Aug 2026· The Eastasouth Journal of Information System and Computer Science· 0 citations· 62 references
TL;DR
This review presents a comprehensive analysis of machine learning-based intrusion detection systems, covering a wide range of techniques including supervised learning, unsupervised learning, ensemble learning, and deep learning models, and discusses critical challenges affecting the deployment of ML-based IDS.
Abstract
The rapid expansion of interconnected networks, cloud computing, Internet of Things (IoT) devices, and digital communication technologies has significantly increased the complexity of modern cyber threats, making traditional network security mechanisms increasingly inadequate. Intrusion Detection Systems (IDS) are essential components of cybersecurity infrastructures, designed to monitor network activities and identify malicious behavior before it compromises system integrity. However, conventional signature-based and rule-based IDS are primarily effective against previously known attack patterns and often fail to detect zero-day attacks, advanced persistent threats (APTs), and other evolving cyber threats. To address these limitations, machine learning (ML) has emerged as a transformative technology that enables adaptive, intelligent, and data-driven intrusion detection by learning complex patterns from network traffic and system behavior. This review presents a comprehensive analysis of machine learning-based intrusion detection systems, covering a wide range of techniques including supervised learning, unsupervised learning, ensemble learning, and deep learning models. The paper examines widely used benchmark datasets, feature selection and feature engineering methods, data preprocessing techniques, and commonly adopted performance evaluation metrics for assessing intrusion detection effectiveness. It also reviews various IDS deployment architectures, including centralized, distributed, edge-based, cloud-enabled, and hybrid frameworks, highlighting their strengths and limitations in different networking environments. To provide a clear understanding of intelligent intrusion detection mechanisms, the review introduces two conceptual frameworks: a machine learning-based intrusion detection pipeline that illustrates the end-to-end process from data acquisition to threat classification, and a layered network security architecture demonstrating the integration of ML techniques into modern cybersecurity infrastructures. Furthermore, the paper discusses critical challenges affecting the deployment of ML-based IDS, including data imbalance, scalability, computational complexity, model interpretability, adversarial machine learning attacks, privacy preservation, and real-time processing constraints.
The rapid expansion and spread of networked systems and digital services has tremendously expanded the complexity and frequency of cyberattacks, and conventional security tools are no longer relevant to contemporary cyber threats. Intrusion Detection Systems (IDS) are very important in detection of malicious activities, but the traditional signature based and rule-based IDS are limited in that they have high false-positive, cannot be able to detect the attacks of the zeroday, and fail to be adapted to changing patterns of threats. The recent developments in machine learning (ML) have brought intelligent and adaptive methods that can learn the complicated patterns based on large volumes of network traffic data. This paper provides an in-depth analysis of effective machine learning methods to intrusion detection system in cybersecurity. The paper compares the efficacy of supervised, unsupervised and ensemble-based ML algorithms that conduct intrusion detection with enhanced accuracy, lowered computation load, and improved scalability. It focuses on the feature selection, dimensionality reduction, and model optimization to enhance the detecting performance and retain the capability of running it in real-time. In the results, the hybrid and ensemble models of machine learning prove to be much more efficient than the conventional IDS methods and provide a strong protection against the current cyber threats. This research contributes toward developing intelligent, adaptive, and efficient IDS frameworks suitable for contemporary and future cybersecurity infrastructures.
K. Ashwini, M. Supriya· 2026 5th International Confe...· 0 citations
This study examines the application of artificial intelligence-powered intrusion detection systems that leverage deep learning architectures and anomaly detection methodologies to identify malicious activities within dynamic network environments and concludes that the convergence of deep learning methodologies and anomaly detection techniques provides a robust foundation for next-generation intrusion detection systems.
Mohd. Asif I. Gandhi, Dinesh Baban Kute, U. Hemavathi· International journal of com...· 0 citations
With the widespread adoption of cloud computing, securing enterprise networks against cyber threats has become increasingly important. Cloud environments are highly dynamic and constantly changing, making them susceptible to sophisticated cyberattacks that traditional Intrusion Detection Systems (IDS) often fail to detect. This study focuses on Intelligent Intrusion Detection Systems (IIDS) and their critical role in strengthening cloud security. Unlike conventional signature-based IDS that rely on fixed attack patterns, IIDS employ advanced Machine Learning (ML) and Artificial Intelligence (AI) techniques including deep learning, decision trees, and ensemble models to identify both known and emerging threats with greater accuracy. The paper proposes an integrated framework that combines real-time anomaly detection with automated response capabilities for cloud networks. Key architectural elements of IIDS are examined, alongside major deployment challenges such as scalability, false-positive rates, and computational requirements. Additionally, practical case studies and performance evaluations illustrate how IIDS enhance threat detection by improving accuracy, adaptability, and efficiency. Finally, the paper outlines future research directions to further advance IIDS capabilities and address the evolving security needs of modern cloud infrastructures.
R. Velu· 2026 4th International Confe...· 0 citations
The rapid growth of heterogeneous network environments such as the Internet of Things (IoT), Industrial IoT (IIoT), cloud computing, and software‐defined networks has significantly increased exposure to sophisticated cyberattacks, making intrusion detection a critical component of modern cybersecurity infrastructures. Traditional intrusion detection systems and conventional machine learning techniques often face limitations when handling high‐dimensional network traffic, class imbalance, and evolving attack patterns, resulting in reduced detection performance and limited scalability under complex network environments. These challenges reduce their effectiveness in practical, large‐scale deployments. To overcome these issues, this paper proposes a hybrid intrusion detection framework based on an Autoencoder and a TabTransformer, optimized using the Whale Optimization Algorithm (WOA). The Autoencoder is employed to perform unsupervised feature learning, transforming high‐dimensional network traffic data into compact and noise‐resistant latent representations. These latent features are then processed by the TabTransformer, which utilizes multi‐head self‐attention to capture complex inter‐feature relationships and enhance classification performance. The WOA is incorporated to automatically optimize key hyperparameters, improving convergence speed, stability, and generalization capability of the model. The proposed framework is primarily evaluated using the CIC‐IDS2018 benchmark dataset. In addition, supplementary cross‐dataset validation on the CIC‐IDS2017 and UNSW‐NB15 datasets is conducted to assess the generalization capability of the proposed framework. Experimental results demonstrate that the proposed model achieves an accuracy of 99.87%, precision of 99.85%, recall of 99.88%, and an F1‐score of 99.86% while maintaining very low false alarm and false negative rates. Comparative analysis with existing deep learning‐based intrusion detection approaches confirms the superior and balanced performance of the proposed method. Overall, the Hybrid Autoencoder–TabTransformer framework provides an effective intrusion detection solution that demonstrates strong performance under the evaluated experimental conditions.
Rui Guo, Guangjun Wen· Transactions on Emerging Tel...· 0 citations
Modern computer networks face a persistent and growing range of cyber threats, including unauthorized access, malware infiltration, denial-of-service attacks, and data exfiltration. Conventional signature- and rule-based intrusion detection systems (IDS) struggle to identify zero-day attacks and evolving intrusion patterns as networks expand in scale and complexity, and they typically require frequent manual updates to remain effective. This paper presents a machine learning–based intrusion detection system capable of automatically analyzing network traffic and distinguishing malicious activity from legitimate behavior. By learning from historical traffic data, the proposed system adapts to emerging threats with greater accuracy than static, rule-driven approaches. The system is implemented in Python using established data-analytics and machine-learning libraries, and it evaluates several supervised classifiers—Random Forest, Support Vector Machine, Naïve Bayes, and Logistic Regression—to categorize network traffic as normal or intrusive. Experimental results show that the Random Forest classifier consistently achieves the strongest overall performance, and the integration of real-time packet capture with a visualization dashboard enables continuous, interpretable monitoring. The findings demonstrate that machine learning offers a scalable, adaptive, and largely automated foundation for securing contemporary network infrastructures.
Mohit kumar saini Mohit kumar saini, Dhanna Ram Dhanna Ram, Pooja Verma Pooja Verma· International Journal of Cre...· 0 citations
The rapid deployment of Internet of Things (IoT) devices across smart cities, healthcare systems, industrial automation, transportation networks, smart grids, and cyber-physical infrastructures has expanded the modern cyberattack surface. IoT devices are often constrained by limited processing capacity, memory, battery power, and communication bandwidth, making conventional security mechanisms difficult to deploy consistently at scale. Intrusion detection systems (IDSs) provide an important defensive layer; however, many machine-learning-based IDSs are developed under static assumptions and may experience performance degradation as traffic distributions evolve due to firmware changes, device onboarding, protocol updates, user behavior variation, or adaptive attacks. This paper presents a hybrid IDS framework that integrates supervised Random Forest classification, unsupervised Isolation Forest anomaly monitoring, and Kolmogorov–Smirnov (KS)-based concept drift monitoring. In the experimental pipeline, Isolation Forest is trained exclusively on benign traffic to ensure that the anomaly detector models normal behavior rather than an attack-dominated training distribution. The evaluation uses a large-scale chronologically sampled subset of the CICIoT2023 dataset containing 3,890,621 records while preserving the natural class distribution of 2.35% benign traffic and 97.65% attack traffic. The chronological 80/20 train/test split is established first at the file level, followed by systematic sampling within each split to reduce the risk of leakage across the evaluation boundary. On the 746,094-record test set, the proposed hybrid IDS achieved 99.73% accuracy, 99.89% precision, 99.83% recall, 99.86% F1-score, and a false positive rate of 4.77%. The corresponding confusion matrix contains TN = 16,683, FP = 836, FN = 1205, and TP = 727,370, yielding 95.23% specificity and 97.53% balanced accuracy. Standalone Random Forest marginally outperformed the hybrid model in raw accuracy and false positive rate; therefore, the contribution of the proposed framework is centered on deployment-oriented anomaly monitoring, drift awareness, and generalization rather than absolute superiority in static classification metrics. A leave-one-attack-family-out experiment withholding MITM-ArpSpoofing from training showed that the hybrid model detected 85.26% of the unseen attack-family samples, compared with 85.18% for Random Forest alone and 7.05% for Isolation Forest alone. These findings provide initial evidence of generalization to one held-out attack family but should not be interpreted as proof of broad zero-day detection capability. The framework is therefore positioned as a competitive IDS that combines supervised detection with anomaly monitoring and concept drift awareness for deployment-oriented IoT security.
Muath A. Obaidat, Meryem Abouali, Aneeza Shakeel· Italian National Conference...· 0 citations