Trustworthy Federated Intrusion Detection for the Future Internet: A Critical Review and Evaluation Framework

Abstract

Federated intrusion detection for the Future Internet must operate across heterogeneous devices, distributed telemetry, changing traffic patterns, and adversarial clients. This critical structured review synthesizes a targeted corpus of 37 publications and standards, including 20 Future Internet articles, coded on six methodological evidence dimensions using a transparent ordinal rubric. Federated-learning relevance received the highest mean coverage score (3.32/5; 24 of 37 records scored at least 3), followed by reproducibility (2.89/5; 19 of 37). Evidence for robustness (1.19/5; 10 of 37), generalization (1.00/5; 7 of 37), explainability (1.27/5; 7 of 37), and deployment realism (1.59/5; 10 of 37) was markedly sparser. Only five records scored at least 3 on both robustness and generalization. These results describe the methods addressed in a purposefully selected literature corpus, not the performance of deployed detection systems. Based on the observed coverage gaps, we propose a reproducible evaluation framework encompassing non-independent and identically distributed federation, disjoint and open-set testing, poisoning and backdoor attacks, leakage auditing, explanation stability, and edge-resource measurements. A supplementary Excel workbook separates original source-level coding from formula-linked analyses and sensitivity checks. Trustworthy federated intrusion detection should be evaluated through this joint systems-level evidence rather than closed-world predictive accuracy alone.