Today, Federated Learning (FL) stands out as the solution to addressing the challenges of distributed computing and empowering a wide range of edge devices with artificial intelligence capabilities. One variant of FL called semi-decentralized FL (SDFL) enables multiple server units to coordinate the learning task instead of relying on only one central server, hence preventing single-point failures. However, SDFL requires careful consideration regarding the coordination between server nodes, and dealing with the heterogeneous computing resources and data distributions across end devices (FL clients). Therefore, we propose TUNE-FL, an adapTive semi-synchronoUs semi-deceNtralizEd Federated Learning that addresses the clients' heterogeneity challenges. TUNE-FL alleviates these challenges by (i) ensuring consensus regardless of the network topology, and (ii) deploying an adaptive semi-synchronous mechanism for coordinating the learning process across all nodes while taking into consideration the heterogeneity presented by end devices. We evaluated TUNE-FL for the intrusion detection system (IDS) datasets and compared it with the three most representative baseline models. The experimental results demonstrate that TUNE-FL outperforms the baselines in accuracy while greatly reducing the duration of FL training by approximately 97 times.

In recent years, federated learning (FL) has gained significant attention as a privacy-preserving solution for distributed machine learning, particularly in cybersecurity applications such as intrusion and attack detection. However, traditional FL models often face challenges related to limited training data diversity, communication overhead, and the ability to adapt to novel or unforeseen attack patterns. At the same time, generative AI (GAI) models have emerged as powerful tools for synthesizing realistic data, enabling enhanced model generalization and robustness. In this work, we propose integrating GAI with FL to create a more effective and adaptive framework for cybersecurity called GAIA-FL (GAI-Augmented FL). GAI can augment FL by synthesizing diverse attack scenarios, enriching local datasets, and addressing data heterogeneity across distributed nodes. We analyze the unique capabilities of GAI, such as data generation, and highlight its potential to improve the performance of FL-based cybersecurity systems. Additionally, we explore the integration of generative models and FL, focusing on their combined ability to detect complex and evolving threats while maintaining data privacy. Unlike existing studies, our work emphasizes the fusion of GAI and FL to tackle the challenges of decentralized intrusion detection and attack prevention. To validate our approach, we present a case study where GAI is used to enhance FL-based network intrusion detection by generating synthetic attack data, improving detection accuracy and robustness. This work demonstrates how this integration can revolutionize cybersecurity in next-generation networks by providing scalable, privacy-preserving, and adaptive solutions for evolving cyber threats.

The widespread adoption of the Internet of Things (IoT) in our technology-driven society raises significant security and privacy concerns, highlighting the need for collaborative Intrusion Detection Systems (IDS) that leverage Deep Learning (DL) methods to detect suspicious network traffic. Using both the computing power and local data available at distributed end devices, Federated Learning (FL) provides a decentralized learning paradigm that preserves data privacy. However, the system heterogeneity and the Independent and Identically Distributed (non-IID) distribution of FL clients’ data introduce various challenges that impact training efficiency. To address these issues, we propose an adaptive approach named FLAIR, which leverages a semi-synchronous FL mechanism and a Decision Transformer (DT) to select clients that not only enhance the global model’s performance but also reduce communication and computation overhead. DT helps to make client selection decisions by considering both current and historical information, with the model trained offline using various client selection policies. The process begins by generating an offline database, which will be used to train the DT offline. Then, the DT is deployed for online client selection under a semi-synchronous protocol, enabling a fully adaptive FL system. Extensive experiments on IDS datasets show that FLAIR significantly reduces computation and communication time by up to 94% and 93%, respectively, while maintaining comparable classification performance to the baseline models.

Open Radio Access Network (O-RAN) architectures enable flexible, scalable, and cost-efficient mobile networks by disaggregating and virtualizing baseband functions. However, this flexibility introduces significant challenges for resource management, requiring joint optimization of functional split selection and virtualized unit placement under dynamic demands and complex topologies. Existing solutions often address these aspects separately or have limitations in large and real-world scenarios. In this work, we propose a novel Graph-Augmented Proximal Policy Optimization (GPPO) framework that leverages Graph Neural Networks (GNNs) for topology-aware feature extraction and integrates action masking to efficiently navigate the combinatorial decision space. Our approach jointly optimizes functional split and placement decisions, capturing the full complexity of O-RAN resource allocation. Extensive experiments on both small- and large-scale O-RAN scenarios demonstrate that GPPO consistently outperforms state-of-the-art baselines, achieving up to $18 \%$ lower deployment cost and $25 \%$ higher reward in multitopology evaluations, while maintaining perfect reliability. These results highlight the effectiveness and scalability of GPPO for practical O-RAN deployments.

Network Digital Twins (NDTs) are increasingly relying on data-driven approaches for modeling complex network dynamics. Traffic forecasting is crucial for NDTs to provide timely insights for automated network reconfiguration. Existing spatiotemporal forecasting methods, while effective, often rely on pre-constructed graphs, limiting their flexibility in dynamic network environments. This paper introduces Flex+ , an inductive graph-based learning model designed for traffic prediction in data-scarce scenarios. Flex+ focuses on individual eNodeB traffic prediction by extracting local spatial correlations from k-hop subgraphs, combined with temporal information. Its inductive design allows it to operate on unseen nodes during training, enabling adaptability to evolving network topologies. Empirical studies on a large-scale cellular traffic dataset demonstrate that Flex+ achieves a 5.9% improvement in accuracy in inductive settings and a 22% reduction in error in data-scarce scenarios when trained with only 3 days of traffic data. Notably, a Knowledge Distillation (KD) framework is introduced to reduce model size and accelerate inference time up to 10 times while maintaining prediction accuracy.

The rapid proliferation of Internet of Things (IoT) devices and the transition to distributed computing environments necessitate advanced intrusion detection systems (IDS) to safeguard the new paradigm known as Cloud-Edge-IoT (CEI) continuum. In this paper, we introduce a novel approach called SURFS, integrating Hierarchical Federated Learning (HFL) with Spiking Neural Networks (SNN) to propose a robust, sustainable, and energy-efficient IDS for this continuum. HFL, with its hierarchical learning strategy, keeps data where they are generated, thus preserving user privacy and reducing communication overhead through its combination of decentralized and centralized architecture. On the other hand, SNN, inspired by human neural mechanisms, offers significant computational efficiency. Our proposed IDS combines these strengths, facilitating localized and energy-efficient detection at the edge and IoT layers while enabling global model aggregation and updates at the cloud layer. Through extensive experiments using one of the most recent datasets (Edge-IIoTset), we demonstrate that our approach not only detects attacks with high accuracy but also substantially reduces energy consumption across the continuum. The SURFS model presents a slightly superior performance in classification accuracy, outstripping the FL+SNN and non-FL models by margins of 0.5% and 1.21 %; however, with a much faster convergence time (3 x and 17 x respectively). In terms of sustainability, it achieves a remarkable reduction in communication overhead 99% lower than FL+SNN and 97% lower than non-FL. Additionally, it showcases significant improvements in computational cost, being 62% more efficient than FL+SNN and 94% more efficient than the non-FL model.

Recent studies have explored the potential of Machine Learning (ML) for intrusion detection systems (IDS) in the Internet of Things (IoT) system. However, low latency and privacy requirements are important in emerging application scenarios. Furthermore, due to limited communication resources, sending the raw data to the central server for model training is no longer practical. It is difficult to get labeled data because data labeling is expensive in terms of time. In this paper, we develop a semi-supervised federated active learning for IDS, called (METALS). This model takes advantage of Federated Learning (FL) and Active Learning (AL) to reduce the need for a large number of labeled data by actively choosing the instances that should be labeled and keeping the data where it was generated. Specifically, FL trains the model locally and communicates the model parameters instead of the raw data. At the same time, AL allows the model located on the devices to automatically choose and label part of the traffic without involving manual inspection of each training sample. Our findings demonstrate that METALS not only achieve a high classification performance, comparable to the classical FL model in terms of accuracy but also with a small amount of labeled data.

From a telecommunication standpoint, the surge in users and services challenges next-generation networks with escalating traffic demands and limited resources. Accurate traffic prediction can offer network operators valuable insights into network conditions and suggest optimal allocation policies. Recently, spatio-temporal forecasting, employing Graph Neural Networks (GNNs), has emerged as a promising method for cellular traffic prediction. However, existing studies, inspired by road traffic forecasting formulations, overlook the dynamic deployment and removal of base stations, requiring the GNN-based forecaster to handle an evolving graph. This work introduces a novel inductive learning scheme and a generalizable GNN-based forecasting model that can process diverse graphs of cellular traffic with one-time training. We also demonstrate that this model can be easily leveraged by transfer learning with minimal effort, making it applicable to different areas. Experimental results show up to ${9. 8 \%}$ performance improvement compared to the state-of-the-art, especially in rare-data settings with training data reduced to below $20 \%$.

Security has become a critical issue for Industry4.0 due to different emerging cyber-security threats. Recently, many deep learning (DL) approaches have focused on intrusion detection. However, such approaches often require sending data to a central entity. This in turn raises concerns related to privacy, efficiency, and latency. Despite the huge amount of data generated by the Internet of Things (IoT) devices in Industry 4.0, it is difficult to get labeled data, because data labeling is costly and time-consuming. This poses many challenges for several DL approaches, which require labeled data. In order to deal with these issues, new approaches should be adopted. This article proposes a novel federated semisupervised learning scheme that takes advantage of both unlabeled and labeled data in a federated way. First, an autoencoder (AE) is trained on each device (using unlabeled local/private data) to learn the representative and low-dimensional features. Then, a cloud server aggregates these models into a global AE using federated learning (FL). Finally, the cloud server composes a supervised neural network, by adding fully connected layers (FCN) to the global encoder (the first part of the global AE) and trains the resulting model using publicly available labeled data. Extensive case studies on two real-world industrial datasets demonstrate that our model: (a) ensures that no local private data is exchanged; (b) detects attacks with high classification performance, (c) works even when only a few amounts of labeled data are available; and (d) haslow communication overhead.

Recent medical applications are largely dominated by the application of Machine Learning (ML) models to assist expert decisions, leading to disruptive innovations in radiology, pathology, genomics, and hence modern healthcare systems in general. Despite the profitable usage of AI-based algorithms, these data-driven methods are facing issues such as the scarcity and privacy of user data, as well as the difficulty of institutions exchanging medical information. With insufficient data, ML is prevented from reaching its full potential, which is only possible if the database consists of the full spectrum of possible anatomies, pathologies, and input data types. To solve these issues, Federated Learning (FL) appeared as a valuable approach in the medical field, allowing patient data to stay where it is generated. Since an FL setting allows many clients to collaboratively train a model while keeping training data decentralized, it can protect privacy-sensitive medical data. However, FL is still unable to deliver all its promises and meets the more stringent requirements (e.g., latency, security) of a healthcare system based on multiple Internet of Medical Things (IoMT). For example, although no data are shared among the participants by definition in FL systems, some security risks are still present and can be considered as vulnerabilities from multiple aspects. This paper sheds light upon the emerging deployment of FL, provides a broad overview of current approaches and existing challenges, and outlines several directions of future work that are relevant to solving existing problems in federated healthcare, with a particular focus on security and privacy issues.

In this paper, we present FLUIDS, a Federated Learning with semi-sUpervised approach for Intrusion Detection System. FLUIDS formulates the intrusion detection into a semi-supervised learning where both supervised learning (using labeled data) and unsupervised learning (no label data) are combined in a collaborative way. The combination of federated learning and semi-supervised Learning allows the solution to: better preserve the privacy, improve training and inference efficiency, achieve better accuracy, and be cheaper to deploy.

With the increasing development of 5G/Beyond 5G and network softwarization techniques, we have more flexibility and agility in the network. This can be exploited by Machine Learning (ML) to integrate intelligence in the network and improve network as well as service management in edge-cloud environment. Intrusion detection systems (IDS) is one of the challenging issues for managing network. However, traditional approaches in this domain require all data (and their associated labels) to be centralized at the same location. In this context, such approaches lead to: (i) a large bandwidth overhead, as raw data needs to be transmitted to the server, (ii) low incentives for devices to send their private data, and (iii) large computing and storage resources needed on the server side to label and treat all this data. In this paper, to cope with the above limitations, we propose a semi-supervised federated learning model for IDS. Moreover, we use network softwarisation for automation and deployment. Our model combines Federated Learning and Semi-Supervised Learning where the clients train unsupervised models (using unlabeled data) to learn the representative and low-dimensional features and the server conducts a supervised model (using labeled data). We evaluate this approach on the well-known UNSW-NB15 dataset and the experimental results demonstrate that our approach can achieve accuracy and detection rates up to 84.32% and 83.10%, respectively while keeping the data private with limited overhead.

Network traffic classification is a key component for network management, Quality-of-Service management, as well as for network security. Therefore, developing machine learning (ML) methods, which can successfully distinguish network applications from each other, is one of the most important tasks. However, among the classification methods applied to network traffic classification so far, there is no one method that outperforms all the others. They all have advantages and inconveniences depending on the application domain. Therefore,this paper proposes an intelligent traffic management model by using deep learning (DL) that incorporates multiple Decision Tree-based models. Our model deploys a blending ensemble learning method to combine tree-based classifiers in order to maximize generalization accuracy. Using two datasets, we show that our proposed ensemble model is efficient for network traffic classification. Furthermore, the proposed approach is also compared against other representative machine-learning and deep-learning models and the results demonstrate that our approach provides better performance compared to others.

Network Traffic Classification enables a number of practical applications ranging from network monitoring to resource management, with security implications as well. Nowadays, traffic classification has become a challenging task in order to distinguish among a variety of applications due to the huge amount of generated traffic. Therefore, developing Machine Learning (ML) models, which can successfully identify network applications, is one of the most important tasks. However, among the ML models applied to network traffic classification so far, no model outperforms all the others. To solve these issues, this paper proposes a novel Deep Learning (DL)-based approach that incorporates multiple Decision Tree based models. This approach employs a non-linear blending ensemble method by combining tree-based classifiers through DL in order to maximize generalization accuracy. This ensemble consists of two levels called base classifiers and meta-classifiers. In the first level, Decision Tree-based models are used as the base classifiers while in the second level, DL is used as a meta-model to combine the outputs of the base classifiers. Using two publicly available datasets, we show that our proposed ensemble is suitable for network traffic classification and outperforms the linear blending (using logistic regression as meta-model) as well as several well-known ML models, which are Support Vector Machine (SVM), Decision Tree (DT), Random Forest (RF), Multi-Layer Perceptron (MLP), AdaBoost, K-Nearest Neighbors (KNN), LightGBM, Catboost, and XGBoost.

Network traffic classification is an important task in modern communications. Several approaches have been proposed to improve the performance of differentiating among applications. However, most of them are based on supervised learning where only labeled data are used. In reality, a lot of datasets are partially labeled due to many reasons and unlabeled portions of the data, which can also provide informative characteristics, are ignored. To handle this issue, we propose a semi-supervised approach based on deep learning. We deployed deep learning because of its unique nature for solving problems, and its ability to take into account both labeled and unlabeled data. Moreover, it can also integrate feature extraction and classification into a single model. To achieve these goals, we propose an approach using stacked sparse autoencoder (SSAE) accompanied by de-noising and dropout techniques to improve the robustness of extracted features and prevent the over-fitting problem during the training process. The obtained results demonstrate a better performance than traditional models while keeping the whole procedure automated.