Zero-day attack detection: a systematic literature review

Ahmad, Rasheed; Alsmadi, Izzat; Al-Hamdani, Wasim A.; Tawalbeh, Lo’ai

doi:10.1007/s10462-023-10437-z

Cited by 23 publications

(9 citation statements)

References 161 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The study concluded that machine learning techniques were more effective in detecting attacks when examining accuracy, precision, and recall metrics. Rasheed Ahmad et al found that intrusion detection systems need to be trained beyond limited datasets and application scopes by using different datasets [20]. They proposed a hybrid model by sequentially using autoencoders.…”

Section: Related Workmentioning

confidence: 99%

“…It can analyze normal behaviors in IoT systems and detect abnormal activities that do not conform to the established patterns [17], [18]. This can also be effective against new and unknown attacks [20]. Machine learning models can learn over time, which means that even if attackers change their attack methods or develop new tactics, security systems can update themselves [21].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A Comprehensive Analysis of the Machine Learning Algorithms in IoT IDS Systems

Ozdogan

2024

IEEE Access

View full text Add to dashboard Cite

In this study, we comprehensively compare machine learning algorithms in IoT IDS (Internet of Things Intrusion Detection System) systems from various aspects. We evaluate accuracy, precision, and training time. We examine the effects of data preprocessing techniques including normalization, outlier removal, standardization, and regularization on the datasets. Furthermore, we investigate the impact of dataset balancing, considering both balanced and imbalanced scenarios, on machine learning performance. We also analyzed the contribution of feature selection on the four different datasets. Based on our findings, we observe that certain preprocessing operations provide significant advantages in various ML algorithms, whereas others have very low impact, and their performance varies depending on the dataset and feature selection. The aim of this study is to facilitate the complexity and lengthiness of machine learning processes and algorithm selection, providing insights for future academic research. By addressing this objective, we aim to shed light on simplifying the utilization of machine learning algorithms. The study addresses the challenges arising from the complexity of machine learning processes in IoT IDS systems. This contribution can greatly benefit researchers in their academic endeavors. This multifaceted approach proves beneficial when comparing the methods under consideration, fostering a scientific discourse on their efficacy within contexts.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

A Comprehensive Analysis of the Machine Learning Algorithms in IoT IDS Systems

Ozdogan

2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Intrusion detection with deep learning models on zero-day attacks is a highly researched topic [63][64][65][66]. Multiple papers [2,[64][65][66][67][68] claim that the advantage of machinelearning-based intrusion detection systems is the ability to detect zero-day attacks.…”

Section: Fourth Experiment: Zero-day Attacksmentioning

confidence: 99%

A Comparison of Neural-Network-Based Intrusion Detection against Signature-Based Detection in IoT Networks

Schrötter,

Niemann,

Schnor

2024

Information

View full text Add to dashboard Cite

Over the last few years, a plethora of papers presenting machine-learning-based approaches for intrusion detection have been published. However, the majority of those papers do not compare their results with a proper baseline of a signature-based intrusion detection system, thus violating good machine learning practices. In order to evaluate the pros and cons of the machine-learning-based approach, we replicated a research study that uses a deep neural network model for intrusion detection. The results of our replicated research study expose several systematic problems with the used datasets and evaluation methods. In our experiments, a signature-based intrusion detection system with a minimal setup was able to outperform the tested model even under small traffic changes. Testing the replicated neural network on a new dataset recorded in the same environment with the same attacks using the same tools showed that the accuracy of the neural network dropped to 54%. Furthermore, the often-claimed advantage of being able to detect zero-day attacks could not be seen in our experiments.

show abstract

“…Both models even perform better on the "MUP" dataset than on the benign traffic of the MQTT-IoT-IDS2020-UP dataset. Intrusion detection with deep learning models on zero-day attacks is a highly researched topic [56,57,58,59]. Multiple papers [57,58,59,2,60,61] claim that the advantage of machine learning-based intrusion detection systems is the ability to detect zero-day attacks.…”

Section: Third Experiment: Sensor Updatesmentioning

confidence: 99%

A Comparison of Neural Network-Based Intrusion Detection Against Signature-Based Detection in IoT Networks

Schrötter,

Niemann,

Schnor

2024

Preprint

View full text Add to dashboard Cite

show abstract

Zero-day attack detection: a systematic literature review

Cited by 23 publications

References 161 publications

A Comprehensive Analysis of the Machine Learning Algorithms in IoT IDS Systems

A Comprehensive Analysis of the Machine Learning Algorithms in IoT IDS Systems

A Comparison of Neural-Network-Based Intrusion Detection against Signature-Based Detection in IoT Networks

A Comparison of Neural Network-Based Intrusion Detection Against Signature-Based Detection in IoT Networks

Contact Info

Product

Resources

About