Data Analytics and Big Data in Cybersecurity Threat Detection: A Critical Review of Techniques, Challenges, and Emerging Directions

Abstract

The increasing sophistication and scale of cyber threats have intensified the need for analytical methods capable of processing high-volume, high-velocity, and heterogeneous security data. This critical review synthesizes 38 scholarly sources identified through a structured Google Scholar search and a PRISMA-informed screening workflow to examine the role of data analytics and big data in cybersecurity threat detection. The review considers signature-based, anomaly-based, behaviour-based, machine-learning, and deep-learning approaches, together with operational challenges and emerging directions. Across heterogeneous datasets and application settings, machine-learning and deep-learning methods offer strong representation-learning and pattern-recognition capabilities, while anomaly- and behaviour-based approaches remain important for identifying previously unseen or context-dependent activity. Their practical effectiveness, however, depends on data quality, labelling, class balance, computational resources, interpretability, privacy, and the operating environment. Because the underlying studies use different datasets, tasks, metrics, and validation designs, the evidence does not support a universal ranking of detection approaches. Current research increasingly emphasises explainable artificial intelligence, federated learning, privacy-preserving analytics, hybrid detection architectures, and real-time processing. The review concludes that robust cybersecurity analytics requires context-appropriate combinations of complementary techniques rather than reliance on a single universally superior model.