Towards Adapting Federated & Quantum Machine Learning for Network Intrusion Detection: A Survey

TL;DR

This work serves as an authoritative reference for researchers and practitioners seeking to enhance privacy, efficiency, and robustness of federated intrusion detection systems in increasingly complex network environments, while preparing for the quantum-enhanced cybersecurity landscape of tomorrow.

Abstract

This survey explores the integration of Federated Learning (FL) with Network Intrusion Detection Systems (NIDS), with particular emphasis on deep learning and quantum machine learning approaches. FL enables collaborative model training across distributed devices while preserving data privacy-a critical requirement in network security contexts where sensitive traffic data cannot be centralized. Our comprehensive analysis systematically examines the full spectrum of FL architectures, deployment strategies, communication protocols, and aggregation methods specifically tailored for intrusion detection. We provide an in-depth investigation of privacy-preserving techniques, model compression approaches, and attack-specific federated solutions for threats including DDoS, MITM, and botnet attacks. The survey further delivers a pioneering exploration of Quantum FL (QFL), discussing quantum feature encoding, quantum machine learning algorithms, and quantum-specific aggregation methods that promise exponential speedups for complex pattern recognition in network traffic. Through rigorous comparative analysis of classical and quantum approaches, identification of research gaps, and evaluation of real-world deployments, we outline a concrete roadmap for industrial adoption and future research directions. This work serves as an authoritative reference for researchers and practitioners seeking to enhance privacy, efficiency, and robustness of federated intrusion detection systems in increasingly complex network environments, while preparing for the quantum-enhanced cybersecurity landscape of tomorrow.

Figures (10)

• Figure 1: Overview of Federated Learning for Intrusion Detection: Illustration of the training phase, where local models are trained on distributed datasets at multiple devices without sharing raw data, and the testing phase, where the aggregated global model is evaluated for detecting network intrusions.
• Figure 2: (a) Federated Learning Model Aggregation: Shows how local model updates from multiple clients are combined on the server using aggregation methods to form a global model without sharing raw data. (b) FL Life Cycle
• Figure 3: Tree diagram illustrating the taxonomy of Federated Learning in IDS, highlighting major categories and their subcomponents.
• Figure 4: Types of FL: (a) Horizontal FL (HFL) with shared features but distinct samples; (b) Vertical FL (VFL) with shared samples but distinct features; (c) Federated Transfer Learning (FTL) with distinct samples and features.
• Figure 5: Communication Methods: (a) Centralized Federated Learning(Client-Server Architecture); (b) Decentralized Federated Learning (Peer-to-Peer); (c) Hierarchical Federated Learning (Multi-Tier Architecture); (d) Multi-Server Overlapping