A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection
Abstract
This survey paper describes a focused literature survey of machine learning (ML) and data mining (DM) methods for cyber analytics in support of intrusion detection. Short tutorial descriptions of each ML/DM method are provided. Based on the number of citations or the relevance of an emerging method, papers representing each method were identified, read, and summarized. Because data are so important in ML/DM approaches, some well-known cyber data sets used in ML/DM are described. The complexity of ML/DM algorithms is addressed, discussion of challenges for using ML/DM for cyber security is presented, and some recommendations on when to use a given method are provided.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The C4.5, ID3, and CART algorithms are among the well-known decision tree algorithms used for intrusion detection.
“The C4.5 algorithm [200], the ID3 algorithm [199], and the CART algorithm [55] are among the well-known decision tree algorithms used for intrusion detection.”
From Comparative Analysis of Intrusion Detection Systems and Machine Learning Based Model Analysis through Decision Tree (2023) · cites this paper as [55]
There are various surveys on machine learning in networking, but they are specialized to specific areas or specific network technologies.
“Though there are various surveys on ML in networking [18,61,82,142,246,339], this survey is purposefully different.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [82]
Fadlullah et al. and Buczak et al., both state-of-the-art surveys, have a specialized treatment of machine learning to specific problems in networking.
“Whereas, Fadlullah et al. [142] and Buczak et al. [82], both state-of-theart surveys, have a specialized treatment of ML to specific problems in networking.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [82]
Cites
Breiman, L. (2001) · Machine Learning · doi:10.1023/a:1010933404324 · Cited by 133,538 · see citing works
Zadeh, L. A. (1965) · Information and Control · doi:10.1016/s0019-9958(65)90241-x · Cited by 67,855 · see citing works
Kennedy, J., & Eberhart, R. (2002) · Proceedings of ICNN'95 - International Conference on Neural Networks · doi:10.1109/icnn.1995.488968 · Cited by 58,192 · see citing works
Maximum Likelihood from Incomplete Data Via the <i>EM</i> Algorithm
Dempster, A. P., Laird, N. M., & Rubin, D. B. (1977) · Journal of the Royal Statistical Society Series B: Statistical Methodology · doi:10.1111/j.2517-6161.1977.tb01600.x · Cited by 50,444 · see citing works
Zadeh, L. A. (1996) · Cited by 46,960 · see citing works
The Nature of Statistical Learning Theory
Vapnik, V. (2000) · Statistics for Engineering and Information Science · doi:10.1007/978-1-4757-3264-1 · Cited by 46,387 · see citing works
Collective dynamics of ‘small-world’ networks
Watts, D. J., & Strogatz, S. H. (1998) · Nature · doi:10.1038/30918 · Cited by 43,060 · see citing works
The Nature of Statistical Learning Theory
Vapnik, V. N. (1995) · doi:10.1007/978-1-4757-2440-0 · Cited by 39,138 · see citing works
Data Mining: Practical Machine Learning Tools and Techniques
Witten, I. H., Frank, E., & Hall, M. A. (2011) · Elsevier eBooks · doi:10.1016/c2009-0-19715-5 · Cited by 25,493 · see citing works
(1992) · Cited by 23,431 · see citing works
Multilayer feedforward networks are universal approximators
Hornik, K., Stinchcombe, M., & White, H. (1989) · Neural Networks · doi:10.1016/0893-6080(89)90020-8 · Cited by 21,728 · see citing works
Quinlan, J. R. (1986) · Machine Learning · doi:10.1007/bf00116251 · Cited by 21,439 · see citing works
(1996) · Cited by 20,179 · see citing works
MapReduce: simplified data processing on large clusters
Dean, J., & Ghemawat, S. (2008) · Communications of the ACM · doi:10.1145/1327452.1327492 · Cited by 18,476 · see citing works
The WEKA data mining software: an update
Hall, M., Frank, E., Holmes, G., Pfahringer, B., Reutemann, P., & Witten, I. H. (2009) · ACM SIGKDD Explorations Newsletter · doi:10.1145/1656274.1656278 · Cited by 17,750 · see citing works
A Tutorial on Support Vector Machines for Pattern Recognition
Burges, C. J. C. (1998) · Data Mining and Knowledge Discovery · doi:10.1023/a:1009715923555 · Cited by 16,437 · see citing works
Kohonen, T. (1995) · Springer series in information sciences · doi:10.1007/978-3-642-56927-2 · Cited by 16,032 · see citing works
Mining association rules between sets of items in large databases
Agrawal, R., Imieliński, T., & Swami, A. (1993) · Proceedings of the 1993 ACM SIGMOD international conference on Management of data · doi:10.1145/170035.170072 · Cited by 14,907 · see citing works
Jolliffe, I. T. (2005) · Wiley eBooks · doi:10.1002/0470013192.bsa501 · Cited by 14,522 · see citing works
Genetic Programming: On the Programming of Computers by Means of Natural Selection
Koza, J. R. (1992) · Medical Entomology and Zoology · Cited by 13,225 · see citing works
The perceptron: A probabilistic model for information storage and organization in the brain.
Rosenblatt, F. (1958) · Psychological Review · doi:10.1037/h0042519 · Cited by 12,280 · see citing works
Multilayer feedforward networks are universal approximators
HornikK., StinchcombeM., & WhiteH. (1989) · Neural Networks · doi:10.5555/70405.70408 · Cited by 9,266 · see citing works
Kohonen, T. (1990) · Proceedings of the IEEE · doi:10.1109/5.58325 · Cited by 8,414 · see citing works
Experiments with a new boosting algorithm
Freund, Y., & Schapire, R. E. (1996) · Cited by 8,189 · see citing works
Multivariate Adaptive Regression Splines
Friedman, J. H. (1991) · The Annals of Statistics · doi:10.1214/aos/1176347963 · Cited by 8,108 · see citing works
Ant colony system: a cooperative learning approach to the traveling salesman problem
Dorigo, M., & Gambardella, L. M. (1997) · IEEE Transactions on Evolutionary Computation · doi:10.1109/4235.585892 · Cited by 8,081 · see citing works
Algorithms for Clustering Data
Sarle, W. S., Jain, A. K., & Dubes, R. C. (1990) · Technometrics · doi:10.2307/1268876 · Cited by 7,804 · see citing works
Chiang, L. H., Russell, E. L., & Braatz, R. D. (2001) · Advanced textbooks in control and signal processing · doi:10.1007/978-1-4471-0347-9_4 · Cited by 6,684 · see citing works
Algorithms for clustering data
Flury, B. N. (1989) · Journal of Statistical Planning and Inference · doi:10.1016/0378-3758(89)90033-5 · Cited by 6,466 · see citing works
Forney, G. D. (1973) · Proceedings of the IEEE · doi:10.1109/proc.1973.9030 · Cited by 5,713 · see citing works
A detailed analysis of the KDD CUP 99 data set
Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A. (2009) · 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications · doi:10.1109/cisda.2009.5356528 · Cited by 5,396 · see citing works
Agrawal, R., & Srikant, R. (2002) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde.1995.380415 · Cited by 5,150 · see citing works
Artificial neural networks: a tutorial
Jain, A. K., Mao, J., & Mohiuddin, K. M. (1996) · Computer · doi:10.1109/2.485891 · Cited by 4,989 · see citing works
Maximum Likelihood from Incomplete Data via the EM Algorithm
Dempster, A. P., Laird, N. M., & Rubin, D. B. (1976) · Cited by 4,517 · see citing works
Bayesian Networks and Decision Graphs
Jensen, F. V., & Nielsen, T. D. (2007) · Information science and statistics · doi:10.1007/978-0-387-68282-2 · Cited by 4,157 · see citing works
(2024) · Physics Subject Headings (PhySH) · doi:10.29172/7c2a6982-6d72-4cd8-bba6-2fccb06a7011 · Cited by 4,081 · see citing works
Cohen, W. W. (1995) · Elsevier eBooks · doi:10.1016/b978-1-55860-377-6.50023-2 · Cited by 3,890 · see citing works
Genetic Algorithms and Machine Learning
Goldberg, D. E., & Holland, J. H. (1988) · Machine Learning · doi:10.1023/a:1022602019183 · Cited by 3,193 · see citing works
Ensemble based systems in decision making
Robi Polikar, A. (2006) · IEEE Circuits and Systems Magazine · doi:10.1109/mcas.2006.1688199 · Cited by 2,960 · see citing works
Evolution strategies – A comprehensive introduction
Beyer, H.-G., & Schwefel, H. (2002) · Natural Computing · doi:10.1023/a:1015059928466 · Cited by 2,810 · see citing works
An empirical comparison of supervised learning algorithms
Caruana, R., & Niculescu-Mizil, A. (2006) · Proceedings of the 23rd international conference on Machine learning - ICML '06 · doi:10.1145/1143844.1143865 · Cited by 2,780 · see citing works
Fast discovery of association rules
Agrawal, R., Mannila, H., Srikant, R., Toivonen, H. T. T., & Verkamo, A. I. (1996) · Knowledge Discovery and Data Mining · Cited by 2,376 · see citing works
Anomaly-based network intrusion detection: Techniques, systems and challenges
García-Teodoro, P., Díaz-Verdejo, J., Maciá-Fernández, G., & Vázquez, E. (2009) · Computers & Security · doi:10.1016/j.cose.2008.08.003 · Cited by 2,085 · see citing works
The KDD process for extracting useful knowledge from volumes of data
Fayyad, U., Piatetsky-Shapiro, G., & Smyth, P. (1996) · Communications of the ACM · doi:10.1145/240455.240464 · Cited by 1,934 · see citing works
Extreme learning machines: a survey
Huang, G.-B., Wang, D. H., & Lan, Y. (2011) · International Journal of Machine Learning and Cybernetics · doi:10.1007/s13042-011-0019-y · Cited by 1,903 · see citing works
Bayesian Networks and Decision Graphs
Jensen, F. V. (2001) · Springer eBooks · doi:10.1007/978-1-4757-3502-4 · Cited by 1,743 · see citing works
A Tutorial on Learning with Bayesian Networks
Heckerman, D. E. (2008) · Studies in computational intelligence · doi:10.1007/978-3-540-85066-3_3 · Cited by 1,712 · see citing works
A survey of techniques for internet traffic classification using machine learning
Nguyen, T. T. T., & Armitage, G. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080406 · Cited by 1,664 · see citing works
Network Anomaly Detection: Methods, Systems and Tools
Bhuyan, M. H., Bhattacharyya, D. K., & Kalita, J. K. (2013) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2013.052213.00046 · Cited by 1,358 · see citing works
A Tutorial on Learning with Bayesian Networks
Heckerman, D. E. (1998) · Springer eBooks · doi:10.1007/978-94-011-5014-9_11 · Cited by 1,242 · see citing works
A data mining framework for building intrusion detection models
Lee, W., Stolfo, S. J., & Mok, K. W. (2003) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/secpri.1999.766909 · Cited by 1,151 · see citing works
The immune system, adaptation, and machine learning
Farmer, J. D., Packard, N. H., & Perelson, A. S. (1986) · Physica D Nonlinear Phenomena · doi:10.1016/0167-2789(86)90240-x · Cited by 1,103 · see citing works
Baum, L. E., & Eagon, J. A. (1967) · Bulletin of the American Mathematical Society · doi:10.1090/s0002-9904-1967-11751-8 · Cited by 1,053 · see citing works
The decay of turbulence in the burgers model
Moiseev, S. S., Toor, A. V., & Yanovsky, V. (1981) · Physica D Nonlinear Phenomena · doi:10.1016/0167-2789(81)90072-5 · Cited by 1,050 · see citing works
Evaluating intrusion detection systems: the 1998 DARPA off-line intrusion detection evaluation
Lippmann, R. P., Fried, D. J., Graf, I., Haines, J. W., Kendall, K. R., McClung, D., Weber, D., Webster, S. E., Wyschogrod, D., Cunningham, R. K., et al. (2002) · DARPA Information Survivability Conference and Exposition · doi:10.1109/discex.2000.821506 · Cited by 918 · see citing works
The 1999 DARPA off-line intrusion detection evaluation
Lippmann, R. P., Haines, J. W., Fried, D. J., Korba, J., & Das, K. (2000) · Computer Networks · doi:10.1016/s1389-1286(00)00139-0 · Cited by 877 · see citing works
The use of computational intelligence in intrusion detection systems: A review
Wu, S. X., & Banzhaf, W. (2009) · Applied Soft Computing · doi:10.1016/j.asoc.2009.06.019 · Cited by 697 · see citing works
Intrusion Detection Techniques for Mobile Wireless Networks
Zhang, Y., Lee, W., & Huang, Y.-A. (2003) · Wireless Networks · doi:10.1023/a:1024600519144 · Cited by 675 · see citing works
Rahbar, A. G., & Yang, O. W. W. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080408 · Cited by 668 · see citing works
Transitivity in Structural Models of Small Groups
Holland, P. W., & Leinhardt, S. (1971) · Comparative Group Studies · doi:10.1177/104649647100200201 · Cited by 664 · see citing works
Random-Forests-Based Network Intrusion Detection Systems
Zhang, J., Zulkernine, M., & Haque, A. (2008) · IEEE Transactions on Systems Man and Cybernetics Part C (Applications and Reviews) · doi:10.1109/tsmcc.2008.923876 · Cited by 587 · see citing works
Mining fuzzy association rules in databases
Kuok, C. M., Fu, A. W.-C., & Wong, M. H. (1998) · ACM SIGMOD Record · doi:10.1145/273244.273257 · Cited by 532 · see citing works
Naive Bayes vs decision trees in intrusion detection systems
Amor, N. B., Salem Benferhat, A., & Elouedi, Z. (2004) · ACM Symposium on Applied Computing · doi:10.1145/967900.967989 · Cited by 491 · see citing works
EXPOSURE : Finding malicious domains using passive DNS analysis
Bilge, L. (2011) · Cited by 482 · see citing works
Mutual information-based feature selection for intrusion detection systems
Amiri, F., Yousefi, M. R., Lucas, C., Shakery, A., & Yazdani, N. (2011) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2011.01.002 · Cited by 473 · see citing works
An Overview of IP Flow-Based Intrusion Detection
Sperotto, A., Schaffrath, G., Sadre, R., Morariu, C., Pras, A., & Stiller, B. (2010) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2010.032210.00054 · Cited by 467 · see citing works
A hybrid machine learning approach to network anomaly detection
Shon, T., & Moon, J. (2007) · Information Sciences · doi:10.1016/j.ins.2007.03.025 · Cited by 443 · see citing works
Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning
Lyon, G. F. (2009) · Medical Entomology and Zoology · Cited by 432 · see citing works
Artificial Neural Networks for Misuse Detection
Cannady, J. (1998) · Cited by 417 · see citing works
Li, Y., Xia, J., Zhang, S., Yan, J., Ai, X., & Dai, K. (2011) · Expert Systems with Applications · doi:10.1016/j.eswa.2011.07.032 · Cited by 386 · see citing works
Intrusion detection using an ensemble of intelligent paradigms
Mukkamala, S., Sung, A. H., & Abraham, A. (2004) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2004.01.003 · Cited by 372 · see citing works
Bayesian event classification for intrusion detection
Kruegel, C., Mutz, D. H., Robertson, W., & Valeur, F. (2004) · Annual Computer Security Applications Conference · doi:10.1109/csac.2003.1254306 · Cited by 344 · see citing works
Unsupervised anomaly detection in network intrusion detection using clusters
Leung, K., & Leckie, C. A. (2005) · Cited by 337 · see citing works
Bilge, L., Şen, S., Balzarotti, D., et al. (2014) · ACM Transactions on Information and System Security · doi:10.1145/2584679 · Cited by 317 · see citing works
Usilng Machine Learning Technliques to Identify Botnet Traffic
Livadas, C., Walsh, R., Lapsley, D., et al. (2006) · Conference on Local Computer Networks · doi:10.1109/lcn.2006.322210 · Cited by 302 · see citing works
Using Genetic Algorithm for Network Intrusion Detection
Li, W. (2004) · Cited by 260 · see citing works
Bilge, L., Balzarotti, D., Robertson, W., et al. (2012) · Annual Computer Security Applications Conference · doi:10.1145/2420950.2420969 · Cited by 251 · see citing works
Using Decision Trees to Improve Signature-Based Intrusion Detection
Kruegel, C., & Toth, T. A. (2003) · Lecture notes in computer science · doi:10.1007/978-3-540-45248-5_10 · Cited by 242 · see citing works
Intrusion detection using fuzzy association rules
Tajbakhsh, A., Rahmati, M., & Mirzaei, A. (2008) · Applied Soft Computing · doi:10.1016/j.asoc.2008.06.001 · Cited by 241 · see citing works
Improving intrusion detection performance using keyword selection and neural networks
Lippmann, R. P., & Cunningham, R. K. (2000) · Computer Networks · doi:10.1016/s1389-1286(00)00140-7 · Cited by 240 · see citing works
Sequeira, K., & Zaki, M. J. (2002) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/775047.775103 · Cited by 229 · see citing works
Practical Data Hiding in TCP/IP
Ahsan, K., & Kundur, D. (2002) · Cited by 226 · see citing works
Using artificial anomalies to detect unknown and known network intrusions
Fan, W., Miller, M. L., Stolfo, S. J., et al. (2004) · Knowledge and Information Systems · doi:10.1007/s10115-003-0132-7 · Cited by 222 · see citing works
A Theory and Methodology of Inductive Learning
Michalski, R. S. (1983) · Springer eBooks · doi:10.1007/978-3-662-12405-5_4 · Cited by 222 · see citing works
NETWORK INTRUSION DETECTION USING NAÏVE BAYES
Panda, M., & Patra, M. R. (2007) · Cited by 219 · see citing works
Time complexity of evolutionary algorithms for combinatorial optimization: A decade of results
Oliveto, P. S., He, J., & Yao, X. (2007) · Machine Intelligence Research · doi:10.1007/s11633-007-0281-3 · Cited by 217 · see citing works
A THEORY AND METHODOLOGY OF INDUCTIVE LEARNING
Michalski, R. S. (1983) · Machine Learning · doi:10.1016/b978-0-08-051054-5.50008-x · Cited by 206 · see citing works
Robust Support Vector Machines for Anomaly Detection in Computer Security.
Hu, W., Liao, Y., & Vemuri, V. R. (2003) · International Conference on Machine Learning and Applications · Cited by 184 · see citing works
NETWORK-BASED INTRUSION DETECTION USING NEURAL NETWORKS
Bivens, A., Palagiri, C., Smith, R. N., et al. (2002) · Cited by 178 · see citing works
PMML: An Open Standard for Sharing Models
Guazzelli, A., Zeller, M., Lin, W.-C., & Williams, G. (2009) · The R Journal · doi:10.32614/rj-2009-010 · Cited by 162 · see citing works
A data mining approach for database intrusion detection
Hu, Y., & Panda, B. (2004) · ACM Symposium on Applied Computing · doi:10.1145/967900.968048 · Cited by 149 · see citing works
Detecting New Forms of Network Intrusion Using Genetic Programming
Lu, W., & Traoré, I. (2004) · Computational Intelligence · doi:10.1111/j.0824-7935.2004.00247.x · Cited by 141 · see citing works
Ye, N. (2013) · CRC Press eBooks · doi:10.1201/b15288-10 · Cited by 140 · see citing works
HMMPayl: An intrusion detection system based on Hidden Markov Models
Ariu, D., Tronci, R., & Giacinto, G. (2011) · Computers & Security · doi:10.1016/j.cose.2010.12.004 · Cited by 129 · see citing works
Evolutionary Design of Intrusion Detection Programs
Abraham, A., Groşan, C., & Martı́n-Vide, C. (2007) · doi:10.6633/ijns.200705.4(3).12 · Cited by 110 · see citing works
Investigating hidden Markov models capabilities in anomaly detection
Joshi, S. S., & Phoha, V. V. (2005) · doi:10.1145/1167350.1167387 · Cited by 96 · see citing works
Machine Learning Approach for IP-Flow Record Anomaly Detection
Wagner, C., François, J., State, R., & Engel, T. (2011) · Lecture notes in computer science · doi:10.1007/978-3-642-20757-0_3 · Cited by 91 · see citing works
A Framework for an Adaptive Intrusion Detection System using Bayesian Network
Jemili, F., Zaghdoud, M., & Ahmed, M. B. (2007) · IEEE International Conference on Intelligence and Security Informatics (ISI) · doi:10.1109/isi.2007.379535 · Cited by 85 · see citing works
Using Hidden Markov Models to Evaluate the Risks of Intrusions
Årnes, A., Valeur, F., Vigna, G., et al. (2006) · Lecture notes in computer science · doi:10.1007/11856214_8 · Cited by 78 · see citing works
Hansen, J. V., Lowry, P. B., Meservy, R. D., & McDonald, D. M. (2006) · Decision Support Systems · doi:10.1016/j.dss.2006.04.004 · Cited by 78 · see citing works
Comparative Study of Supervised Machine Learning Techniques for Intrusion Detection
Gharibian, F., & Ghorbani, A. A. (2007) · Conference on Communication Networks and Services Research · doi:10.1109/cnsr.2007.22 · Cited by 69 · see citing works
Comparative Analysis of Premises Valuation Models Using KEEL, RapidMiner, and WEKA
Graczyk, M., Lasota, T., & Trawiński, B. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-04441-0_70 · Cited by 60 · see citing works
Artificial intelligence and the future of cybersecurity
Morel, B. F. (2011) · doi:10.1145/2046684.2046699 · Cited by 58 · see citing works
A Naive Bayes Approach for Detecting Coordinated Attacks
Benferhat, S., Kenaza, T., & Mokhtari, A. (2008) · doi:10.1109/compsac.2008.213 · Cited by 49 · see citing works
Machine Learning Applied to Cyber Operations
Blowers, M. K., & Williams, J. (2013) · Advances in information security · doi:10.1007/978-1-4614-7597-2_10 · Cited by 48 · see citing works
Rule based Network Intrusion Detection using Genetic Algorithm
Khan, M. S. A. (2011) · International Journal of Computer Applications · doi:10.5120/2303-2914 · Cited by 46 · see citing works
Using data mining to discover signatures in network-based intrusion detection
Han, H. L., Lu, X.-L., & Ren, L.-Y. (2003) · International Conference on Machine Learning and Cybernetics · doi:10.1109/icmlc.2002.1176698 · Cited by 41 · see citing works
Cyber Security Challenges: Designing Efficient Intrusion Detection Systems and Antivirus Tools
Mukkamala, S., Sung, A. H., & Abraham, A. (2004) · Cited by 41 · see citing works
Characterizing network traffic by means of the NetMine framework
Apiletti, D., Baralis, E., Cerquitelli, T., et al. (2008) · Computer Networks · doi:10.1016/j.comnet.2008.12.011 · Cited by 39 · see citing works
Beyer, H.-G. (2007) · Scholarpedia · doi:10.4249/scholarpedia.1965 · Cited by 38 · see citing works
A Novel Network Intrusion Detection System (NIDS) Based on Signatures Search of Data Mining
Hu, Z., Zhitang, L., & Junqi, W. (2008) · doi:10.1109/wkdd.2008.48 · Cited by 38 · see citing works
Boosting the Area under the ROC Curve
Long, P., & Servedio, R. A. (2007) · Cited by 33 · see citing works
OMC-IDS: At the Cross-Roads of OLAP Mining and Intrusion Detection
Brahmi, H., Brahmi, I., & Yahia, S. B. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-30220-6_2 · Cited by 32 · see citing works
Towards Quantifying the Possible Risk in e-commerce Interactions for RDSS
Hussain, F. K., Chang, E. J., Hussain, F. K., & Dillon, T. S. (2007) · IEEE International Conference on e-Business Engineering (ICEBE) · doi:10.1109/icebe.2007.89 · Cited by 30 · see citing works
Intrusion signature creation via clustering anomalies
Hendry, G., & Yang, S. J. (2008) · Proceedings of SPIE, the International Society for Optical Engineering/Proceedings of SPIE · doi:10.1117/12.775886 · Cited by 28 · see citing works
Real-Time Correlation of Network Security Alerts
Li, Z., Zhang, A., Lei, J., & Wang, L. (2007) · IEEE International Conference on e-Business Engineering (ICEBE) · doi:10.1109/icebe.2007.69 · Cited by 25 · see citing works
Sung, A. H., Abraham, A., & Mukkamala, S. (2005) · Auerbach Publications eBooks · doi:10.1201/9781420031225.ch6 · Cited by 11 · see citing works
Improving a neuro-fuzzy classifier using exploratory factor analysis
Martens, J., Wets, G., Vanthienen, J., & Mues, C. (2000) · International Journal of Intelligent Systems · doi:10.1002/1098-111x(200008)15:8 · Cited by 3 · see citing works
Flagged first, then by citations
1 of the 119 references couldn’t be matched to a known paper.
Research works printed but not linked: 14
- Shearer, 2000, The CRISP-DM model: The new blueprint for data mining, J. Data Warehouse., 5, 13
- 2000, R Core Team
- Jacobson, 1989, The Tcpdump Manual Page
- Combs, 2014, Wireshark
- 2014, Sourcefire
- Stolfo, 2014, KDD Cup 1999 Data Set
- 2015, IBM
- 10.4108/wkdd.2008.2686 · DOI
- 2014, Politecnico di Torino, Analyzer 3.0
- Baralis, 2008, Generalized Itemset Discovery by Means of Opportunistic Aggregation
- Markov, 1971, Extension of the limit theorems of probability theory to a sum of variables connected in a chain, Dynamic Probabilistic Systems, 1
- 10.2307/2984875 · DOI
- Brauckhoff, 2008, Flame: A low-level anomaly modeling engine
- Paxson, 2004, Bro 0.9
Cited by
Sorted by citations
A Deep Learning Approach for Intrusion Detection Using Recurrent Neural Networks
Yin, C., Zhu, Y., Fei, J., & He, X. (2017) · IEEE Access · doi:10.1109/access.2017.2762418 · Cited by 2,100 · see citing works
Survey of intrusion detection systems: Techniques, datasets and challenges
Khraisat, A., Gondal, I., Vamplew, P., & Kamruzzaman, J. (2019) · Cybersecurity · doi:10.1186/s42400-019-0038-7 · Cited by 2,024 · see citing works
“AIDS methods can be categorized into three main groups: Statistics-based (Chao et al., 2015), knowledge-based (Elhag et al., 2015; Can & Sahingoz, 2015), and machine learning-based (Buczak & Guven, 2016; Mesh-ram & Haas, 2017).”
Deep Learning in Mobile and Wireless Networking: A Survey
Zhang, C., Patras, P., & Haddadi, H. (2019) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2019.2904897 · Cited by 1,847 · see citing works
A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security
Al-Garadi, M. A., Mohamed, A., Al-Ali, A. K., Du, X., Ali, I., & Guizani, M. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.2988293 · Cited by 1,392 · see citing works
Ahmad, Z., Khan, A. S., Shiang, C. W., Abdullah, J., & Ahmad, F. (2020) · Transactions on Emerging Telecommunications Technologies · doi:10.1002/ett.4150 · Cited by 1,313 · see citing works
Time Series FeatuRe Extraction on basis of Scalable Hypothesis tests (tsfresh – A Python package)
Christ, M., Braun, N., Neuffer, J., & Kempa-Liehr, A. W. (2018) · Neurocomputing · doi:10.1016/j.neucom.2018.03.067 · Cited by 1,269 · see citing works
Machine Learning and Deep Learning Methods for Cybersecurity
Xin, Y., Kong, L., Liu, Z., Chen, Y., Li, Y., Zhu, H., Gao, M., Hou, H., & Wang, C. (2018) · IEEE Access · doi:10.1109/access.2018.2836950 · Cited by 1,228 · see citing works
Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study
Ferrag, M. A., Maglaras, L. A., Moschoyiannis, S., & Janicke, H. (2019) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2019.102419 · Cited by 1,298 · see citing works
“Buczak et al. [8] presented a study of machine learning approaches used by the intrusion detection systems.”
MethodMachine Learning and Deep Learning Methods for Intrusion Detection Systems: A Survey
Liu, H., & Lang, B. (2019) · Applied Sciences · doi:10.3390/app9204396 · Cited by 1,133 · see citing works
“Several previous surveys [3–5] have classified research efforts by their applied machine learning algorithms.”
BackgroundDeep Neural Networks and Tabular Data: A Survey
Borisov, V., Leemann, T., Seßler, K., Haug, J., Pawelczyk, M., & Kasneci, G. (2022) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3229161 · Cited by 1,182 · see citing works
Boutaba, R., Salahuddin, M. A., Limam, N., Ayoubi, S., Shahriar, N., Estrada-Solano, F., & Caicedo, O. M. (2018) · Journal of Internet Services and Applications · doi:10.1186/s13174-018-0087-2 · Cited by 1,036 · see citing works
“More recently, [82] looked at the application of Data Mining and ML for cyber-security intrusion detection.”
BackgroundInfluentialA survey of network-based intrusion detection data sets
Ring, M., Wunderlich, S., Scheuring, D., Landes, D., & Andreas Hotho, A. (2019) · Computers & Security · doi:10.1016/j.cose.2019.06.005 · Cited by 977 · see citing works
Network Intrusion Detection for IoT Security Based on Learning Techniques
Chaabouni, N., Mosbah, M., Zemmari, A., Sauvignac, C., & Faruki, P. (2019) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2019.2896380 · Cited by 945 · see citing works
Alsaedi, A., Moustafa, N., Tari, Z., Mahmood, A. N., & Anwar, A. (2020) · IEEE Access · doi:10.1109/access.2020.3022862 · Cited by 983 · see citing works
A Survey on the Internet of Things (IoT) Forensics: Challenges, Approaches, and Open Issues
Stoyanova, M., Nikoloudakis, Y., Panagiotakis, S., Pallis, E., & Markakis, E. K. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2019.2962586 · Cited by 852 · see citing works
Machine Learning in IoT Security: Current Solutions and Future Challenges
Hussain, F., Hussain, R., Hassan, S. A., & Hossain, E. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.2986444 · Cited by 129 · see citing works
Machine Learning for Anomaly Detection: A Systematic Review
Nassif, A. B., Talib, M. A., Nasir, Q., & Dakalbab, F. M. (2021) · IEEE Access · doi:10.1109/access.2021.3083060 · Cited by 748 · see citing works
A Detailed Investigation and Analysis of Using Machine Learning Techniques for Intrusion Detection
Mishra, P., Varadharajan, V., Tupakula, U. K., & Pilli, E. S. (2018) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2018.2847722 · Cited by 745 · see citing works
Xie, J., Yu, F. R., Huang, T., Xie, R., Liu, J., Wang, C., & Liu, Y. (2019) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2018.2866942 · Cited by 700 · see citing works
IoT Security Techniques Based on Machine Learning: How Do IoT Devices Use AI to Enhance Security?
Xiao, L., Wan, X., Lu, X., Zhang, Y., & Wu, D. (2018) · IEEE Signal Processing Magazine · doi:10.1109/msp.2018.2825478 · Cited by 681 · see citing works
“ML techniques such as SVMs, K-NNs, and NNs have been used for intrusion detection [15].”
MethodWang, W., Sheng, Y., Wang, J., Zeng, X., Ye, X., Huang, Y., & Zhu, M. (2017) · IEEE Access · doi:10.1109/access.2017.2780250 · Cited by 664 · see citing works
A Survey of Deep Learning: Platforms, Applications and Emerging Research Trends
Hatcher, W. G., & Yu, W. (2018) · IEEE Access · doi:10.1109/access.2018.2830661 · Cited by 654 · see citing works
A Survey on Industrial Internet of Things: A Cyber-Physical Systems Perspective
Xu, H., Yu, W., Griffith, D., & Golmie, N. (2018) · IEEE Access · doi:10.1109/access.2018.2884906 · Cited by 637 · see citing works
An Overview on Application of Machine Learning Techniques in Optical Networks
Musumeci, F., Rottondi, C., Nag, A., Irene Macaluso, B., Zibar, D., Ruffini, M., & Tornatore, M. (2018) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2018.2880039 · Cited by 644 · see citing works
Unsupervised Machine Learning for Networking: Techniques, Applications and Research Challenges
Usama, M., Qadir, J., Raza, A., Arif, H., Yau, K. A., Elkhatib, Y., Hussain, A., & Al‐Fuqaha, A. (2019) · IEEE Access · doi:10.1109/access.2019.2916648 · Cited by 621 · see citing works
Smart Cities: A Survey on Data Management, Security, and Enabling Technologies
Gharaibeh, A., Salahuddin, M. A., Hussini, S. J., Khreishah, A., Khalil, I., Guizani, M., & Al-Fuqaha, A. (2017) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2017.2736886 · Cited by 628 · see citing works
Thirty Years of Machine Learning: The Road to Pareto-Optimal Wireless Networks
Wang, J., Jiang, C., Zhang, H., Ren, Y., Chen, K.-C., & Hanzo, L. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.2965856 · Cited by 557 · see citing works
A Survey on Machine Learning Techniques for Cyber Security in the Last Decade
Shaukat, K., Luo, S., Varadharajan, V., Hameed, I. A., & Xu, M. (2020) · IEEE Access · doi:10.1109/access.2020.3041951 · Cited by 567 · see citing works
Hossain, E., Khan, I., Un-Noor, F., Sikander, S. S., & Sunny, M. S. H. (2019) · IEEE Access · doi:10.1109/access.2019.2894819 · Cited by 514 · see citing works
“[248] A. L. Buczak and E. Guven, ‘‘A survey of data mining and machine learning methods for cyber security intrusion detection,’’ IEEE Commun.”
BackgroundKhraisat, A., & Alazab, A. (2021) · Cybersecurity · doi:10.1186/s42400-021-00077-7 · Cited by 540 · see citing works
Pajouh, H. H., Javidan, R., Khayami, R., Dehghantanha, A., & Choo, K. R. (2016) · IEEE Transactions on Emerging Topics in Computing · doi:10.1109/tetc.2016.2633228 · Cited by 504 · see citing works
Real-time big data processing for anomaly detection: A survey
Ariyaluran Habeeb, R. A., Nasaruddin, F., Gani, A., Targio Hashem, I. A., Ahmed, E., & Imran, M. (2019) · International Journal of Information Management · doi:10.1016/j.ijinfomgt.2018.08.006 · Cited by 487 · see citing works
Wahab, O. A., Mourad, A., Otrok, H., & Taleb, T. (2021) · IEEE Communications Surveys and Tutorials · doi:10.1109/comst.2021.3058573 · Cited by 444 · see citing works
Deep reinforcement learning for cyber security
Nguyen, T. T., & Reddi, V. J. (2023) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2021.3121870 · Cited by 620 · see citing works
A Survey of Deep Learning Methods for Cyber Security
Berman, D. S., Buczak, A. L., Chavis, J. S., & Corbett, C. L. (2019) · Information · doi:10.3390/info10040122 · Cited by 569 · see citing works
Self-citationMachine learning based solutions for security of Internet of Things (IoT): A survey
Tahsien, S. M., Karimipour, H., & Spachos, P. (2020) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2020.102630 · Cited by 483 · see citing works
“being used to detect the intrusion attack [88], [147][148].”
BackgroundMethodAdversarial Machine Learning for Network Intrusion Detection Systems: A Comprehensive Survey
He, K., Kim, D. S., & Asghar, M. R. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2022.3233793 · Cited by 493 · see citing works
CICIDS-2017 Dataset Feature Analysis With Information Gain for Anomaly Detection
Kurniabudi, K., Stiawan, D., Darmawijoyo, Idris, M. Y., Bamhdi, A. M., & Budiarto, R. (2020) · IEEE Access · doi:10.1109/access.2020.3009843 · Cited by 457 · see citing works
Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research
Zhang, Z., Hamadi, H. A., Damiani, E., Yeun, C. Y., & Taher, F. (2022) · IEEE Access · doi:10.1109/access.2022.3204051 · Cited by 450 · see citing works
Sharma, S. K., & Wang, X. (2019) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2019.2916177 · Cited by 440 · see citing works
“In addition, Neural Networks (NNs) can be utilized to detect network intrusion and in this context, authors in [31] have provided a comprehensive review of ML and data mining techniques for intrusion detection in cyber analytic applications.”
BackgroundVariational LSTM Enhanced Anomaly Detection for Industrial Big Data
Zhou, X., Hu, Y., Liang, W., Ma, J., & Jin, Q. (2020) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2020.3022432 · Cited by 403 · see citing works
Lucid: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection
Doriguzzi-Corin, R., Millar, S., Scott-Hayward, S., Martínez-del-Rincón, J., & Siracusa, D. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.2971776 · Cited by 393 · see citing works
An intrusion detection system for connected vehicles in smart cities
Aloqaily, M., Otoum, S., Ridhawi, I. A., & Jararweh, Y. (2019) · Ad Hoc Networks · doi:10.1016/j.adhoc.2019.02.001 · Cited by 390 · see citing works
Deep learning methods in network intrusion detection: A survey and an objective comparison
Gamage, S., & Samarabandu, J. K. (2020) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2020.102767 · Cited by 405 · see citing works
A GA-LR wrapper approach for feature selection in network intrusion detection
Khammassi, C., & Krichen, S. (2017) · Computers & Security · doi:10.1016/j.cose.2017.06.005 · Cited by 384 · see citing works
“This process is repeated until a leaf node is reached which represents the class of the tested instance (Buczak and Guven, 2016).”
BackgroundA comprehensive survey on network anomaly detection
Fernandes, G., Rodrigues, J. J. P. C., Carvalho, L. F., Al-Muhtadi, J. F., & Proença, M. L. (2018) · Telecommunication Systems · doi:10.1007/s11235-018-0475-8 · Cited by 396 · see citing works
A Survey of Random Forest Based Methods for Intrusion Detection Systems
Resende, P. A. A., & Drummond, A. C. (2018) · ACM Computing Surveys · doi:10.1145/3178582 · Cited by 369 · see citing works
“For example, Buczak and Guven (2016) provide two paragraphs for a Random Forest review and cite three works which use this method.”
BackgroundMethodResultInfluentialPacheco, F., Expósito, E., Gineste, M., Baudoin, C., & Aguilar, J. (2018) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2018.2883147 · Cited by 371 · see citing works
Thakkar, A., & Lohiya, R. (2020) · Archives of Computational Methods in Engineering · doi:10.1007/s11831-020-09496-0 · Cited by 368 · see citing works
Artificial intelligence, cyber-threats and industry 4.0: challenges and opportunities
Bécue, A., Praça, I., & Gama, J. (2021) · Artificial Intelligence Review · doi:10.1007/s10462-020-09942-2 · Cited by 368 · see citing works
Zhang, F., Kodituwakku, H. A. D. E., Hines, J. W., & Coble, J. B. (2019) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2019.2891261 · Cited by 364 · see citing works
A systematic literature review of methods and datasets for anomaly-based network intrusion detection
Yang, Z., Liu, X., Li, T., Wu, D., Wang, J., Zhao, Y., & Han, H. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102675 · Cited by 363 · see citing works
An Explainable Machine Learning Framework for Intrusion Detection Systems
Wang, M., Zheng, K., Yang, Y., & Wang, X. (2020) · IEEE Access · doi:10.1109/access.2020.2988359 · Cited by 378 · see citing works
Intrusion Detection System for Healthcare Systems Using Medical and Network Data: A Comparison Study
Hady, A. A., Ghubaish, A., Salman, T., Ünal, D., & Jain, R. K. (2020) · IEEE Access · doi:10.1109/access.2020.3000421 · Cited by 359 · see citing works
On the effectiveness of machine and deep learning for cyber security
Apruzzese, G., Colajanni, M., Ferretti, L., Guido, A., & Marchetti, M. (2018) · doi:10.23919/cycon.2018.8405026 · Cited by 358 · see citing works
TSDL: A Two-Stage Deep Learning Model for Efficient Network Intrusion Detection
Khan, F. A., Gumaei, A., Derhab, A., & Hussain, A. (2019) · IEEE Access · doi:10.1109/access.2019.2899721 · Cited by 363 · see citing works
Thakkar, A., & Lohiya, R. (2021) · Artificial Intelligence Review · doi:10.1007/s10462-021-10037-9 · Cited by 375 · see citing works
From Fluid Flow to Coupled Processes in Fractured Rock: Recent Advances and New Frontiers
Viswanathan, H., Ajo‐Franklin, J., Birkhölzer, J., Carey, J. W., Guglielmi, Y., Hyman, J. D., Karra, S., Pyrak‐Nolte, L. J., Rajaram, H., Srinivasan, G., et al. (2022) · Reviews of Geophysics · doi:10.1029/2021rg000744 · Cited by 349 · see citing works
Building Auto-Encoder Intrusion Detection System based on random forest feature selection
Li, X., Chen, W., Zhang, Q., & Wu, L. (2020) · Computers & Security · doi:10.1016/j.cose.2020.101851 · Cited by 340 · see citing works
IntruDTree: A Machine Learning Based Cyber Security Intrusion Detection Model
Sarker, I. H., Abushark, Y. B., Alsolami, F., & Khan, A. I. (2020) · Symmetry · doi:10.3390/sym12050754 · Cited by 356 · see citing works
Robust detection for network intrusion of industrial IoT based on multi-CNN fusion
Li, Y., Xu, Y., Liu, Z., Hou, H., Zheng, Y., Xin, Y., Zhao, Y., & Cui, L. (2019) · Measurement · doi:10.1016/j.measurement.2019.107450 · Cited by 336 · see citing works
Asharf, J., Moustafa, N., Khurshid, H., Debie, E., Haider, W., & Wahab, A. (2020) · Electronics · doi:10.3390/electronics9071177 · Cited by 378 · see citing works
“There are other studies [35,36], which discussed the feasibility of both ML and data mining techniques to detect intrusions in IoT networks by implementing these techniques in IDSs either through detecting anomalies or classification of traffic.”
BackgroundData-Driven Cybersecurity Incident Prediction: A Survey
Sun, N., Zhang, J., Rimba, P., Gao, S., Zhang, L. Y., & Xiang, Y. (2018) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2018.2885561 · Cited by 331 · see citing works
Application of deep learning to cybersecurity: A survey
Mahdavifar, S., & Ghorbani, A. A. (2019) · Neurocomputing · doi:10.1016/j.neucom.2019.02.056 · Cited by 329 · see citing works
Survey of Attack Projection, Prediction, and Forecasting in Cyber Security
Husák, M., Komárková, J., Bou‐Harb, E., & Čeleda, P. (2018) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2018.2871866 · Cited by 322 · see citing works
A survey on attack detection, estimation and control of industrial cyber–physical systems
Zhang, D., Wang, Q., Feng, G., Shi, Y., & Vasilakos, A. V. (2021) · ISA Transactions · doi:10.1016/j.isatra.2021.01.036 · Cited by 318 · see citing works
A holistic review of Network Anomaly Detection Systems: A comprehensive survey
Moustafa, N., Hu, J., & Slay, J. (2018) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2018.12.006 · Cited by 318 · see citing works
Harnessing Artificial Intelligence Capabilities to Improve Cybersecurity
Zeadally, S., Adi, E., Baig, Z. A., & Khan, I. A. (2020) · IEEE Access · doi:10.1109/access.2020.2968045 · Cited by 334 · see citing works
Blockchain and Machine Learning for Communications and Networking Systems
Liu, Y., Yu, F. R., Li, X., Ji, H., & Leung, V. C. M. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.2975911 · Cited by 325 · see citing works
Enterprise data breach: causes, challenges, prevention, and future directions
Cheng, L., Liu, F., & Yao, D. D. (2017) · Wiley Interdisciplinary Reviews Data Mining and Knowledge Discovery · doi:10.1002/widm.1211 · Cited by 308 · see citing works
Performance Comparison and Current Challenges of Using Machine Learning Techniques in Cybersecurity
Shaukat, K., Luo, S., Varadharajan, V., Hameed, I. A., Chen, S., Liu, D., & Li, J. (2020) · Energies · doi:10.3390/en13102509 · Cited by 303 · see citing works
“On the DARPA dataset, NB and ANN performed better accuracy than other models, but ANN has given worse precision value on DARPA dataset.”
InfluentialA Self-Adaptive Deep Learning-Based System for Anomaly Detection in 5G Networks
Maimó, L. F., Gómez, Á. L. P., Clemente, F. J. G., Pérez, M. G., & Pérez, G. M. (2018) · IEEE Access · doi:10.1109/access.2018.2803446 · Cited by 302 · see citing works
“They moved from inspecting raw network packets to analyzing traffic network flows with innovative AI-based techniques [7].”
BackgroundDeepCoin: A Novel Deep Learning and Blockchain-Based Energy Exchange Framework for Smart Grids
Ferrag, M. A., & Maglaras, L. (2020) · IEEE Transactions on Engineering Management · doi:10.1109/tem.2019.2922936 · Cited by 358 · see citing works
A survey of edge computing-based designs for IoT security
Sha, K., Yang, T. A., Wei, W., & Davari, S. (2020) · Digital Communications and Networks · doi:10.1016/j.dcan.2019.08.006 · Cited by 295 · see citing works
Detecting crypto-ransomware in IoT networks based on energy consumption footprint
Azmoodeh, A., Dehghantanha, A., Conti, M., & Choo, K. R. (2017) · Journal of Ambient Intelligence and Humanized Computing · doi:10.1007/s12652-017-0558-5 · Cited by 295 · see citing works
“Similar to the approach in (Buczak and Guven 2016), we use the following four common performance indicators for malware detection:”
MethodA Review of the Advancement in Intrusion Detection Datasets
Thakkar, A., & Lohiya, R. (2020) · Procedia Computer Science · doi:10.1016/j.procs.2020.03.330 · Cited by 293 · see citing works
The Role of Machine Learning in Cybersecurity
Apruzzese, G., Laskov, P., de, E. M., Mallouli, W., Búrdalo, L., Grammatopoulos, A. V., & Franco, F. D. (2022) · Digital Threats Research and Practice · doi:10.1145/3545574 · Cited by 291 · see citing works
An Unsupervised Deep Learning Model for Early Network Traffic Anomaly Detection
Hwang, R., Peng, M.-C., Huang, C., Lin, P., & Nguyen, V.-L. (2020) · IEEE Access · doi:10.1109/access.2020.2973023 · Cited by 283 · see citing works
Malicious URL Detection using Machine Learning: A SurveyPreprint
Sahoo, D., Liu, C., & Hoi, S. C. H. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1701.07179 · Cited by 283 · see citing works
“fy the limitations of the current models [162], and provide directions for future research. 7 RELATED SURVEYS Recent years have witnessed innovative applications of machine learning in cyber security [26, 52, 164]. They discuss a variety of other cyber threats, and do not focus on Malicious URL Detection. For example,…”
BackgroundBlockchain Security: A Survey of Techniques and Research Directions
Leng, J., Zhou, M., Zhao, J. L., Huang, Y., & Bian, Y. (2020) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2020.3038641 · Cited by 289 · see citing works
A Taxonomy of Network Threats and the Effect of Current Datasets on Intrusion Detection Systems
Hindy, H., Brosset, D., Bayne, E., Seeam, A. K., Tachtatzis, C., Atkinson, R. C., & Bellekens, X. (2020) · IEEE Access · doi:10.1109/access.2020.3000179 · Cited by 283 · see citing works
A systematic literature review for network intrusion detection system (IDS)
Abdulganiyu, O. H., Ait Tchakoucht, T., & Saheed, Y. K. (2023) · International Journal of Information Security · doi:10.1007/s10207-023-00682-2 · Cited by 279 · see citing works
The rise of traffic classification in IoT networks: A survey
Tahaei, H., Afifi, F., Asemi, A., Zaki, F., & Anuar, N. B. (2020) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2020.102538 · Cited by 277 · see citing works
Ferrag, M. A., Maglaras, L. A., Argyriou, A., Kosmanos, D., & Janicke, H. (2017) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2017.10.017 · Cited by 277 · see citing works
“section III-B, data mining and machine learning methods are used to help discover, determine, and identify unauthorized use and destruction of information systems, such as 4G and 5G cellular networks [246]. Buczak 19 and Guven [246] have found that the most intrusion detection systems used the DARPA 1998, DARPA 1999,…”
MethodA Machine Learning Security Framework for Iot Systems
Bagaa, M., Taleb, T., Bernabe, J. B., & Skarmeta, A. (2020) · IEEE Access · doi:10.1109/access.2020.2996214 · Cited by 271 · see citing works
Machine Learning-Powered Encrypted Network Traffic Analysis: A Comprehensive Survey
Shen, M., Ye, K., Liu, X., Zhu, L., Kang, J., Yu, S., Li, Q. L., & Xu, K. (2022) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2022.3208196 · Cited by 286 · see citing works
Cybersecurity, Data Privacy and Blockchain: A Review
Wylde, V., Rawindaran, N., Lawrence, J., et al. (2022) · SN Computer Science · doi:10.1007/s42979-022-01020-4 · Cited by 266 · see citing works
Ullah, A., Anwar, S. M., Li, J., Nadeem, L., Mahmood, T., Rehman, A. U., & Saba, T. (2023) · Complex & Intelligent Systems · doi:10.1007/s40747-023-01175-4 · Cited by 315 · see citing works
Machine learning in cybersecurity: a comprehensive survey
Dasgupta, D., Akhtar, Z., & Sen, S. (2020) · The Journal of Defense Modeling and Simulation Applications Methodology Technology · doi:10.1177/1548512920951275 · Cited by 262 · see citing works
An Evolutionary SVM Model for DDOS Attack Detection in Software Defined Networks
Sahoo, K. S., Tripathy, B. K., Naik, K., Ramasubbareddy, S., Balusamy, B., Khari, M., & Burgos, D. (2020) · IEEE Access · doi:10.1109/access.2020.3009733 · Cited by 261 · see citing works
A review of Machine Learning-based zero-day attack detection: Challenges and future directions
Guo, Y. (2022) · Computer Communications · doi:10.1016/j.comcom.2022.11.001 · Cited by 262 · see citing works
“While multiple surveys have been conducted on intrusion detection and malware detection using various approaches [14–18], none has been focused on ML-based zero-day attack detection schemes.”
Azam, Z., Islam, M. M., & Huda, M. N. (2023) · IEEE Access · doi:10.1109/access.2023.3296444 · Cited by 265 · see citing works
A survey on evolutionary machine learning
Al-Sahaf, H., Bi, Y., Chen, Q., Lensen, A., Mei, Y., Sun, Y., Tran, B., Xue, B., & Zhang, M. (2019) · Journal of the Royal Society of New Zealand · doi:10.1080/03036758.2019.1609052 · Cited by 258 · see citing works
“…predict natural disaster, especially earthquake (Asim et al. 2018; Scoble et al. 2013), and other real-world problems, such as web service composition (da Silva et al. 2016), cloud computing (Guzek et al. 2015), cyber security (Buczak and Guven 2016), and video games (Yannakakis and Togelius 2018).”
BackgroundThakkar, A., & Lohiya, R. (2022) · Information Fusion · doi:10.1016/j.inffus.2022.09.026 · Cited by 258 · see citing works
A survey on graph neural networks for intrusion detection systems: Methods, trends and challenges
Zhong, M., Lin, M., Zhang, C., & Xu, Z. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103821 · Cited by 262 · see citing works
Deep Learning-Based Intrusion Detection for Distributed Denial of Service Attack in Agriculture 4.0
Ferrag, M. A., Shu, L., Hamouda, D., & Choo, K. R. (2021) · Electronics · doi:10.3390/electronics10111257 · Cited by 253 · see citing works
Survey on Explainable AI: From Approaches, Limitations and Applications Aspects
Yang, W., Wei, Y.-C., Wei, H., Chen, Y., Huang, G., Li, X., Li, R., Yao, N., Wang, X., Gu, X., et al. (2023) · Human-Centric Intelligent Systems · doi:10.1007/s44230-023-00038-y · Cited by 275 · see citing works
Neupane, S., Ables, J., Anderson, W. S., Mittal, S., Rahimi, S., Banicescu, I., & Seale, M. A. (2022) · IEEE Access · doi:10.1109/access.2022.3216617 · Cited by 293 · see citing works
Flow-based network traffic generation using Generative Adversarial Networks
Ring, M., Schlör, D., Landes, D., & Andreas Hotho, A. (2018) · Computers & Security · doi:10.1016/j.cose.2018.12.012 · Cited by 246 · see citing works
“Recently, Buczak and Guven [1] presented an overview of the community effort with regard to this issue.”
BackgroundAI-Based Two-Stage Intrusion Detection for Software Defined IoT Networks
Li, J., Zhao, Z., Li, R., & Zhang, H. (2018) · IEEE Internet of Things Journal · doi:10.1109/jiot.2018.2883344 · Cited by 245 · see citing works
- Authors
- Buczak, A. L., & Guven, E.
- Affiliations
- Johns Hopkins University (US)
- ORCID
- Buczak, Anna L.
- Venue
- IEEE Communications Surveys & Tutorials
- Published
- 2016
- Volume
- 18
- Issue
- 2
- Pages
- 1153-1176
- ISSN
- 1553-877X (ISSN-L)
- 2373-745X
- OpenAlex
- W2342408547
- Semantic Scholar
- 971766088dfaf63fb55e6f0190b14f28f2c98ad0
- Cited by
- 3,332
- References
- 119
- Citations by year
- 2026: 460 · 2025: 395 · 2024: 297 · 2023: 319 · 2022: 403 · 2021: 447 · 2020: 394 · 2019: 314 · 2018: 217 · 2017: 73 · 2016: 11 · 2015: 1 · 2012: 1
- FWCI
- 115.39
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- IEEE Communications Surveys & Tutorials (publishedVersion)
- Funders
- Department of Homeland Security Network Security Deployment Division (HSSA01-13-C-2709)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Physical Sciences › Engineering › Biomedical Engineering › Artificial Immune Systems Applications
- Keywords
- intrusion detection, cybersecurity, machine learning, data mining, algorithmic complexity
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review