Cited by 3,332Network Security and Intrusion DetectionNetwork Packet Processing and OptimizationArtificial Immune Systems Applications

A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection

Buczak, Anna L., Guven, Erhan·2016·IEEE Communications Surveys & Tutorials

Abstract

This survey paper describes a focused literature survey of machine learning (ML) and data mining (DM) methods for cyber analytics in support of intrusion detection. Short tutorial descriptions of each ML/DM method are provided. Based on the number of citations or the relevance of an emerging method, papers representing each method were identified, read, and summarized. Because data are so important in ML/DM approaches, some well-known cyber data sets used in ML/DM are described. The complexity of ML/DM algorithms is addressed, discussion of challenges for using ML/DM for cyber security is presented, and some recommendations on when to use a given method are provided.

Integrity signals

Registry

Crossref · 10.1109/comst.2015.2494502

Cites

114 of 118 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Cites

Flagged first, then by citations

1 of the 119 references couldn’t be matched to a known paper.

Research works printed but not linked: 14

  1. Shearer, 2000, The CRISP-DM model: The new blueprint for data mining, J. Data Warehouse., 5, 13
  2. 2000, R Core Team
  3. Jacobson, 1989, The Tcpdump Manual Page
  4. Combs, 2014, Wireshark
  5. 2014, Sourcefire
  6. Stolfo, 2014, KDD Cup 1999 Data Set
  7. 2015, IBM
  8. 10.4108/wkdd.2008.2686 · DOI
  9. 2014, Politecnico di Torino, Analyzer 3.0
  10. Baralis, 2008, Generalized Itemset Discovery by Means of Opportunistic Aggregation
  11. Markov, 1971, Extension of the limit theorems of probability theory to a sum of variables connected in a chain, Dynamic Probabilistic Systems, 1
  12. 10.2307/2984875 · DOI
  13. Brauckhoff, 2008, Flame: A low-level anomaly modeling engine
  14. Paxson, 2004, Bro 0.9

Cited by

Sorted by citations

Authors
Buczak, A. L., & Guven, E.
Affiliations
Johns Hopkins University (US)
Venue
IEEE Communications Surveys & Tutorials
Published
2016
Volume
18
Issue
2
Pages
1153-1176
ISSN
  • 1553-877X (ISSN-L)
  • 2373-745X
OpenAlex
W2342408547
Cited by
3,332
References
119
Citations by year
2026: 460 · 2025: 395 · 2024: 297 · 2023: 319 · 2022: 403 · 2021: 447 · 2020: 394 · 2019: 314 · 2018: 217 · 2017: 73 · 2016: 11 · 2015: 1 · 2012: 1
FWCI
115.39
Type
journal article
Language
en
Open access
closed
Locations
IEEE Communications Surveys & Tutorials (publishedVersion)
Funders
Department of Homeland Security Network Security Deployment Division (HSSA01-13-C-2709)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
  • Physical Sciences › Engineering › Biomedical Engineering › Artificial Immune Systems Applications
Keywords
intrusion detection, cybersecurity, machine learning, data mining, algorithmic complexity

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review