Generative AI and Federated Learning for Intrusion Detection Systems: A Survey

• tag:aim-pro.eu,2026:oer/f40027e54d10
• https://arxiv.org/abs/2607.01305
• arxiv:2607.01305

This engine's id, the source URI, and any persistent identifier the source published.

• Generative AI and Federated Learning for Intrusion Detection Systems: A Survey

The title of this resource, not of the record or repository it came from.

• dcmitype:Text
• preprint

A DCMI Type term for the form held, plus the source's own genre label as declared.

• Jiefei Liu
• Abu Saleh Md Tayeen
• Pratyay Kumar
• Qixu Gong
• Wenbin Jiang
• Huiping Cao
• Satyajayant Misra
• Jayashree Harikumar

Only agents the source named as creators. A repository owner is not made an author by default.

• Intrusion Detection Systems (IDSs) are essential for monitoring network traffic and identifying malicious activities in modern cyber-physical, Internet of Things (IoT), enterprise, and distributed network environments. However, developing reliable IDS models remains challenging because attack behaviors evolve over time, realistic datasets are difficult to obtain, traffic records may be incomplete, attack classes are often imbalanced, and privacy constraints limit centralized data collection. Recent advances in generative artificial intelligence (AI) and Federated Learning (FL) provide new opportunities to address these limitations. Generative models can support anomaly detection, synthetic traffic generation, data augmentation, data imputation, adversarial traffic generation, and IDS alert explanation. FL enables distributed IDS training without directly sharing local network traffic, making it suitable for privacy-sensitive and geographically distributed environments. This survey provides a structured review of generative AI and FL techniques for IDS. We first summarize representative IDS research directions, including adversarial machine learning, anomaly-based detection, IoT-oriented IDS, explainable IDS, and benchmark datasets. We then categorize generative AI applications in IDS according to model families and task objectives, covering autoencoder-based models, Generative Adversarial Networks (GANs), diffusion models, and Large Language Models (LLMs). Finally, we review emerging studies that integrate generative AI with FL-based IDS and discuss open challenges, including synthetic data quality, realistic traffic generation, dual-use adversarial risks, non-IID client distributions, communication-efficient model sharing, federated IDS benchmarking, and domain-specific LLMs for network security.

The abstract, and the depositor's additional notes after it when the source has a field for them.

• cs.CR (arxiv)
• cs.AI (arxiv)
• cs.LG (arxiv)

Declared keywords and taxonomy terms, each carrying its scheme.

• en

The language of the content as the language gate read it.

• http://creativecommons.org/licenses/by/4.0/

The licence document, as a URI where the gate resolved one.

• CC-BY-4.0 — assessed as OPEN by the harvester's licence gate. Conditions: attribution required. open, permissive

The verdict and the conditions, in words.

• open

The access condition the source declared. Not the licence.

• text/markdown

One value per form held — the original and the extracted text.

• 137025 bytes (extracted text)

Sizes in bytes, each saying which form it measures.

• 2026-07-01

When the resource was published. Not when it was collected.

• doi:10.1109/tse.1987.232894
• doi:10.1016/j.comnet.2022.109073
• doi:10.3390/fi15020062
• doi:10.1016/j.cose.2022.102675
• doi:10.1109/access.2022.3220622
• doi:10.1109/comst.2023.3280465
• doi:10.1109/access.2022.3216617
• doi:10.21227/qvr7-n418
• doi:10.1109/tvt.2023.3327275
• arXiv:1312.6114
• doi:10.1109/access.2020.3001350
• doi:10.1109/jiot.2020.3034621
• and 82 more, every one of them in the export

Works this one cites, when the source declares them as relations. What its text links to and its reference list cites is inferred, and stands under it apart.

• Retrieved from arXiv on 2026-10-09 in response to the search string “(all:"artificial intelligence" OR all:"machine learning" OR all:"generative AI" OR all:"deep learning" OR all:"reinforcement learning" OR all:"large language model") AND (all:"AI concepts" OR all:"types of AI" OR all:"AI fundamentals" OR all:"recognizing AI" OR all:"recognising AI" OR all:"general versus narrow AI" OR all:"narrow AI" OR all:"general AI" OR all:"machine intelligence" OR all:"AI strengths and weaknesses" OR all:"traditional software" OR all:"rule-based systems" OR all:"introduction to AI" OR all:"introduction to artificial intelligence" OR all:"artificial intelligence introduction" OR all:"AI primer" OR all:"foundations of artificial intelligence" OR all:"overview of AI" OR all:"understanding AI" OR all:"history of AI" OR all:"AI essentials" OR all:"AI terminology" OR all:"metaphors for AI" OR all:"AI fundamental concepts" OR all:"AI key concepts" OR all:"philosophy of AI" OR all:"critical AI literacy")”. arXiv served the resource and is not asserted to be its publisher or author.
• Text extracted from latexml-html to Markdown by arxiv-html; the original is retained unchanged beside it.

Where it was collected from, what was converted, and what container it came out of — the custody statements that would otherwise be mistaken for authorship.

• URI: tag:aim-pro.eu,2026:oer/f40027e54d10
• URI: https://arxiv.org/abs/2607.01305
• ARXIV: 2607.01305

This engine's identifier for the resource, the source URI, and any persistent identifier the source published.

• Generative AI and Federated Learning for Intrusion Detection Systems: A Survey

• en

The language of the content, as the language gate read it off the converted text. The language the source declared is kept separately.

• Intrusion Detection Systems (IDSs) are essential for monitoring network traffic and identifying malicious activities in modern cyber-physical, Internet of Things (IoT), enterprise, and distributed network environments. However, developing reliable IDS models remains challenging because attack behaviors evolve over time, realistic datasets are difficult to obtain, traffic records may be incomplete, attack classes are often imbalanced, and privacy constraints limit centralized data collection. Recent advances in generative artificial intelligence (AI) and Federated Learning (FL) provide new opportunities to address these limitations. Generative models can support anomaly detection, synthetic traffic generation, data augmentation, data imputation, adversarial traffic generation, and IDS alert explanation. FL enables distributed IDS training without directly sharing local network traffic, making it suitable for privacy-sensitive and geographically distributed environments. This survey provides a structured review of generative AI and FL techniques for IDS. We first summarize representative IDS research directions, including adversarial machine learning, anomaly-based detection, IoT-oriented IDS, explainable IDS, and benchmark datasets. We then categorize generative AI applications in IDS according to model families and task objectives, covering autoencoder-based models, Generative Adversarial Networks (GANs), diffusion models, and Large Language Models (LLMs). Finally, we review emerging studies that integrate generative AI with FL-based IDS and discuss open challenges, including synthetic data quality, realistic traffic generation, dual-use adversarial risks, non-IID client distributions, communication-efficient model sharing, federated IDS benchmarking, and domain-specific LLMs for network security.

The abstract, and the depositor's additional notes after it as a second LangString when the source has a field for them.

• cs.CR
• cs.AI
• cs.LG

• v1

• Jiefei Liu — author
• Abu Saleh Md Tayeen — author
• Pratyay Kumar — author
• Qixu Gong — author
• Wenbin Jiang — author
• Huiping Cao — author
• Satyajayant Misra — author
• Jayashree Harikumar — author

Role, entity and date per declared contribution. A role outside LOM's vocabulary is reported in the entry's description instead.

• URI: tag:aim-pro.eu,2026:oer/f40027e54d10/record

The identifier of this metadata record — the resource's own, with /record after it, because the record is a description of the resource and not the resource.

• AIM-PRO WP3 OER harvester (arXiv) — creator

Who generated this record and when — a statement about the record, not about the resource.

• LOMv1.0
• aimpro-oer-profile/1

LOMv1.0, and the profile this was built against.

• en

• text/markdown

One value per form held: the original as the source published it, and the Markdown this engine extracted.

• 137025

Bytes. The original's, because the resource is the file and not our conversion of it.

• https://arxiv.org/abs/2607.01305

Where the source serves it.

• narrative text

Only from a declaration that maps onto LOM's vocabulary. A file format is not a declaration.

• no — free to use

No: the licence gate refuses anything it cannot establish open reuse terms for, before the bytes are requested.

• yes — attribution required (CC-BY-4.0)

Yes unless the licence reserves nothing — attribution is a restriction. The conditions after the dash are the licence gate's reading; the export carries LOM's bare term.

• CC-BY-4.0 · http://creativecommons.org/licenses/by/4.0/. Conditions: adaptation permitted, attribution required.

The SPDX id, the licence URI and the conditions. LOM has no element for any of the three, so this is where they survive.