Trustworthy Federated Intrusion Detection for the Future Internet: A Critical Review and Evaluation Framework

1. Introduction

The security boundary of the Future Internet is difficult to draw. A single service can span constrained sensors, home or industrial gateways, virtualized edge functions, cloud APIs, mobile clients, and machine-learning components. In that setting, network location says little about whether a device, user, flow, or model update should be trusted. Security decisions must be made repeatedly and with incomplete information, often on infrastructure that cannot send all of its raw telemetry to a central site.

Intrusion detection sits directly inside this tension. It is one of the few security functions that must turn distributed and noisy telemetry into an operational decision quickly enough to matter. Yet a large part of the literature still evaluates intrusion-detection system (IDS) models on random train/test splits drawn from a single benchmark. Those experiments are useful for algorithm development, but they say less about what happens when the device changes, an attack family is absent from training, client data become strongly non-independent and identically distributed (non-IID), or an attacker controls part of the learning process. In Internet of Things (IoT) environments, those are not unusual edge cases; they are normal deployment conditions.

Federated learning (FL) addresses a second problem: organizations and devices may be unable or unwilling to centralize raw telemetry. FedAvg established the basic paradigm of communication-efficient collaborative learning [1], while FedProx, SCAFFOLD, and adaptive federated optimization address statistical and systems heterogeneity [2,3,4]. Yet FL shifts rather than removes risk. Model updates can leak information [5,6], malicious clients can poison or backdoor the global model [7], heterogeneous local distributions can destabilize convergence, and secure aggregation can protect update confidentiality without guaranteeing update correctness [8].

For that reason, we treat trustworthy intrusion detection as a multi-objective engineering problem. Accuracy remains important, but it is only one part of the evidence. A convincing system also has to show how it behaves under poisoning and backdoor attacks, how well it transfers to unseen devices or traffic distributions, what privacy protection costs, whether its explanations remain stable, and whether the full pipeline fits the latency, memory, and communication budget of the intended edge platform. A result can be strong on one axis and still be operationally weak on another.

This paper therefore does four things. It first maps recent Future Internet work against six methodological dimensions so that gaps can be discussed quantitatively rather than impressionistically. It then separates two failure modes that are often conflated—adversarial robustness and non-adversarial generalization—and examines how rarely they are tested together. Third, it connects datasets, threat models, privacy controls, explanations, and deployment constraints through a common evidence chain. Finally, it turns that synthesis into a concrete experimental design for a federated IoT IDS that could be evaluated reproducibly across multiple datasets and edge conditions.

2. Research Context: Trustworthy Federated IDS for the Future Internet

Future Internet security research has progressively moved from perimeter defence toward distributed trust management across Internet of Things (IoT), Industrial IoT (IIoT), edge, fog, and cloud environments. Foundational IoT security surveys emphasize persistent problems of device heterogeneity, constrained resources, privacy, and trust [9,10,11], while network intrusion-detection research has long warned that high closed-world accuracy does not necessarily translate into operational generalization [12,13]. Adversarial machine learning further complicates deployment by showing that learned decision boundaries can be deliberately manipulated [14].

Federated learning (FL) provides a natural mechanism for collaborative model training without routine raw-data centralization, but it introduces its own attack and privacy surface. Broad FL surveys identify non-IID data, communication constraints, privacy leakage, malicious clients, and systems heterogeneity as recurring obstacles [15,16,17,18]. Within Future Internet, recent studies have explored blockchain-assisted FL [19], device-disjoint and open-set evaluation [20], FL-based IIoT intrusion detection [21], explainable intrusion detection [22], Transformer-based IoT IDS models [23], transfer learning [24], generative and adversarial architectures [25,26], distributed explainable artificial intelligence (XAI) [27], cross-dataset robustness [28], heterogeneous IoT–fog–cloud federation [29], hardware-validated secure FL [30], stability-centric intrusion detection [31], differential-privacy trade-offs [32], adaptive robust aggregation [33], deployment-focused lightweight IDS evidence [34], and attention-based federated intrusion detection [35]. Taken together, these studies motivate an evaluation framework that treats robustness, generalization, privacy, explainability, and deployment evidence as complementary rather than interchangeable.

The relationship between the research themes and the evidence expected from the proposed evaluation is summarized in Table 1.

3. Review Method and Evidence Coding Framework

3.1. Review Design and Literature Identification

This study is a critical structured review and evidence synthesis; it is not presented as a systematic review or a scoping review, and no PRISMA or PRISMA-ScR claim is made. The corpus was assembled through targeted searches of the Future Internet website and reference chaining from included studies, with literature considered up to 8 October 2026. Search concepts combined federated learning, intrusion detection, IoT/IIoT, robustness or poisoning, generalization or open-set evaluation, explainability, privacy, zero trust, and edge deployment. Foundational methods and authoritative standards were added when they were directly necessary to interpret the recent literature.

Sources were eligible when they were peer-reviewed research/review articles or authoritative standards with direct methodological relevance to at least one coded dimension. Duplicate records and papers with only tangential application relevance were excluded. The corpus deliberately emphasizes recent Future Internet publications because the review asks what evidence is currently expected for a strong contribution in this journal; it should therefore not be interpreted as a field-wide bibliometric sample. Seven works that were present in the original coded corpus but missing from the supplied reference list have been added to the bibliography, including recent surveys of federated cybersecurity and two applied intrusion-detection studies [50,51,52,53,54,55,56]. The article-level DOI records of two 2025 Future Internet articles have also been corrected in the supplementary source matrix. No unpublished primary data or new experimental results were generated. All numerical synthesis values are derived from source-level coding, with provenance retained in Supplementary File S1.

3.2. Six-Dimensional Coding Scheme

Each evidence record is coded from 0 to 5 on six dimensions. A score of 0 means the dimension is absent or not evaluated; 1 indicates peripheral relevance; 2 indicates limited treatment; 3 indicates explicit moderate evidence; 4 indicates strong evidence; and 5 indicates that the dimension is a central, rigorously evaluated contribution. The coding is intentionally methodological. It does not rate scientific prestige, citation impact, or model accuracy. Scores were assigned within the source submission’s review protocol and were not independently double-coded; no inter-rater reliability coefficient or score validation against external ground truth is claimed. The rubric, individual integers, bibliographic links, and calculations are exposed for author reappraisal and reader scrutiny.

The operational coding rules are summarized in Table 2.

3.3. Composite Evidence Score

A weighted composite score is used only as a synthesis device: 20 × (0.20 FL + 0.20 robustness + 0.20 generalization + 0.10 explainability + 0.15 deployment realism + 0.15 reproducibility). Robustness and generalization receive high weight because a trustworthy IDS must remain useful under both adversarial and non-adversarial distribution change. Explainability receives lower weight because it is not mandatory for every technical paper, although it becomes critical when predictions drive automated policy decisions. The workbook preserves all component scores so that readers can reject the weighting, inspect the raw coding, and compare alternative weighting choices. Composite scores are descriptive indicators of methodological coverage, not measurements of scientific quality or model performance. Supplementary File S1 contains five weight scenarios (baseline, equal, security-focused, operations-focused, and reproducibility-focused) to show which conclusions depend on the value judgments embedded in the index. A change in rank under alternative weighting is a diagnostic observation, not an inferential finding.

3.4. Descriptive Synthesis and Software

The analysis is descriptive. Means, medians, coverage proportions, and cross-tabulations summarize the coded evidence. Because the six evidence dimensions are ordinal 0–5 ratings, pairwise co-coverage is summarized using Spearman rank correlations rather than Pearson correlations. Figure 4 reports nonparametric bootstrap 95% confidence intervals using 3000 resamples with a fixed random seed. These intervals are exploratory and are not used for confirmatory hypothesis testing. Figure preparation and workbook processing were performed with Python 3.13.5, pandas 2.2.3, NumPy 2.3.5, SciPy 1.17.0, Matplotlib 3.10.8, and openpyxl 3.1.5. The formula-linked Excel companion distinguishes author-coded raw study, dataset, and prioritization inputs (RAW and SOURCE sheets) from derived evidence summaries, tied-score Spearman coefficients, fixed-seed bootstrap intervals, sensitivity scenarios, and reconciliation checks (ANALYSIS, CONTROL, and AUDIT sheets). Workbook “raw” data are bibliographic and researcher-coded evidence, not packets, original network flows, model predictions, or measurements from newly run experiments. The fixed-seed bootstrap archives 3000 replicate correlations for each of 15 dimension pairs; the figure-generation script and machine-readable exports are included in Supplementary Files S2 and S3. If author-coded values change, stored bootstrap resamples must be recomputed and figure files regenerated using S3; the plotting script does not overwrite the workbook resample archive.

3.5. Generative AI Assistance and Author Responsibility

During preparation of this review, OpenAI ChatGPT (accessed October 2026) was used to assist with manuscript structuring, language refinement, figure preparation, and spreadsheet organization. The tool was not treated as a bibliographic or evidentiary source. The authors remain responsible for verification of the cited literature, interpretation of the coded evidence, numerical accuracy, and the final manuscript.

4. Quantitative Evidence Synthesis

4.1. Corpus Composition and Temporal Signal

The coded corpus contains 37 records, including 20 articles from Future Internet and 22 records published in 2025–2026. Because the corpus is purposive, differences among source subsets are descriptive and do not estimate changes in the overall literature. The recent emphasis is intentional: the purpose of the synthesis is to understand what a strong paper in this area now needs to demonstrate, not to reconstruct the entire history of intrusion detection. Figure 1 shows that the newer literature covers more methodological ground than the earlier work, but the improvement is uneven. Deployment and generalization become much more visible in 2026, whereas robustness and explainability remain concentrated in a relatively small subset of studies.

4.2. Maturity Imbalance Across Trustworthiness Dimensions

Figure 2 is intended to make the score distributions easy to read at a glance. The most important pattern is that federated-learning relevance is consistently high, reproducibility is moderate, and robustness, generalization, explainability, and deployment realism remain both lower and more uneven. The horizontal layout makes the spread clearer, while the mean and median annotations reduce the need to infer the central tendency visually. Taken together, the figure supports a cautious interpretation of broad claims such as “trustworthy” or “deployment-ready”.

Coverage statistics for the six evidence dimensions are reported in Table 3.

This does not mean that every paper should attempt to solve every problem. Specialized contributions are necessary, and a narrow paper can be methodologically excellent. The problem arises when broad language—such as secure, trustworthy, robust, or deployable—is used to describe evidence that was collected along only one dimension. The matrix is intended to make that mismatch visible.

4.3. Robustness–Generalization Frontier

Robustness and generalization deserve separate treatment because they describe different kinds of failure. Robustness asks whether an adversary can deliberately distort the learner or its predictions. Generalization asks whether performance survives ordinary changes in device population, traffic mix, attack family, or site. Figure 3 shows how uncommon it is for both questions to be tested strongly in the same study. The upper-right region is sparsely populated, which is precisely where a convincing Future Internet security system should aim to operate.

4.4. Correlation and Co-Maturity

Figure 4 uses a forest-plot layout to show rank-based co-coverage among the ordinal evidence dimensions. The strongest positive associations occur among generalization, reproducibility, deployment realism, and robustness, but several intervals remain wide because the coded corpus is modest. The estimates are therefore used to describe study-design patterns rather than to support causal or confirmatory inference.

5. Thematic Evolution of Future Internet Cybersecurity Research

5.1. From accuracy-Centric IDS Toward Trustworthy Distributed Intelligence

Recent Future Internet work reveals a clear sequence of maturation. Earlier IDS papers frequently focused on architecture choice and benchmark performance. Current studies increasingly introduce one or more of five additional requirements: cross-dataset or external-scenario stability, resource constraints, secure federated exchange, robust aggregation, and explainability. This does not mean high accuracy has become unimportant. Rather, accuracy is becoming a necessary but insufficient component of evidence.

Figure 5. Change in selected thematic coding from 2025 to 2026. A record may contribute to more than one theme, so the counts are not mutually exclusive. XAI denotes explainable artificial intelligence.

Figure 5. Change in selected thematic coding from 2025 to 2026. A record may contribute to more than one theme, so the counts are not mutually exclusive. XAI denotes explainable artificial intelligence.

5.2. Evidence from Recent 2026 Papers

Selected recent Future Internet studies are compared in Table 4.

Three examples illustrate why this shift matters. The hardware-validated secure FL study on ESP32 devices measured cipher-level latency, throughput, energy, and memory while retaining an intrusion-detection evaluation [30]; this provides stronger deployment evidence than a purely simulated “lightweight” claim. The stability-centric IoT-23 study explicitly separates internal validation from unseen-scenario performance [31], making distribution shift a first-class result. The controlled differential-privacy comparison evaluates both formal privacy accounting and empirical leakage attacks across repeated seeds [32], avoiding the common assumption that adding DP or decentralization automatically proves practical privacy.

6. Dataset Strategy, Leakage Risk, and External Validity

6.1. Why Dataset Choice Is Part of the Security Method

Dataset choice is not a neutral implementation detail. It determines attack taxonomy, device diversity, temporal structure, protocol coverage, class imbalance, and the kinds of leakage that can occur during splitting. CICIoT2023 is valuable for contemporary, large-scale IoT attacks [36]; Edge-IIoTset was explicitly designed to support centralized and federated evaluation [37]; TON_IoT provides heterogeneous telemetry sources [38]; N-BaIoT offers canonical botnet captures [39]; CICIDS2018 remains widely used for intrusion-traffic characterization [40]; and UNSW-NB15 remains useful as a general network-security benchmark [41]. No single dataset, however, demonstrates broad operational validity.

Figure 6. Dataset comparison across three practical properties: (A) weighted overall suitability; (B) average risk burden from leakage and class imbalance; and (C) external-validity potential. Scores are author-coded design indicators from the accompanying workbook.

Figure 6. Dataset comparison across three practical properties: (A) weighted overall suitability; (B) average risk burden from leakage and class imbalance; and (C) external-validity potential. Scores are author-coded design indicators from the accompanying workbook.

A strong empirical paper should therefore use a portfolio strategy. One dataset can be used for controlled FL ablation; a second can test cross-dataset transfer; a third can provide an external or open-set challenge. The evaluation should prevent exact or near-duplicate flows from appearing on both sides of the train/test boundary and should preserve device or time grouping wherever the source data permit it. If device IDs are unavailable or unreliable, the limitation should be stated explicitly rather than silently relying on a random split.

6.2. Recommended Split Governance

The split-governance design is summarized in Table 5.

7. Federated Learning Under Heterogeneity

7.1. Baseline Federated Formulation

FedAvg remains the essential baseline because it provides the reference against which more sophisticated methods must demonstrate value [1]. In a security setting, however, the client objective distributions are rarely IID. Different gateways observe different devices, protocols, attack prevalence, background traffic, and time periods. A global model may therefore be dominated by high-volume clients or oscillate between incompatible local optima. FedProx introduces a proximal term to stabilize local updates under heterogeneity [2], while SCAFFOLD corrects client drift with control variates [3]. Adaptive federated optimization can further change server-side update dynamics [4].

7.2. What Should Be Reported

A publishable FL evaluation should report more than final global accuracy. At minimum, it should include the client-partition rule, number of clients, clients sampled per round, local epochs, optimizer, learning rate, batch size, aggregation weights, communication rounds, convergence trajectory, repeated random seeds, and per-client performance distribution. Client fairness matters because an average global metric can hide severe under-performance on rare or resource-poor clients. The standard deviation and lower-tail client F1 should therefore be reported together with the global macro-F1.

The principal FL design factors are summarized in Table 6.

8. Robustness: Poisoning, Backdoors, Byzantine Clients, and Adaptive Defense

8.1. Threat Model

Federated IDS is vulnerable to adversaries that control one or more clients or manipulate their local data. Untargeted poisoning attempts to degrade global utility; targeted backdoors preserve clean accuracy while inducing a chosen misclassification under a trigger; Byzantine clients may send arbitrary updates. Secure aggregation does not solve these problems because an encrypted malicious update is still malicious. This distinction is fundamental: confidentiality of updates and integrity of updates are separate security objectives [7,8,14,42,43].

Figure 7. Unadjusted and deployment-adjusted evidence scores for the leading records. The connecting segment shows the sensitivity of each record to explicit weighting of deployment realism.

Figure 7. Unadjusted and deployment-adjusted evidence scores for the leading records. The connecting segment shows the sensitivity of each record to explicit weighting of deployment realism.

8.2. Evaluation Design

Robustness should be tested across a malicious-client fraction rather than at a single point. Suggested fractions are 0%, 5%, 10%, 20%, and 30%, subject to the assumptions of the aggregation method. For backdoors, the primary metric is attack success rate (ASR) on triggered samples alongside clean macro-F1; for untargeted poisoning, use relative clean-performance degradation, convergence delay, and worst-client degradation. Robust aggregation should be compared against FedAvg under both attack-free and attacked conditions because aggressive defenses can reduce clean utility.

The ranking in Figure 7 should not be read as a league table of papers. Its purpose is narrower: to show how conclusions change when deployment evidence is given explicit weight. Several studies remain strong after the adjustment because they report hardware, latency, memory, or systems-level evidence; others fall because their methodological breadth is mostly conceptual. This sensitivity analysis is useful when the paper’s target claim is practical deployment rather than algorithmic novelty alone.

9. Privacy: From Data Locality to Empirical Leakage Resistance

9.1. Data Locality Is Not a Complete Privacy Argument

FL prevents routine centralization of raw training data, but gradients and model deltas can encode sensitive information. Gradient inversion and related reconstruction attacks show that update sharing may expose aspects of local examples [5,6]. Secure aggregation reduces the server’s visibility into individual updates [8], while differential privacy bounds the influence of protected units under a stated privacy accountant [44,45]. These mechanisms address different adversaries and should not be conflated.

9.2. Recommended Privacy Evaluation

A strong privacy section should include three layers: formal mechanism description, empirical leakage testing, and utility/resource cost. If differential privacy is used, report clipping norm, noise multiplier, sampling rate, number of rounds, accountant type, protected unit, and . Then independently run membership-inference or gradient-inversion tests. Finally, quantify the effect on macro-F1, convergence, communication, and latency. The controlled Future Internet comparison published in September 2026 is an important methodological signal because it explicitly separates formal privacy accounting from empirical leakage behavior [32].

The privacy-control comparison is summarized in Table 7.

10. Explainability as a Security-Control Property

10.1. Beyond Decorative SHAP Plots

LIME and SHAP are widely used model-agnostic explanation methods [46,47]. In intrusion detection, however, explanation quality should be evaluated as part of the control loop. An analyst needs to know whether the explanation is faithful to the classifier, stable under small benign perturbations, consistent across federated clients, available within operational latency, and understandable in network-security terms. A feature-importance bar chart alone does not establish these properties.

The 2026 Future Internet survey on XAI in federated/distributed IoT identifies a resource–interpretability gap: computationally expensive explanation techniques are often applied to constrained edge settings without explicit latency, memory, energy, or privacy accounting [27]. This finding supports a two-tier explanation design. Lightweight local explanations or rule summaries can be generated at the edge for immediate triage, while more expensive global or counterfactual analyses can run asynchronously at an edge server or SOC backend.

10.2. Proposed XAI Metrics

The proposed XAI evidence metrics are summarized in Table 8.

11. Zero-Trust Integration: Turning Detection into Action

Zero Trust Architecture (ZTA) rejects implicit trust based on network location and instead emphasizes continuous, resource-centric decisions informed by identity, device state, policy, and context [48,49]. An IDS should therefore not be treated as an autonomous binary gate. Its risk score and explanation should be one signal to a policy decision point. High-confidence malicious behavior may trigger immediate isolation; medium-confidence anomalies may trigger step-up authentication, rate limits, or restricted service access; uncertain open-set behavior may be routed to observation/quarantine rather than hard denial.

The link between IDS evidence and zero-trust action is illustrated in Table 9.

12. Edge Deployment and Resource Accounting

Deployment realism is one of the weakest dimensions in the coded evidence base, despite being central to IoT. “Lightweight” should therefore be an empirical adjective. Model size, parameter count, FLOPs, runtime memory, inference latency, update-encryption overhead, communication volume, energy, and thermal/availability behavior should be measured on a target device or a clearly justified proxy. The 2026 hardware-validated Future Internet study provides a concrete precedent: on ESP32-class devices, cipher choice produced orders-of-magnitude differences in update-processing latency and energy, while secure FL still maintained model convergence [30].

The deployability review of 78 IoT–edge IDS studies similarly found that target-device latency, runtime memory, measured energy, zero-day testing, time-aware splitting, and device-shift validation were inconsistently reported [34]. These findings reinforce the need for an explicit deployment evidence table in any manuscript claiming practical suitability.

The deployment measurements required for edge validation are listed in Table 10.

13. Integrated ZT-FXIDS Reference Architecture

13.1. Layered Architecture

The proposed Zero-Trust Federated Explainable Intrusion Detection System (ZT-FXIDS) is designed as six interacting layers: (1) telemetry collection and local feature engineering; (2) client-side IDS learning; (3) federated coordination; (4) privacy and update-integrity protection; (5) explainability and security analytics; and (6) zero-trust policy enforcement. The architecture intentionally separates the data plane, learning plane, explanation plane, and policy plane so that failures can be diagnosed independently.

13.2. Threat–Control–Evidence Chain

The end-to-end threat–control–evidence chain is summarized in Table 11.

This chain prevents vague security claims. Every claimed property must identify an adversary or failure condition, implement a control, define a measurable outcome, and state an acceptance criterion. For example, “robust federated learning” is not established by using Krum; it is established by showing that Krum or another defense reduces attack success under a declared malicious-client model while preserving acceptable clean utility and client fairness.

14. Proposed Empirical Study Design

14.1. Research Questions and Hypotheses

The empirical research questions and hypotheses are stated in Table 12.

14.2. Experimental Factors

The experimental factor design is summarized in Table 13.

14.3. Statistical Analysis Plan

Each headline configuration should be repeated with at least five random seeds when computationally feasible. Report mean ± standard deviation and 95% confidence intervals. For paired comparisons across the same seeds and partitions, use a paired test after checking distributional assumptions; otherwise use a non-parametric alternative such as Wilcoxon signed-rank. When comparing multiple models across multiple datasets/splits, control the family-wise or false-discovery rate and report effect sizes rather than relying only on p-values. For classification, use macro-F1, MCC and AUPRC as primary metrics; accuracy is secondary in imbalanced settings. Calibration should be evaluated with expected calibration error or Brier score when confidence drives zero-trust policy actions.

The statistical reporting plan is summarized in Table 14.

15. Detailed Research-Gap Prioritization

Figure 8. Research-gap prioritization. Panel A ranks the weighted priority score. Panel B shows the five criterion profiles; line-end numbers correspond to the rank order in panel A.

Figure 8. Research-gap prioritization. Panel A ranks the weighted priority score. Panel B shows the five criterion profiles; line-end numbers correspond to the rank order in panel A.

The resulting research-gap priorities are summarized in Table 15.

15.1. Highest-Priority Gap: Integrated External Validity and Adversarial Robustness

The strongest opportunity is to evaluate generalization and adversarial robustness together. Most studies that test poisoning do so on the same benchmark distribution used for training, while many generalization studies do not include malicious clients. A realistic Future Internet system faces both simultaneously: new devices and attacks arrive while some participating clients may be compromised. The proposed study should therefore include at least one matrix in which distribution shift is crossed with malicious-client fraction. This produces a more demanding and more original result than evaluating each factor separately.

15.2. Privacy–Robustness Interaction

Differential privacy noise and Byzantine behavior can interact because both perturb model updates. A defense tuned to detect outlying malicious updates may misclassify privacy-noised honest updates; conversely, privacy noise can reduce the separability of malicious and benign update statistics. The 2026 robust-aggregation work in Future Internet explicitly targets this coupled setting [33]. A useful extension is to report the three-way trade-off among privacy budget, attack success, and clean utility.

15.3. Explainability Under Federation and Shift

Explanations can drift even when predictive accuracy remains stable. If different clients learn different feature shortcuts, a global model may produce unstable attributions across environments. This is operationally important because analysts may interpret inconsistent explanations as inconsistent threats. The proposed work should quantify cross-client explanation similarity for matched attack categories and evaluate how it changes under open-set or device-disjoint testing.

15.4. Deployment Evidence as a Differentiator

Hardware evidence is still uncommon enough to differentiate a submission. A modest but carefully reported edge experiment can be more informative than another small gain on a benchmark: reviewers can see the actual latency, memory, communication, and energy implications of the proposed security controls. The hardware does not need to be exotic. What matters is that the platform is specified, the measurement procedure is repeatable, and the resource cost is reported alongside the security benefit.

16. Expected Results and Interpretation Framework

Because this manuscript does not fabricate experimental results, this section specifies how real results should be interpreted once experiments are conducted. The central principle is that a result is meaningful only relative to the threat model and evaluation regime. A 2-point macro-F1 reduction under a strict device-disjoint split may be a stronger scientific outcome than a 0.2-point gain under a random split if the former demonstrates external validity. Similarly, a robust aggregator that loses 1 point of clean macro-F1 but reduces backdoor ASR from 80% to 10% may be preferable in a high-risk deployment, while the same trade-off may be unacceptable in a low-risk, latency-sensitive environment.

Representative result patterns and their interpretation are summarized in Table 16.

17. Threats to Validity and Limitations

The evidence synthesis has limitations. It is structured and traceable but is not an exhaustive systematic or scoping review and therefore does not claim PRISMA coverage. The targeted search design can miss relevant papers outside the selected concepts and citation chains. The six-dimensional scores are author-coded and therefore subject to judgment; no inter-rater reliability is claimed. The workbook preserves the coding rules, record-level scores, and source URLs to support audit and alternative weighting. The corpus intentionally over-represents recent Future Internet publications because journal alignment is an explicit goal, so the distribution should not be interpreted as a field-wide bibliometric sample. The rank correlations are exploratory descriptions of co-coverage in a small ordinal dataset and should not be interpreted causally.

The proposed empirical framework also has practical limitations. Cross-dataset transfer can be confounded by incompatible feature schemas; open-set evaluation depends on a defensible definition of “unseen”; differential-privacy comparisons are sensitive to the protected unit and accountant; malicious-client simulations may not capture adaptive real attackers; and energy measurements vary by hardware and instrumentation. These limitations should be reported as design constraints rather than hidden by aggregate performance metrics.

18. Conclusions

The literature is moving in the right direction, but the evidence is still uneven. Federated learning is now a well-established mechanism for collaborative IDS training, whereas the harder questions—what happens under malicious clients, unfamiliar devices, unseen attack families, privacy constraints, and edge-resource limits—are addressed much less consistently. That imbalance matters because these conditions are exactly what distinguish a laboratory benchmark from a Future Internet deployment.

A stronger experimental paper should therefore resist the temptation to optimize a single accuracy number. The more defensible design is a matrix of tests: multiple datasets, device-disjoint and open-set splits, non-IID clients, benign and malicious federation, privacy and leakage measurements, explanation stability, and hardware cost. No single method is expected to dominate every cell. The scientific contribution lies in making the trade-offs visible and reproducible.