Generative AI and Federated Learning for Intrusion Detection Systems: A Survey

Jul 16, 2026

Intrusion Detection Systems (IDSs) are vital for monitoring network traffic and detecting malicious behavior across cyber-physical, IoT, enterprise, and distributed environments, yet reliable modeling is hindered by evolving attacks, scarce or incomplete realistic datasets, class imbalance, and privacy limits that restrict centralized data collection. Generative AI and Federated Learning (FL) address these gaps by enabling anomaly detection, synthetic traffic generation, augmentation and imputation, adversarial traffic creation, and IDS alert explanations. The survey reviews representative IDS directions, organizes generative applications by model families and objectives, and studies integrations with FL while outlining key open challenges.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages21

Reading Time53 min

Introduction

Generative AI for IDS

Generative models and tasks

Federated Learning for IDS

Privacy-preserving distributed training

Integration of Generative AI and FL for IDS

Emerging studies and open challenges

Generative AI and Federated Learning for Intrusion Detection Systems: A Survey Jiefei Liu, Abu Saleh Md Tayeen, Pratyay Kumar, Qixu Gong, Wenbin Jiang, Huiping Cao, Satyajayant Misra, Jayashree Harikumar arXiv :2607 .0 1305v 1 [ cs .CR] 1 Jul 2026 Abstract—Intrusion Detection Systems (IDSs) are essential for monitoring network traffic and identifying malicious activities in modern cyber-physical, Internet of Things (IoT), enterprise, and distributed network environments. However, developing reliable IDS models remains challenging because attack behaviors evolve over time, realistic datasets are difficult to obtain, traffic records may be incomplete, attack classes are often imbalanced, and privacy constraints limit centralized data collection. Recent advances in generative artificial intelligence (AI) and Federated Learning (FL) provide new opportunities to address these limitations. Generative models can support anomaly detection, synthetic traffic generation, data augmentation, data imputation, adversarial traffic generation, and IDS alert explanation. FL enables distributed IDS training without directly sharing local network traffic, making it suitable for privacy-sensitive and geographically distributed environments. This survey provides a structured review of generative AI and FL techniques for IDS. We first summarize representative IDS research directions, including adversarial machine learning, anomaly-based detection, IoT-oriented IDS, explainable IDS, and benchmark datasets. We then categorize generative AI applications in IDS according to model families and task objectives, covering autoencoder-based models, Generative Adversarial Networks (GANs), diffusion models, and Large Language Models (LLMs). Finally, we review emerging studies that integrate generative AI with FL-based IDS and discuss open challenges, including synthetic data quality, realistic traffic generation, dual-use adversarial risks, non-IID client distributions, communication-efficient model sharing, federated IDS benchmarking, and domain-specific LLMs for network security. Index Terms—Intrusion Detection System, Generative AI, Federated Learning, Network Security, Synthetic Data Generation, Large Language Model. I. INTRODUCTION Modern computer networks support a wide range of critical services, including cloud computing, Internet of Things (IoT) platforms, industrial control systems, intelligent transportation, financial systems, healthcare infrastructure, and defense applications. As these systems become increasingly connected, they also become more exposed to cyber attacks that can disrupt services, compromise sensitive data, or damage physical infrastructure. Intrusion Detection Systems (IDSs) are therefore Jiefei Liu, Pratyay Kumar, Qixu Gong, Wenbin Jiang, Huiping Cao, and Satyajayant Misra are with the Department of Computer Science, New Mexico State University, Las Cruces, NM, USA (e-mail: {jiefei, pratyay, qixugong, wbjiang, hcao, [misra](misra}@nmsu.edu)[}](misra}@nmsu.edu)[@nmsu.edu](misra}@nmsu.edu)). Abu Saleh Md Tayeen is with the University of Hartford, CT, USA (e[mail:tayeen@hartford.edu](mail:tayeen@hartford.edu)). Jayashree Harikumar is with DEVCOM Analysis Center, WSMR, NM, USA (e-mail: [jayashree.harikumar.civ@army.mil](jayashree.harikumar.civ@army.mil)). an essential component of network security. An IDS monitors system activities or network traffic and identifies behaviors that may indicate unauthorized access, malware propagation, denial-of-service attacks, data exfiltration, or other malicious activities. Early IDS research established the foundation for monitoring security-relevant events and detecting abnormal system behaviors [1], [2] . Since then, IDS techniques have evolved from rule-based and signature-based detection toward data-driven approaches based on machine learning (ML) and deep learning (DL) . ML-based IDS models can learn complex traffic patterns from historical data and have shown strong

FAQs

Why are Intrusion Detection Systems (IDSs) difficult to build reliably in real-world networks?

IDS modeling is challenging because attack behaviors evolve over time, realistic datasets are hard to obtain, traffic records may be incomplete, attack classes are often imbalanced, and privacy constraints limit centralized data collection.

How can generative AI improve intrusion detection?

Generative models can support anomaly detection, synthetic traffic generation, data augmentation, data imputation, adversarial traffic generation, and explanation of IDS alerts.

What is the role of federated learning (FL) in IDS training?

FL enables distributed training without directly sharing local network traffic, making it suitable for privacy-sensitive and geographically distributed environments, while introducing challenges such as non-IID client data and communication-efficient model sharing.

Jul 16, 2026

Upload by Lucas Martin