey from "cool idea" to "real-world tool" is still bumpy. The biggest hurdles are making sure the system works when everyone's data looks different, and building defenses that are strong enough to stop hackers from tricking the group. The authors conclude that future research needs to focus on creating better testing grounds (standardized benchmarks) and designing systems that can handle the messy reality of the internet, rather than just the clean, perfect worlds of computer simulations.