DEEP LEARNING-BASED INTRUSION DETECTION IN COMPUTER SYSTEMS AND NETWORKS: ADVANCES, HYBRIDS, AND CHALLENGES 2022–2026

Abstract

The work is devoted to a comprehensive systematic review of advances in identifying the state of computer systems and networks in the context of cybersecurity for the period 2022–2026. The study analyzes the evolution of intrusion detection systems (IDS), provides categorization and synthesis of key approaches, including supervised, unsupervised, and semi-supervised learning, as well as statistical and temporal analysis methods. Particular attention is paid to deep learning models (CNN, RNN/LSTM, Transformers, GNN) and their hybrid combinations, which demonstrate accuracy above 95% in detecting complex multi-stage attacks and zero-day threats. The experience of implementing identification methods in specific domains such as IoT, SCADA, automotive networks, and maritime transportation systems is summarized. Critical challenges for the scientific community are identified, including the problem of explainable artificial intelligence (XAI), resilience to adversarial attacks, and optimization for real-time operation on resource-constrained devices. Conclusions. The study revealed a trend of transition from classical static signature-based methods to dynamic intelligent algorithms. The analysis of available sources made it possible to classify the considered approaches according to their mathematical foundations and operational characteristics. For each group of methods, their main advantages, disadvantages, and key prospects for application were identified. It was found that hybrid and ensemble models provide the highest accuracy in complex environments (over 99%), while the combination of convolutional neural networks with recurrent networks or Transformers is the most effective solution for detecting multi-stage attacks. In addition, the growing role of federated learning in the development and implementation of intrusion detection systems was emphasized.