A Systematic and Comprehensive Survey of Recent Advances in Intrusion Detection Systems Using Machine Learning: Deep Learning, Datasets, and Attack Taxonomy

Abstract

Recently, intrusion detection systems (IDS) have become an essential part of most organisations’ security architecture due to the rise in frequency and severity of network attacks. To identify a security breach, the target machine or network must be watched and analysed for signs of an intrusion. It is defined as efforts to compromise the confidentiality, integrity, or availability of a computer or network or to circumvent its security mechanisms. Several IDS have been proposed in the literature to efficiently detect such attempts exploiting different characteristics of cyberattacks. These systems can provide with timely sensing the network intrusions and, subsequently, notifying the manager or the responsible person in an organisation. Important actions are then carried out to reduce the degree of damage caused by the intrusion. Organisations use such techniques to defend their systems from the network disconnectivity and increase reliance on the information systems by employing intrusion detection. This paper presents a detailed summary of recent advances in IDS from the literature. Nevertheless, a review of future research directions for detecting malicious operations and launching different attacks on systems is discussed and highlighted. Furthermore, this study presents detailed description of well-known publicly available datasets and a variety of strategies developed for dealing with intrusions.

From Bytes to Insights: A Systematic Literature Review on Unraveling IDS Datasets for Enhanced Cybersecurity Understanding

“…The study conducted by [25] emphasizes on the use of DL models in the identification of phishing assaults, a growing concern in the field of cybersecurity. This study highlights the importance of every DL model, starting from the preprocessing of input data through the generation of the model's output.…”

Cloud Network Anomaly Detection Using Machine and Deep Learning Techniques— Recent Research Advancements

“…Detecting a security breach involves monitoring and analyzing the target machine or network for indications of unauthorized access. Such breaches are defined as attempts to compromise the confidentiality, integrity, or availability of a computer system or network, or to bypass its security measures [25]. However, the most common intrusion detection approaches are signature-based and anomaly-based.…”

Optimizing Intrusion Detection Systems in Three Phases on the CSE-CIC-IDS-2018 Dataset

“…Malicious attacks are continually developing, emphasizing the critical need for improved network security solutions. Given the world's growing reliance on digital technologies such as computers and the Internet, building safe and reliable programs, frameworks, and networks that can withstand these attacks is a critical task [1,2].…”

“…It accomplishes this by subtracting the minimum value of the feature from each data point and then dividing the result by the range of the feature. This technique's equivalent mathematical equation is shown as (1), where X is an original value and X is the normalized value [35]:…”