Artificial intelligence for cybersecurity: Literature review and future research directions
Open accessAbstract
Artificial intelligence (AI) is a powerful technology that helps cybersecurity teams automate repetitive tasks, accelerate threat detection and response, and improve the accuracy of their actions to strengthen the security posture against various security issues and cyberattacks. This article presents a systematic literature review and a detailed analysis of AI use cases for cybersecurity provisioning. The review resulted in 2395 studies, of which 236 were identified as primary. This article classifies the identified AI use cases based on a NIST cybersecurity framework using a thematic analysis approach. This classification framework will provide readers with a comprehensive overview of the potential of AI to improve cybersecurity in different contexts. The review also identifies future research opportunities in emerging cybersecurity application areas, advanced AI methods, data representation, and the development of new infrastructures for the successful adoption of AI-based cybersecurity in today's era of digital transformation and polycrisis.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Tools powered by machine learning can now perform tasks like anomaly detection, predictive maintenance, and automated remediation.
“Tools powered by machine learning can now perform tasks like anomaly detection, predictive maintenance, and automated remediation.”
From Modern Approaches to Unix Automation: Shell Scripting, Configuration Management, and Security (2025) · cites this paper as Kaur et al., 2023
AI and intelligent automation are beginning to shape the future of Unix administration.
“Looking further ahead, AI and intelligent automation are beginning to shape the future of Unix administration.”
From Modern Approaches to Unix Automation: Shell Scripting, Configuration Management, and Security (2025) · cites this paper as Kaur et al., 2023
Early implementations include AI driven alerting systems that adjust thresholds based on usage patterns or bots that recommend or even execute corrective actions.
“Early implementations include AI driven alerting systems that adjust thresholds based on usage patterns or bots that recommend or even execute corrective actions.”
From Modern Approaches to Unix Automation: Shell Scripting, Configuration Management, and Security (2025) · cites this paper as Kaur et al., 2023
Cites
Al-Shehari, T., & Alsowail, R. A. (2021) · Entropy · doi:10.3390/e23101258 · Cited by 193 · see citing works
Insider Threat Detection Based on User Behavior Modeling and Anomaly Detection Algorithms
Kim, J., Park, M., Kim, H., Cho, S., & Kang, P. (2019) · Applied Sciences · doi:10.3390/app9194018 · Cited by 134 · see citing works
Cyberthreat Detection from Twitter using Deep Neural Networks
Dionisio, N., Alves, F., Ferreira, P. M., & Bessani, A. (2019) · 2019 International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn.2019.8852475 · Cited by 126 · see citing works
A hypergraph based Kohonen map for detecting intrusions over cyber–physical systems traffic
Jagtap, S. S., V. S., S. S., & V., S. (2021) · Future Generation Computer Systems · doi:10.1016/j.future.2021.02.001 · Cited by 29 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Advancing cybersecurity: a comprehensive review of AI-driven detection techniques
Salem, A. H., Azzam, S. M., Emam, O. E., & Abohany, A. A. (2024) · Journal of Big Data · doi:10.1186/s40537-024-00957-y · Cited by 282 · see citing works
When LLMs meet cybersecurity: a systematic literature review
Zhang, J., Bu, H., Wen, H., Liu, Y., Fei, H., Xi, R., Li, L., Yang, Y., Zhu, H., & Meng, D. (2025) · Cybersecurity · doi:10.1186/s42400-025-00361-w · Cited by 220 · see citing works
“Cybersecurity has become a critical concern due to the increasing reliance on interconnected systems and the continued emergence of sophisticated cyber threats (Thakur et al. 2015; Ghelani 2022).”
Digital deception: generative artificial intelligence in social engineering and phishing
Schmitt, M., & Flechais, I. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-10973-2 · Cited by 198 · see citing works
Evolving techniques in cyber threat hunting: A systematic review
Mahboubi, A., Luong, K., Aboutorab, H., Bui, H. T., Jarrad, G., Bahutair, M., Camtepe, S., Pogrebna, G., Ahmed, E., Barry, B., et al. (2024) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2024.104004 · Cited by 94 · see citing works
Threat Detection and Response Using AI and NLP in Cybersecurity
Ismail, D. W. S. (2024) · Journal of Internet Services and Information Security · doi:10.58346/jisis.2024.i1.013 · Cited by 34 · see citing works
A Comprehensive Survey on Generative AI Solutions in IoT Security
López Delgado, J. L., & López Ramos, J. A. (2024) · Electronics · doi:10.3390/electronics13244965 · Cited by 33 · see citing works
BARTPredict: Empowering IoT Security with LLM-Driven Cyber Threat Prediction
Diaf, A., Korba, A. A., Elislem Karabadji, N., & Ghamri-Doudane, Y. (2024) · GLOBECOM 2024 - 2024 IEEE Global Communications Conference · doi:10.1109/globecom52923.2024.10901770 · Cited by 28 · see citing works
Modern Approaches to Unix Automation: Shell Scripting, Configuration Management, and Security
Madamanchi, S. R. (2025) · International Journal for Research in Applied Science and Engineering Technology · doi:10.22214/ijraset.2025.72773 · Cited by 2 · see citing works
- Authors
- Kaur, R., Gabrijelčič, D., & Klobučar, T.
- Affiliations
- Jožef Stefan Institute (SI)
- Corresponding author
- Kaur, Ramanpreet
- Venue
- Information Fusion
- Publisher
- Elsevier BV
- Published
- 2023-09
- Volume
- 97
- Pages
- 101804
- ISSN
- 1566-2535 (ISSN-L)
- OpenAlex
- W4362704894
- Cited by
- 615
- References
- 4
- Citations by year
- 2026: 141 · 2025: 249 · 2024: 198 · 2023: 27
- FWCI
- 68.32
- Type
- journal article
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- Locations
- Information Fusion (publishedVersion, cc-by-nc-nd)
- Funders
- Javna Agencija za Raziskovalno Dejavnost RS (P2–0037, V2–2147)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- artificial intelligence in cybersecurity, AI use cases, threat detection, threat response, NIST Cybersecurity Framework, artificial intelligence adoption, digital transformation, polycrisis, cybersecurity infrastructure, data representation
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
