Federated Learning And Explainable Artificial Intelligence For Intrusion Detection In Iot Networks: A Review

Abstract

The Rapid Enlargement Of The Internet Of Things Has Turned Billions Of Weakly Protected Devices Into An Attractive Attack Surface, And Machine-learning Intrusion Detection Has Become The Default Defensive Answer. Three Difficulties, However, Continue To Limit Deployment: High-accuracy Deep Detectors Behave As Black Boxes, Conventional Training Pipelines Demand That Raw Traffic Be Pooled At A Central Site, And Constrained Edge Hardware Restricts Model Size. Two Research Directions Have Emerged In Response—federated Learning, Which Trains A Shared Detector While Traffic Remains On-device, And Explainable Artificial Intelligence, Which Converts Opaque Predictions Into Auditable Evidence. This Paper Reviews Thirty-two Studies Published Between 2009 And 2025 That Span Deep-learning Intrusion Detection, Federated Training Of Security Models, Post-hoc Explanation Techniques, And The Small But Growing Body Of Work That Unites All Of These Strands. We Organise The Literature Into A Common Taxonomy, Catalogue Seven Public Benchmark Datasets With An Emphasis On CIC-IoT2023, Tabulate Reported Detection Results Across Centralised, Federated And Explainable Configurations, And Trace How Hybrid Convolutional–recurrent Architectures Came To Dominate Recent Benchmarks. The Synthesis Shows That Federated Detectors Now Operate Within One Percentage Point Of Their Centralised Equivalents, That SHAP And LIME Are The De-facto Explanation Pair In Security Settings, And That Frameworks Combining Federated Optimisation With Dual Explainability Over Hybrid Deep Models Remain Rare. We Close By Identifying Open Problems—non-IID Client Data, Poisoning Of The Aggregation Step, Explanation Fidelity, And The Absence Of Standard Evaluation Protocol—that Define The Near-term Research Agenda.

Keywords