{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,5]],"date-time":"2026-08-05T18:23:53Z","timestamp":1785954233426,"version":"3.56.0"},"reference-count":118,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"3","license":[{"start":{"date-parts":[[2022,9,1]],"date-time":"2022-09-01T00:00:00Z","timestamp":1661990400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2022,9,1]],"date-time":"2022-09-01T00:00:00Z","timestamp":1661990400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2022,9,1]],"date-time":"2022-09-01T00:00:00Z","timestamp":1661990400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"chair CyberCNI.fr"},{"name":"FEDER development fund of the Brittany region"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Netw. Serv. Manage."],"published-print":{"date-parts":[[2022,9]]},"DOI":"10.1109\/tnsm.2022.3177512","type":"journal-article","created":{"date-parts":[[2022,5,24]],"date-time":"2022-05-24T19:39:50Z","timestamp":1653421190000},"page":"2309-2332","source":"Crossref","is-referenced-by-count":83,"title":["The Evolution of Federated Learning-Based Intrusion Detection and Mitigation: A Survey"],"prefix":"10.1109","volume":"19","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0379-7946","authenticated-orcid":false,"given":"Leo","family":"Lavaur","sequence":"first","affiliation":[{"name":"IMT Atlantique and the Chair Cybersecurity of Critical Networked Infrastructures (Cyber CNI), Rennes, France"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5241-3809","authenticated-orcid":false,"given":"Marc-Oliver","family":"Pahl","sequence":"additional","affiliation":[{"name":"IMT Atlantique and the Chair Cybersecurity of Critical Networked Infrastructures (Cyber CNI), Rennes, France"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6908-719X","authenticated-orcid":false,"given":"Yann","family":"Busnel","sequence":"additional","affiliation":[{"name":"Department of Network Systems, Cybersecurity and Digital Law (SRCD), IMT Atlantique, IRISA, Rennes, France"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8403-515X","authenticated-orcid":false,"given":"Fabien","family":"Autrel","sequence":"additional","affiliation":[{"name":"Department of Network Systems, Cybersecurity and Digital Law (SRCD), IMT Atlantique, IRISA, Rennes, France"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2016.04.003"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2020.10.007"},{"key":"ref33","author":"agrawal","year":"2021","journal-title":"Federated learning for intrusion detection system concepts challenges and future directions"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/OJCOMS.2020.3044323"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/ICECCE52056.2021.9514222"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2021.3100755"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/2716260"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3407023.3407048"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2021.3119038"},{"key":"ref34","author":"campos","year":"2021","journal-title":"Evaluating federated learning for intrusion detection in Internet of Things Review and challenges"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3041641"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.102033"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/TVT.2021.3076780"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2020.3032544"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.011.2000286"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/BigDataSE50710.2020.00020"},{"key":"ref24","author":"al-marri","year":"2021","journal-title":"Federated mimic learning for privacy preserving intrusion detection"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN48605.2020.9207094"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1145\/3190508.3190538"},{"key":"ref26","first-page":"9","article-title":"Line-speed and scalable intrusion detection at the network edge via federated learning","author":"qin","year":"2020","journal-title":"Proc IFIP Netw Conf (Networking)"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.23919\/ITU-WT.2018.8598115"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/ICCC49849.2020.9238913"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/3450288"},{"key":"ref51","article-title":"Guidelines for performing systematic literature reviews in software engineering","author":"kitchenham","year":"2007"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2015.2402161"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"ref57","year":"2021","journal-title":"Kdd Cup 1999 Dataset"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2008.08.003"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.3390\/app9204396"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-019-0038-7"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/1273445.1273458"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2020.3040358"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2017.09.001"},{"key":"ref4","year":"2017","journal-title":"Exploring the opportunities and limitations of current Threat Intelligence Platforms"},{"key":"ref3","year":"2021","journal-title":"Incentives and Challenges for Information Sharing in the Context of Network and Information Security"},{"key":"ref6","year":"2014","journal-title":"Actionable Information for Security Incident Response"},{"key":"ref5","year":"2021","journal-title":"Directive (EU) 2016\/1148 of 6 July 2016 concerning measures for a high common level of security of network and information systems across the union"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.14722\/diss.2020.23003"},{"key":"ref49","author":"shen","year":"2021","journal-title":"From distributed machine learning to federated learning In the view of data privacy and security"},{"key":"ref7","first-page":"1273","article-title":"Communication-efficient learning of deep networks from decentralized data","volume":"54","author":"mcmahan","year":"2017","journal-title":"Proc 20th Int Conf Artif Intell Stat"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2019.06.019"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2009.06.008"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2019.01.023"},{"key":"ref48","author":"lyu","year":"2021","journal-title":"Threats to federated learning A survey"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3013541"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2015.2494502"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1287\/deca.2018.0387"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2019.2896380"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2799854"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1145\/2740908.2742839"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2003.1160055"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1186\/s12864-019-6413-7"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1007\/s11222-017-9746-6"},{"key":"ref76","author":"nguyen","year":"2021","journal-title":"FLGUARD Secure and Private Federated Learning"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP39728.2021.9413764"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00013"},{"key":"ref75","author":"hardy","year":"2021","journal-title":"Private federated learning on vertically partitioned data via entity resolution and additively homomorphic encryption"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2021.3056185"},{"key":"ref79","year":"2021","journal-title":"Conference portal—CORE"},{"key":"ref60","first-page":"41","article-title":"Creation of flow-based data sets for intrusion detection","volume":"16","author":"ring","year":"2017","journal-title":"J Inf Warfare"},{"key":"ref62","first-page":"3976","article-title":"UNSW-NB15: A comprehensive data set for network intrusion detection systems","volume":"8","author":"moustafa","year":"2015","journal-title":"Proc MilCIS"},{"key":"ref61","first-page":"361","article-title":"Flow-based benchmark data sets for intrusion detection","author":"ring","year":"2017","journal-title":"Proc Eur Conf Cyber Warfare Security (ECCWS)"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.5220\/0006639801080116"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/TMC.2018.2866249"},{"key":"ref65","author":"kone?n\u00fd","year":"2021","journal-title":"Federated learning Strategies for improving communication efficiency"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2919736"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3133982"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.23919\/APNOMS.2019.8892848"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.101589"},{"key":"ref69","author":"bishop","year":"2006","journal-title":"Pattern Recognition and Machine Learning"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2019.2910750"},{"key":"ref109","author":"fung","year":"2021","journal-title":"Mitigating sybils in federated learning poisoning"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2019.05.041"},{"key":"ref108","year":"2021","journal-title":"Ds2ostraffictraces—Kaggle"},{"key":"ref94","first-page":"188","author":"haines","year":"2001","journal-title":"1999 DARPA intrusion detection evaluation Design and procedures"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1155\/2016\/4731953"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.17487\/RFC8520"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/CNS.2014.6997492"},{"key":"ref106","first-page":"560","article-title":"signSGD: Compressed Optimisation for non-convex problems","volume":"80","author":"bernstein","year":"2018","journal-title":"Proc 35th Int Conf Mach Learn"},{"key":"ref91","author":"hideya","year":"2021","journal-title":"LAN-Security Monitoring Project"},{"key":"ref105","first-page":"9","article-title":"How transferable are features in deep neural networks?","volume":"2","author":"yosinski","year":"0","journal-title":"Proc 27th Int Conf Neural Inf Process Syst"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-45355-1_5"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2020.3034674"},{"key":"ref103","author":"goodfellow","year":"2016","journal-title":"Deep Learning"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-48910-X_16"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.3233\/IA-200075"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1109\/MIS.2020.2988604"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101824"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1016\/j.dss.2006.06.011"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1109\/ICFN.2010.103"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1109\/MPRV.2018.03367731"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2020.2973631"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3298981"},{"key":"ref11","author":"kairouz","year":"2022","journal-title":"Advances and Open Problems in Federated Learning"},{"key":"ref12","first-page":"756","article-title":"DÏoT: A federated self-learning anomaly detection system for IoT","author":"nguyen","year":"2019","journal-title":"Proc IEEE 39th Int Conf Distrib Comput Syst (ICDCS)"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3041793"},{"key":"ref14","first-page":"72","article-title":"All eyes on you: Distributed multi-dimensional IoT microservice anomaly detection","author":"pahl","year":"2018","journal-title":"Proc CNSM"},{"key":"ref15","first-page":"1","article-title":"Attack detection using federated learning in medical cyber-physical systems","author":"schneble","year":"2019","journal-title":"Proc ICCCN"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1016\/j.cosrev.2020.100279"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3368926.3369705"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2019.2904364"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1109\/ATNAC.2017.8215418"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/BigData47090.2019.9005507"},{"key":"ref81","author":"kone?n\u00fd","year":"2021","journal-title":"Federated optimization distributed machine learning for on-device intelligence"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2020.3023430"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1145\/1541880.1541882"},{"key":"ref19","first-page":"1","article-title":"Network anomaly detection using federated deep autoencoding Gaussian mixture model","author":"chen","year":"2019","journal-title":"Machine Learning for Networking"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-74320-0"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2022.3202029"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1109\/GCWkshps52748.2021.9682118"},{"key":"ref116","first-page":"301","article-title":"The limitations of federated learning in Sybil settings","author":"fung","year":"2020","journal-title":"Proc 23rd Int Symp Res Attacks Intrusions Defenses (RAID)"},{"key":"ref80","author":"bonawitz","year":"2021","journal-title":"Towards Federated Learning at Scale System Design"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1109\/LCOMM.2022.3140273"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.5220\/0006105602530262"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2022.01.006"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/ICC45855.2022.9839042"},{"key":"ref87","article-title":"MIMIC-III, a freely accessible critical care database","volume":"3","author":"johnson","year":"2016","journal-title":"Data Science Journal"},{"key":"ref88","first-page":"407","article-title":"Characterization of encrypted and VPN traffic using time-related features","author":"draper-gil","year":"2017","journal-title":"Proc 2nd Int Conf Inf Syst Security Privacy"}],"container-title":["IEEE Transactions on Network and Service Management"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/4275028\/9917435\/09780571.pdf?arnumber=9780571","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,10,14]],"date-time":"2022-10-14T17:34:39Z","timestamp":1665768879000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9780571\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,9]]},"references-count":118,"journal-issue":{"issue":"3"},"URL":"https:\/\/doi.org\/10.1109\/tnsm.2022.3177512","relation":{},"ISSN":["1932-4537","2373-7379"],"issn-type":[{"value":"1932-4537","type":"electronic"},{"value":"2373-7379","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,9]]}}}