This survey provides a structured review of generative AI and FL techniques for IDS and categorizes generative AI applications in IDS according to model families and task objectives, covering autoencoder-based models, Generative Adversarial Networks (GANs), diffusion models, and Large Language Models (LLMs).
Abstract
Intrusion Detection Systems (IDSs) are essential for monitoring network traffic and identifying malicious activities in modern cyber-physical, Internet of Things (IoT), enterprise, and distributed network environments. However, developing reliable IDS models remains challenging because attack behaviors evolve over time, realistic datasets are difficult to obtain, traffic records may be incomplete, attack classes are often imbalanced, and privacy constraints limit centralized data collection. Recent advances in generative artificial intelligence (AI) and Federated Learning (FL) provide new opportunities to address these limitations. Generative models can support anomaly detection, synthetic traffic generation, data augmentation, data imputation, adversarial traffic generation, and IDS alert explanation. FL enables distributed IDS training without directly sharing local network traffic, making it suitable for privacy-sensitive and geographically distributed environments. This survey provides a structured review of generative AI and FL techniques for IDS. We first summarize representative IDS research directions, including adversarial machine learning, anomaly-based detection, IoT-oriented IDS, explainable IDS, and benchmark datasets. We then categorize generative AI applications in IDS according to model families and task objectives, covering autoencoder-based models, Generative Adversarial Networks (GANs), diffusion models, and Large Language Models (LLMs). Finally, we review emerging studies that integrate generative AI with FL-based IDS and discuss open challenges, including synthetic data quality, realistic traffic generation, dual-use adversarial risks, non-IID client distributions, communication-efficient model sharing, federated IDS benchmarking, and domain-specific LLMs for network security.
A Kitchenham-informed systematic literature review methodology, this review synthesizes 186 studies published between 2018 and 2026 and develops a perturbation-realism taxonomy, ranging from feature-level manipulation to executable packet-level attacks, that clarifies when reported success corresponds to deployable risk.
Cloud computing has emerged as an important core to the contemporary digital services, facilitating scalable, on demand provisioning of resources across a variety of application fields. Nevertheless, this multi-tenant and dynamic environment of clouds and the amplified attack surface make the detection of intrusions through reliable methods a consistent issue that cloud security systems struggle with. The proposed work is a Generative Adversarial Network (GAN)-based hardening framework of cloud intrusion detection systems, targeting better resilience to changing and low-rate cyberattacks. The methodology combines a conditional generator which is used to generate realistic cloud-specific attack traffic, a discriminator used to refine the adversarial traffic, as well as a co-trained intrusion classifier trained on both clean and synthetic data in a closed-loop way. The feature-aware regularization is introduced to maintain the statistical consistency of network traffic, and optimize the attack diversity. The proposed approach is proved to yield better results in comparison with signature-based, machine learning, deep learning, and adversarial ML-based IDS models by experimental assessment. Significant gains in the accuracy of identifying, the ability to recall, stability, and minimizing errors are also noticed with quantifiable increases observed in all evaluation measures. These findings represent the usefulness of adversarial data-driven learning to develop robust, adaptive, and future-ready cloud intrusion detection systems.
T. Divya, Sheik Saidhbi, S. Umarani et al.· 2026 International Conferenc...· 0 citations
In Cloud Computing, Artificial Intelligence (AI)-driven intrusion detection focuses on identifying anomalies, unauthorized access, and malicious activities across dynamic cloud environments. Besides, the Intrusion Detection System (IDS) is also crucial in strengthening the overall cybersecurity defenses, thereby assisting institutions or organizations in detecting malicious activities to improve their security and preserve sensitive data. Conventional security approaches often fail to handle constantly evolving attack patterns in the cloud. Prevailing signature-based schemes do not have the ability to identify unknown threats, thereby generating false alarms. Besides, they require large labelled databases for adapting to changing workloads. This survey examines several intrusion detection approaches in the Cloud Computing Environment. The methods are categorized as Machine Learning (ML), Federated Learning (FL), Deep Learning (DL), and Big Databased models. Further, to provide a comprehensive assessment, 25 research papers on intrusion detection are collected and reviewed. Further, a general outline for detecting intrusions is explained, and then the literature review of each technique with its pros and cons is elaborated. The research gaps that are encountered by the existing techniques are also presented. In addition, this survey also highlights the analysis on the basis of various factors, like publication year, methodology, tools, indicators, and databases utilized.
P. Raja, J. Sathiamoorthy· 2026 4th International Confe...· 0 citations
Modern vehicular networks face an expanding attack surface across internal Electronic Control Units (ECUs) and external Vehicle-to-Everything (V2X) communication. Federated Learning (FL) has emerged as a decentralized paradigm to deploy Intrusion Detection Systems (IDS) without compromising data privacy. However, the vehicular FL-IDS literature suffers from fragmented methodologies and unrealistic experimental setups. This paper presents a Systematization of Knowledge (SoK) that unifies the taxonomy of vehicular attack surfaces, evaluates FL topologies, and maps adversarial threats such as poisoning and inference attacks. By auditing over 60 publications, we identify recurring pitfalls: artificial IID data splits, reliance on trivial benchmarks, weak adversarial evaluation, and omission of real-time CAN constraints. Finally, we define a forward-looking research agenda and outline minimum benchmarking requirements necessary to transition vehicular FL-IDS from optimistic simulations to secure, real-world deployment.
Yahya Shahsavari, Reza Nourmohammadi, Sara Rouhani et al.· 0 citations
AI-driven cyberattacks represent major challenges to detect by classic security frameworks, which makes it important to employ intelligent and autonomous mechanisms. In this paper, we present a data-driven analysis of network attack detection and reduction using machine learning, deep learning, and an Autonomous Defense Agent (ADA) for real-time threat detection and response. Experiments are done on two benchmark datasets CIC-IoT 2023 and UNSW-NB15 datasets, representing network intrusion scenarios. We addressed the imbalance in the dataset CIC-IoT 2023 with a 1:41 benign-to-attack skewed ratio by applying the Synthetic Minority Over-sampling Technique (SMOTE) to the training set. For classification progress, we used four classical ML classifiers (Decision Tree, Random Forest, XGBoost, and KNN), and also an LSTM model. Furthermore, we designed an Autonomous Defense Agent (ADA) for real-time intrusion detection. The highest F1 achieved for Random Forest is 99.39% on CIC-IoT 2023 and 88.67% on UNSW-NB15. For XGBoost, the same accuracy was achieved with 12 times faster training speed. This makes it the preferred ADA backbone. LSTM outperforms on structured IoT traffic with F1=98.82%, but on the other hand, fails on heterogeneous traffic with F1=43.29%. This shows how data temporal characteristics affect model selection. The ADA achieves 99.94% precision on CIC-IoT 2023 with sub-1ms average response latency. The results provide a principled model selection criterion that prefers the classical ML methods for heterogeneous traffic and LSTM for temporally structured IoT traffic, and also provides an ADA design to validate real benchmark datasets.
Marwah Yaseen· Al-Noor Journal of Engineeri...· 0 citations
Background
The fast rate at which cyber threats are evolving brings a lot of challenges to the conventional signature-based intrusion
detection systems (IDS) that do not always identify new or zero-day attacks. The paper introduces an AI-based, adaptable
Network Intrusion Detection System (NIDS) which, using Generative Adversarial Networks (GANs) with XGBoost, will
enhance the detection of known and novel cyberattacks.
Objective
The suggested framework is designed to process network traffic data by preprocessing network traffic data, realistically
simulates the samples of synthetic attacks based on a feature-driven GAN, and uses XGBoost as a powerful feature selection
and classification tool. The system decreases the false positives and increases the detection of rare and previously unseen attacks
by managing class imbalance.
Results
Large-scale experiments, using benchmark network intrusion datasets, reveal the proposed approach to be much better than the
conventional machine learning and deep learning-based IDS models with regards to accuracy, precision, recall and F1-score.
In addition, the framework facilitates dynamic learning in changing patterns of network traffic to allow real-time monitoring in
dynamic environments.
Conclusion
Data augmentation using GAN and explainable XGBoost classification is a scalable, interpretable, and practical intelligent
network security solution. This research contributes to the work on the creation of active, AI-based intrusion detection systems
that can react to cybersecurity threats that change rapidly.
R. Jegan, P. R, Sukisivam B et al.· International Journal of Dru...· 0 citations