Cited by 3,332Network Security and Intrusion DetectionNetwork Packet Processing and OptimizationArtificial Immune Systems Applications

The DOI matches its Crossref record; 114 of the 119 references it cites were found in a registry or an index, and 4 are not checked yet.

A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection

Buczak, Anna L., Guven, Erhan·2016·IEEE Communications Surveys & Tutorials

DOI 10.1109/comst.2015.2494502

Open this paper in CoChat — free account

Abstract

This survey paper describes a focused literature survey of machine learning (ML) and data mining (DM) methods for cyber analytics in support of intrusion detection. Short tutorial descriptions of each ML/DM method are provided. Based on the number of citations or the relevance of an emerging method, papers representing each method were identified, read, and summarized. Because data are so important in ML/DM approaches, some well-known cyber data sets used in ML/DM are described. The complexity of ML/DM algorithms is addressed, discussion of challenges for using ML/DM for cyber security is presented, and some recommendations on when to use a given method are provided.

Integrity signals

Registry

Crossref · 10.1109/comst.2015.2494502

Cites

114 of 118 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Random Forests
Breiman, L. (2001) · Machine Learning · doi:10.1023/a:1010933404324 · Cited by 133,538
Fuzzy sets
Zadeh, L. A. (1965) · Information and Control · doi:10.1016/s0019-9958(65)90241-x · Cited by 67,855
Particle swarm optimization
Kennedy, J., & Eberhart, R. (2002) · Proceedings of ICNN'95 - International Conference on Neural Networks · doi:10.1109/icnn.1995.488968 · Cited by 58,192
Maximum Likelihood from Incomplete Data Via the EM Algorithm
Dempster, A. P., Laird, N. M., & Rubin, D. B. (1977) · Journal of the Royal Statistical Society Series B: Statistical Methodology · doi:10.1111/j.2517-6161.1977.tb01600.x · Cited by 50,444
Fuzzy sets
Zadeh, L. A. (1996) · Cited by 46,960
The Nature of Statistical Learning Theory
Vapnik, V. (2000) · Statistics for Engineering and Information Science · doi:10.1007/978-1-4757-3264-1 · Cited by 46,387
Collective dynamics of ‘small-world’ networks
Watts, D. J., & Strogatz, S. H. (1998) · Nature · doi:10.1038/30918 · Cited by 43,060
The Nature of Statistical Learning Theory
Vapnik, V. N. (1995) · doi:10.1007/978-1-4757-2440-0 · Cited by 39,138
Data Mining: Practical Machine Learning Tools and Techniques
Witten, I. H., Frank, E., & Hall, M. A. (2011) · Elsevier eBooks · doi:10.1016/c2009-0-19715-5 · Cited by 25,543
Untitled work
(1992) · Cited by 23,431

Flagged first, then by citations

Show all 119 references

1 of the 119 references couldn’t be matched to a known paper.

Research works printed but not linked: 14

Shearer, 2000, The CRISP-DM model: The new blueprint for data mining, J. Data Warehouse., 5, 13
2000, R Core Team
Jacobson, 1989, The Tcpdump Manual Page
Combs, 2014, Wireshark
2014, Sourcefire
Stolfo, 2014, KDD Cup 1999 Data Set
2015, IBM
10.4108/wkdd.2008.2686 · DOI
2014, Politecnico di Torino, Analyzer 3.0
Baralis, 2008, Generalized Itemset Discovery by Means of Opportunistic Aggregation
Markov, 1971, Extension of the limit theorems of probability theory to a sum of variables connected in a chain, Dynamic Probabilistic Systems, 1
10.2307/2984875 · DOI
Brauckhoff, 2008, Flame: A low-level anomaly modeling engine
Paxson, 2004, Bro 0.9

Sorted by citations

Items 901–1,000 of 1,004

Neural Networks Toward Cybersecurity: Domain Map Analysis of State-of-the-Art Challenges
Shevchuk, R., & Martsenyuk, V. (2024) · IEEE Access · doi:10.1109/access.2024.3411632 · Cited by 23
A Privacy-Preserving Graph Neural Network for Network Intrusion Detection
Pei, X., Deng, X., Tian, S., Jiang, P., Zhao, Y., & Xue, K. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2024.3417853 · Cited by 20
A machine learning approach for cost prediction analysis in environmental governance engineering
Ai, D. M., & Yang, J. (2018) · Neural Computing and Applications · doi:10.1007/s00521-018-3860-z · Cited by 20
A Cascade-structured Meta-Specialists Approach for Neural Network-based Intrusion Detection
Labonne, M., Olivereau, A., Polve, B., et al. (2019) · IEEE Consumer Communications & Networking Conference (CCNC) · doi:10.1109/ccnc.2019.8651856 · Cited by 20
Semi-supervised tri-Adaboost algorithm for network intrusion detection
Yuan, Y., Huo, L., Yuan, Y., et al. (2019) · International Journal of Distributed Sensor Networks · doi:10.1177/1550147719846052 · Cited by 20
“Network intrusion detection systems (IDSs) are often used for monitoring, detecting, and analyzing events which flagged as violating network security policies.(2) In general, IDSs are mainly categorized into two categories: host-based IDSs and networkbased IDSs.”
Background
Finding Needles in a Moving Haystack: Prioritizing Alerts with Adversarial Reinforcement Learning
Tong, L., Lászka, Á., Yan, C., Zhang, N., & Vorobeychik, Y. (2020) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v34i01.5442 · Cited by 24
A Novel Intrusion Detection Model Using a Fusion of Network and Device States for Communication-Based Train Control Systems
Song, Y., Bu, B., & Zhu, L. (2020) · Electronics · doi:10.3390/electronics9010181 · Cited by 21
“As the anomaly based IDS can be used to detect “zero day” attacks that have not been disclosed before, it has attracted the attention of more and more researchers [10,11].”
BackgroundMethodInfluential
A Machine Learning Approach for Traffic Flow Provisioning in Software Defined Networks
Kumar, S., Bansal, G., & Shekhawat, V. S. (2020) · International Conference on Information Networking · doi:10.1109/icoin48656.2020.9016529 · Cited by 20
Core‐level cybersecurity assurance using cloud‐based adaptive machine learning techniques for manufacturing industry
Sakthivel, R. K., Nagasubramanian, G., Al-Turjman, F. M., et al. (2020) · Transactions on Emerging Telecommunications Technologies · doi:10.1002/ett.3947 · Cited by 20
Considering the human operator cognitive process for the interpretation of diagnostic outcomes related to component failures and cyber security attacks
Wang, W., Maio, F. D., & Zio, E. (2020) · Reliability Engineering & System Safety · doi:10.1016/j.ress.2020.107007 · Cited by 20
“Methods and algorithms have been developed also for diagnosing cyber attacks [14, 39, 40].”
Method
Detecting a Stealthy Attack in Distributed Control for Microgrids using Machine Learning Algorithms
Ma, M., Lahmadi, A., & Chrisment, I. (2020) · doi:10.1109/icps48405.2020.9274721 · Cited by 20
Deep learning algorithms for cyber security applications: A survey
Li, G., Sharma, P., Pan, L., Rajasegarar, S., Karmakar, C. K., & Patterson, N. (2021) · Journal of Computer Security · doi:10.3233/jcs-200095 · Cited by 26
UN-AVOIDS: Unsupervised and Nonparametric Approach for Visualizing Outliers and Invariant Detection Scoring
Yousef, W. A., Traoré, I., & Briguglio, W. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3125608 · Cited by 20
An optimal feature based network intrusion detection system using bagging ensemble method for real-time traffic analysis
Chowdhury, R., Sen, S., Roy, A., & Saha, B. (2022) · Multimedia Tools and Applications · doi:10.1007/s11042-022-12330-3 · Cited by 20
Real-Time Link Verification in Software-Defined Networks
Soltani, S., Shojafar, M., Mostafaei, H., et al. (2023) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2023.3238691 · Cited by 20
A balanced communication-avoiding support vector machine decision tree method for smart intrusion detection systems
Alsaleh, A. (2023) · Scientific Reports · doi:10.1038/s41598-023-36304-z · Cited by 21
Data-Driven Network Anomaly Detection with Cyber Attack and Defense Visualization
Muhati, E., & Rawat, D. B. (2024) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp4020012 · Cited by 25
“The survey [21] flags issues like sluggish response times during connection look-ups, owing to the sheer volume of TCP data structures housed in vast spans of protected kernel memory.”
Background
A training-resistant anomaly detection system
Muller, S., Lancrenon, J., Harpes, C., Traon, Y. L., Gombault, S., & Bonnin, J. (2018) · Computers & Security · doi:10.1016/j.cose.2018.02.015 · Cited by 20
“In the machine-learning domain, some schemes already exist which autonomously tell ‘normal’ data apart from outliers, and which are thus suitable for intrusion detection [8].”
Background
ML-based cyber incident detection for Electronic Medical Record (EMR) systems
McGlade, D., & Scott-Hayward, S. (2018) · Smart Health · doi:10.1016/j.smhl.2018.05.001 · Cited by 20
“the Confidentiality Prototype to determine the best fit, as recommended in [38].”
Background
Intelligent Security Measures for Smart Cyber Physical Systems
Shafique, M., Khalid, F., & Rehman, S. (2018) · Euromicro Conference on Digital System Design (DSD) · doi:10.1109/dsd.2018.00058 · Cited by 20
Performance Analysis of Anomaly Based Network Intrusion Detection Systems
Abedin, M. Z., Siddiquee, K. N. E. A., Bhuyan, M. S., et al. (2018) · IEEE Conference on Local Computer Networks Workshops (LCN Workshops) · doi:10.1109/lcnw.2018.8628599 · Cited by 20
“[19] and Li et al [20] did comprehensive surveys of data mining and machine learning algorithms which are used in IDSs.”
Background
An empirical study of intelligent approaches to DDoS detection in large scale networks
Liang, X., & Znati, T. F. (2019) · 2012 International Conference on Computing, Networking and Communications (ICNC) · doi:10.1109/iccnc.2019.8685519 · Cited by 20
Analysis of Socket Communication Technology Based on Machine Learning Algorithms Under TCP/IP Protocol in Network Virtual Laboratory System
Si, H., Sun, C., Chen, B., Shi, L., & Qiao, H. (2019) · IEEE Access · doi:10.1109/access.2019.2923052 · Cited by 21
KARL: Fast Kernel Aggregation Queries
Chan, T. N., Yiu, M. L., & Leong Hou, U. (2019) · Proceedings - International Conference on Data Engineering · doi:10.1109/icde.2019.00055 · Cited by 20
An interactive visual analytics approach for network anomaly detection through smart labeling
Fan, X., Li, C., Yuan, X., Dong, X., & Liang, J. (2019) · Journal of Visualization · doi:10.1007/s12650-019-00580-7 · Cited by 20
“Despite current research achievements on anomaly detection (Bhuyan et al. 2014; Chandola et al. 2009; Buczak and Guven 2016), there are still some challenges and study directions worth exploring.”
Background
Learning paradigms for communication and computing technologies in IoT systems
Ejaz, W., Basharat, M., Saadat, S., Khattak, A. M., Naeem, M., & Anpalagan, A. (2020) · Computer Communications · doi:10.1016/j.comcom.2020.01.043 · Cited by 20
A Study of Ensemble Methods for Cyber Security
Lower, N., & Zhan, F. (2020) · IEEE Annual Computing and Communication Workshop and Conference (CCWC) · doi:10.1109/ccwc47524.2020.9031256 · Cited by 20
Trust-Based Authentication for Smart Home Systems
Mbarek, B., Ge, M., & Pitner, T. (2020) · Wireless Personal Communications · doi:10.1007/s11277-020-07965-0 · Cited by 20
“This can be done by faking for example the tag ID or transactions ID [3, 4].”
Background
Syrius: Synthesis of Rules for Intrusion Detectors
Alcantara, L., Padilha, G. A. G., Abreu, R., & d’Amorim, M. (2021) · IEEE Transactions on Reliability · doi:10.1109/tr.2021.3061297 · Cited by 20
Adversarial RL-Based IDS for Evolving Data Environment in 6LoWPAN
Pasikhani, A. M., Clark, J. A., & Gope, P. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3214099 · Cited by 20
Comprehensive Study on Smart Solar Grid with Embedded System and IoT Technology
Mahendran, S., Gomathy, B., Sathesh, S., et al. (2023) · International Conference on Computing, Communication and Networking Technologies (ICCCNT) · doi:10.1109/icccnt56998.2023.10308033 · Cited by 19
Interpretable Anomaly Detection: A Hybrid Approach Using Rule-Based and Machine Learning Techniques
Mohite, R., & Ouarbya, L. (2024) · IEEE International Conference for Convergence in Technology (I2CT) · doi:10.1109/i2ct61223.2024.10543396 · Cited by 19
A Neuro-Symbolic Artificial Intelligence Network Intrusion Detection System
Bizzarri, A., Jalaian, B. A., Riguzzi, F., et al. (2024) · Proceedings/Proceedings - International Conference on Computer Communications and Networks · doi:10.1109/icccn61486.2024.10637618 · Cited by 19
An Anomaly Detection Model Training Method Based on LLM Knowledge Distillation
Yang, Y., Tian, B., Yu, F., & He, Y. (2024) · International Conference on Networking and Network Applications (NaNA) · doi:10.1109/nana63151.2024.00084 · Cited by 21
Machine Learning-Based Intrusion Detection Systems for the Internet of Drones: A Systematic Literature Review
Ogab, M., Zaidi, S., Bourouis, A., & Calafate, C. T. (2025) · IEEE Access · doi:10.1109/access.2025.3575236 · Cited by 29
Comprehensive Review of Intrusion Detection Techniques: ML and DL in Different Networks
Rakine, I., Oukaira, A., Guemmat, K. E., Atouf, I., Ouahabi, S., Talea, M., & Bouragba, T. (2025) · IEEE Access · doi:10.1109/access.2025.3579990 · Cited by 20
“It predicts the most accurate result by employing majority voting or weighted voting, based on the predictions of these trees [28].”
A lightweight IoT intrusion detection method based on two-stage feature selection and Bayesian optimization
Zhang, D., Huang, D., Chen, Y., Lin, S., & Li, C. (2025) · AIMS Electronics and Electrical Engineering · doi:10.3934/electreng.2025017 · Cited by 21
Revolutionising anomaly detection: a hybrid framework for anomaly detection integrating isolation forest, autoencoder, and Conv. LSTM
Kumar, A., Dewangan, A. K., Raja, R., Dewangan, A. K., Kumar, M., Soni, A., Agarwal, D., & Saudagar, A. K. J. (2025) · Knowledge and Information Systems · doi:10.1007/s10115-025-02580-6 · Cited by 24
Network Data Analysis and Anomaly Detection Using CNN Technique for Industrial Control Systems Security
Hu, Y., Zhang, D., Cao, G., & Pan, Q. (2019) · Conference proceedings/Conference proceedings - IEEE International Conference on Systems, Man, and Cybernetics · doi:10.1109/smc.2019.8913895 · Cited by 19
“Tcpdump, Wireshark, Snort, and Nmap are popular programs when using pcap data[12].”
Method
Deep Learning-Based Detection of Fake Task Injection in Mobile Crowdsensing
Sood, A., Şimşek, M., Zhang, Y., et al. (2019) · IEEE Global Conference on Signal and Information Processing · doi:10.1109/globalsip45357.2019.8969416 · Cited by 19
Multi-Layer Mapping of Cyberspace for Intrusion Detection
Shao, S., Satam, P., Satam, S., et al. (2021) · IEEE/ACS International Conference on Computer Systems and Applications (AICCSA) · doi:10.1109/aiccsa53542.2021.9686823 · Cited by 19
Bi-discriminator GAN for tabular data synthesis
Esmaeilpour, M., Chaalia, N., Abusitta, A. H., Devailly, F.-X., Maazoun, W., & Cardinal, P. (2022) · Pattern Recognition Letters · doi:10.1016/j.patrec.2022.05.023 · Cited by 23
Privacy-preserving knowledge transfer for intrusion detection with federated deep autoencoding gaussian mixture model
Chen, Y., Zhang, J., & Yeo, C. K. (2022) · Information Sciences · doi:10.1016/j.ins.2022.07.104 · Cited by 20
Cyber Attack Detection Dataset: A Review
Yusof, N. N. M., & Sulaiman, N. S. (2022) · Journal of Physics Conference Series · doi:10.1088/1742-6596/2319/1/012029 · Cited by 19
Cybercrime: Identification and Prediction Using Machine Learning Techniques
Veena, K., Meena, K., Kuppusamy, R., et al. (2022) · Computational Intelligence and Neuroscience · doi:10.1155/2022/8237421 · Cited by 19
“There is eﬀective execution of ML procedures in system administration regions such as interruption discovery proposed by Buczak et al. [4] and intellectual radios proposed by Bkassiny et al. [5].”
Method
On-device context-aware misuse detection framework for heterogeneous IoT edge
Nitish, A., Hanumanthappa, J., Prakash, S. P. S., & Krinkin, K. V. (2022) · Applied Intelligence · doi:10.1007/s10489-022-04039-5 · Cited by 18
Two-Stage Distillation-Aware Compressed Models for Traffic Classification
Lu, M., Zhou, B., & Bu, Z. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3263487 · Cited by 19
Least Square Support Vector Machine based Intrusion Detection System in IoT
Akhther, A. P., Maryposonia, A., & Prasanth, V. S. (2023) · International Conference on Intelligent Computing and Control Systems (ICICCS) · doi:10.1109/iciccs56967.2023.10142805 · Cited by 19
“In order to help with intrusion detection, [20] examine the”
Background
Neurosymbolic AI in Cybersecurity: Bridging Pattern Recognition and Symbolic Reasoning
Jalaian, B. A., & Bastian, N. D. (2023) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom58377.2023.10356283 · Cited by 19
Efficacious Novel Intrusion Detection System for Cloud Computing Environment
Rana, P., Batra, I., Malik, A., et al. (2024) · IEEE Access · doi:10.1109/access.2024.3424528 · Cited by 19
Leveraging Artificial Intelligence to Enhance Data Security and Combat Cyber Attacks
Weng, Y., & Wu, J. (2024) · Journal of Artificial Intelligence General science (JAIGS) · doi:10.60087/jaigs.v5i1.211 · Cited by 19
Intrusion detection taxonomy and data preprocessing mechanisms
Al-Utaibi, K. A., & El-Alfy, E.-S. M. (2018) · Journal of Intelligent & Fuzzy Systems · doi:10.3233/jifs-169432 · Cited by 19
Uncertainty-Aware Authentication Model for Fog Computing in IoT
Heydari, M., Mylonas, A., Katos, V., et al. (2019) · International Conference on Fog and Mobile Edge Computing (FMEC) · doi:10.1109/fmec.2019.8795332 · Cited by 19
Real-Time Distributed Denial-of-Service (DDoS) Attack Detection Using Decision Trees for Server Performance Maintenance
Khare, M., & Oak, R. (2019) · Asset analytics · doi:10.1007/978-981-13-8253-6_1 · Cited by 19
On the performance of intelligent techniques for intensive and stealthy DDos detection
Liang, X., & Znati, T. F. (2019) · Computer Networks · doi:10.1016/j.comnet.2019.106906 · Cited by 20
A Robust Cybersecurity Solution Platform Architecture for Digital Instrumentation and Control Systems in Nuclear Power Facilities
Zhang, F., Hines, J. W., & Coble, J. B. (2019) · Nuclear Technology · doi:10.1080/00295450.2019.1666599 · Cited by 19
“These four classification methods were selected based on a survey of data mining methods for cybersecurity intrusion detection.(18) Intrusion detection results suggest that KNN, bagging, and random forest have true alarm rates higher than 97% with low missed alarm and false alarm rates for man-in-the-middle (MITM) and…”
Method
Improving Maliciousness Estimation of Indicator of Compromise Using Graph Convolutional Networks
Kazato, Y., Nakagawa, Y., & Nakatani, Y. (2020) · IEEE Consumer Communications & Networking Conference (CCNC) · doi:10.1109/ccnc46108.2020.9045113 · Cited by 19
Managing Information System Security Under Continuous and Abrupt Deterioration
Bensoussan, A., Mookerjee, V. S., & Yue, W. T. (2020) · Production and Operations Management · doi:10.1111/poms.13198 · Cited by 19
“In addition to technical details, knowledge about the business process is critical when maintaining such systems (Buczak and Guven 2016, Tjoa et al. 2011).”
Background
A Comprehensive Survey on Various Machine Learning Methods used for Intrusion Detection System
Gupta, A. R. B., & Agrawal, J. (2020) · IEEE International Conference on Communication Systems and Network Technologies (CSNT) · doi:10.1109/csnt48778.2020.9115764 · Cited by 20
IoT Botnet Malware Classification Using Weka Tool and Scikit-learn Machine Learning
Susanto, S., Stiawan, D., Arifin, M. A. S., et al. (2020) · doi:10.23919/eecsi50503.2020.9251304 · Cited by 19
An intrusion detection system integrating network-level intrusion detection and host-level intrusion detection
Liu, J., Xiao, K., Luo, L., Li, Y., & Chen, L. (2020) · IEEE International Conference on Software Quality, Reliability and Security (QRS) · doi:10.1109/qrs51102.2020.00028 · Cited by 19
INTELLIGENT TECHNIQUES FOR ANOMALY DETECTION IN NUCLEAR REACTORS
Ioannou, G., Tagaris, T., Alexandridis, G., & Stafylopatis, A. (2021) · EPJ Web of Conferences · doi:10.1051/epjconf/202124721011 · Cited by 21
Comparing and Analyzing Applications of Intelligent Techniques in Cyberattack Detection
Dixit, P., Kohli, R., Acevedo-Duque, Á., González-Díaz, R. R., & Jhaveri, R. H. (2021) · Security and Communication Networks · doi:10.1155/2021/5561816 · Cited by 19
An Integrated Approach to Cyber Risk Management with Cyber Threat Intelligence Framework to Secure Critical Infrastructure
Amin, H. E., Samhat, A. E., Chamoun, M., et al. (2024) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp4020018 · Cited by 18
“Existing frameworks often struggle to adapt to the dynamic threat landscape, highlighting the importance of considering adversary techniques for proactive risk mitigation [14,52].”
Background
Enhancing UAV Network Security: A Human-in-the-Loop and GAN-Based Approach to Intrusion Detection
Zeng, Q., & Naït‐Abdesselam, F. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3545389 · Cited by 21
Addressing Security Orchestration Challenges in Next-Generation Networks: A Comprehensive Overview
Batewela, S., Ranaweera, P. S., Liyanage, M., Zeydan, E., & Ylianttila, M. (2025) · IEEE Open Journal of the Computer Society · doi:10.1109/ojcs.2025.3564788 · Cited by 20
A Network Intrusion Detection Model Based on Convolutional Neural Network
Tao, W., Zhang, W., Hu, C., et al. (2019) · Advances in intelligent systems and computing · doi:10.1007/978-3-030-16946-6_63 · Cited by 18
A Deep Random Forest Model on Spark for Network Intrusion Detection
Liu, Z., Su, N., Qin, Y., et al. (2020) · Mobile Information Systems · doi:10.1155/2020/6633252 · Cited by 18
“A recent survey by Buczak and Guven [12] made a comprehensive review of the current data mining and machine learning methodologies of intrusion detection; the survey described the strengths and weaknesses of the algorithm and provided a clear outlook for future work.”
Background
The Challenges of Machine Learning and Their Economic Implications
Martín, P. B. I., & Unceta, I. (2021) · Entropy · doi:10.3390/e23030275 · Cited by 23
Cryptographic Based Secure Model on Dataset for Deep Learning Algorithms
Tayyab, M. A., Marjani, M., Jhanjhi, N. Z., Hashem, I. A. T., Almazroi, A. A., & Almazroi, A. A. (2021) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2021.017199 · Cited by 18
Role-based lateral movement detection with unsupervised learning
Powell, B. A. (2022) · Intelligent Systems with Applications · doi:10.1016/j.iswa.2022.200106 · Cited by 17
An Analysis of Integrating Machine Learning in Healthcare for Ensuring Confidentiality of the Electronic Records
Seh, A. H., Al‐Amri, J. F., Subahi, A. F., Agrawal, A., Pathak, N., Kumar, R., & Khan, R. A. (2021) · Computer Modeling in Engineering & Sciences · doi:10.32604/cmes.2022.018163 · Cited by 18
Software Supply Chain Vulnerabilities Detection in Source Code: Performance Comparison between Traditional and Quantum Machine Learning Algorithms
Akter, M. S., Faruk, M. J. H., Anjum, N., Masum, M., Shahriar, H., Sakib, N., Rahman, A., Wu, F., & Cuzzocrea, A. (2022) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata55660.2022.10020813 · Cited by 20
GLEAM: GAN and LLM for Evasive Adversarial Malware
Devadiga, D., Jin, G., Potdar, B., et al. (2023) · International Conference on Information and Communication Technology Convergence (ICTC) · doi:10.1109/ictc58733.2023.10393706 · Cited by 18
A Systematic Review of Additive Manufacturing Solutions Using Machine Learning, Internet of Things, Big Data, Digital Twins and Blockchain Technologies: A Technological Perspective Towards Sustainability
Pant, R., Singh, R., Gehlot, A., Akram, S. V., Gupta, L. R., & Thakur, A. K. (2024) · Archives of Computational Methods in Engineering · doi:10.1007/s11831-024-10116-4 · Cited by 22
A Survey on Network Security Traffic Analysis and Anomaly Detection Techniques
Zhang, W., & Lazaro, J. P. (2024) · International Journal of Emerging Technologies and Advanced Applications · doi:10.62677/ijetaa.2404117 · Cited by 18
Applying Event Stream Processing to Network Online Failure Prediction
Dueñas, J. C., Navarro, J. M., G., H. A. P., et al. (2018) · IEEE Communications Magazine · doi:10.1109/mcom.2018.1601135 · Cited by 18
A Survey of Cyber Security Approaches for Attack Detection, Prediction, and Prevention
Ibor, A. E., Oladeji, F. A., & Okunoye, O. B. (2018) · International Journal of Security and Its Applications · doi:10.14257/ijsia.2018.12.4.02 · Cited by 18
Implementation and Analysis of Combined Machine Learning Method for Intrusion Detection System
Masduki, B. W., Ramli, K., & Murfi, H. (2022) · International Journal of Communication Networks and Information Security (IJCNIS) · doi:10.17762/ijcnis.v10i2.3375 · Cited by 18
Learning and Applying Ontology for Machine Learning in Cyber Attack Detection
Zheng, H., Wang, Y., Han, C., et al. (2018) · doi:10.1109/trustcom/bigdatase.2018.00180 · Cited by 18
Intelligent Methods in Digital Forensics: State of the Art
Krivchenkov, A., Mišņevs, B., & Pavlyuk, D. (2019) · Lecture notes in networks and systems · doi:10.1007/978-3-030-12450-2_26 · Cited by 18
Forget the Myth of the Air Gap: Machine Learning for Reliable Intrusion Detection in SCADA Systems
Perez, R. L., Adamsky, F., Soua, R., & Engel, T. (2019) · ICST Transactions on Security and Safety · doi:10.4108/eai.25-1-2019.159348 · Cited by 20
Low-Complexity Adaptive Chromatic Dispersion Estimation Scheme Using Machine Learning for Coherent Long-Reach Passive Optical Networks
Li, J., Wang, D., & Zhang, M. (2019) · IEEE photonics journal · doi:10.1109/jphot.2019.2936426 · Cited by 18
“Recently, machine learning (ML) has been successfully applied in the optical networks [14]–[19], which is specialized in modeling complicated functional relationships where the underlying principles of physic and mathematics are difficult to be described [20], [21].”
Background
Modern Machine Learning for Cyber-Defense and Distributed Denial-of-Service Attacks
Paffenroth, R. C., & Zhou, C. (2019) · IEEE Engineering Management Review · doi:10.1109/emr.2019.2950183 · Cited by 20
INTELLIGENT AUTHENTICATION FOR IDENTITY AND ACCESS MANAGEMENT: A REVIEW PAPER
Hadi, I. H. (2019) · Iraqi Journal for Computers and Informatics · doi:10.25195/ijci.v45i1.39 · Cited by 18
Putting Together Wavelet-based Scaleograms and Convolutional Neural Networks for Anomaly Detection in Nuclear Reactors
Tagaris, T., Ioannou, G., Sdraka, M., Alexandridis, G., & Stafylopatis, A. (2019) · International Conference on Advances in Artificial Intelligence (ICAAI) · doi:10.1145/3369114.3369121 · Cited by 20
“Recently, an increase in anomaly detection methodologies based on machine learning techniques has also been witnessed [2].”
Background
A literature review of the current applications of machine learning and their practical implications
Chagas, B. N. R., Viana, J. A. N., Reinhold, O., Lobato, F. M. F., Jacob, A. F. L., & Alt, R. (2020) · Web Intelligence · doi:10.3233/web-200429 · Cited by 18
“Basically, ML consists of three main types of learning: supervised, unsupervised and semi-supervised [23,39,75,92,110].”
Towards Evaluating the Robustness of Deep Intrusion Detection Models in Adversarial Environment
Sriram, S., Simran, K., Vinayakumar, R., et al. (2020) · Communications in computer and information science · doi:10.1007/978-981-15-4825-3_9 · Cited by 18
Deep Learning-Based Network Security Data Sampling and Anomaly Prediction in Future Network
Liu, L., Lin, J., Wang, P., et al. (2020) · Discrete Dynamics in Nature and Society · doi:10.1155/2020/4163825 · Cited by 18
“(e long short-term memory (LSTM) improves the original RNN algorithm [22–24], solves the problem of gradient disappearance or gradient explosion after training of time series modeling, and conducts deep learning through long-term state preservation and forward calculation and uses the back-propagation algorithm to tra…”
Background
MalFinder: An Ensemble Learning-based Framework For Malicious Traffic Detection
Rong, C., Gou, G., Cui, M., Xiong, G., Li, Z., & Guo, L. (2020) · IEEE Symposium on Computers and Communications (ISCC) · doi:10.1109/iscc50000.2020.9219609 · Cited by 18
Prototype Cross Platform Oriented on Cybersecurity, Virtual Connectivity, Big Data and Artificial Intelligence Control
Massaro, A. S., Gargaro, M., Dipierro, G., Galiano, A. M., & Buonopane, S. (2020) · IEEE Access · doi:10.1109/access.2020.3034399 · Cited by 18
ME-Box: A reliable method to detect malicious encrypted traffic
Xu, B., He, G., & Zhu, H. (2021) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2021.102823 · Cited by 18
Proactive trust classification for detection of replication attacks in 6LoWPAN-based IoT
Mbarek, B., Ge, M., & Pitner, T. (2021) · Internet of Things · doi:10.1016/j.iot.2021.100442 · Cited by 18
A Network Intrusion Detection System for Concept Drifting Network Traffic Data
Andresini, G., Appice, A., Loglisci, C. A. A. M. D., Belvedere, V., Redavid, D., & Malerba, D. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-88942-5_9 · Cited by 18
Knowledge-Driven Machine Learning and Applications in Wireless Communications
Li, D., Xu, Y., Zhao, M., Zhu, J., & Zhang, S. (2021) · IEEE Transactions on Cognitive Communications and Networking · doi:10.1109/tccn.2021.3128597 · Cited by 22
A Survey of Intrusion Detection Systems Leveraging Host DataPreprint
Glass-Vanderlan, T. R., Iannacone, M. D., Vincent, M. S., Qian, Q., Chen, & Bridges, R. A. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.06070 · Cited by 19
Xai-driven black-box adversarial attacks on network intrusion detectors
Okada, S., Jmila, H., Akashi, K., et al. (2025) · International Journal of Information Security · doi:10.1007/s10207-025-01016-0 · Cited by 17
Exploring Adversarial Properties of Insider Threat Detection
Le, D. C., & Zincir-Heywood, N. (2020) · 2020 IEEE Conference on Communications and Network Security (CNS) · doi:10.1109/cns48642.2020.9162254 · Cited by 17
Providing Cyber Security using Artificial Intelligence – A survey
B.S., S., S., N., Kashyap, N., & D.N., S. (2019) · 2019 3rd International Conference on Computing Methodologies and Communication (ICCMC) · doi:10.1109/iccmc.2019.8819719 · Cited by 34
Data Security and Privacy in the Digital Era: Challenges for Modern Government
Sarjito, A. (2024) · JIAN (Jurnal Ilmiah Administrasi Negara) · doi:10.56071/jian.v8i3.933 · Cited by 9

Authors: Buczak, A. L., & Guven, E.
Affiliations: Johns Hopkins University (US)
ORCID: Buczak, Anna L.
Venue: IEEE Communications Surveys & Tutorials
Publisher: Institute of Electrical and Electronics Engineers (IEEE)
Published: 2016
Volume: 18
Issue: 2
Pages: 1153-1176
ISSN: 1553-877X (ISSN-L)
2373-745X
DOI: 10.1109/comst.2015.2494502
OpenAlex: W2342408547
Semantic Scholar: 971766088dfaf63fb55e6f0190b14f28f2c98ad0
Cited by: 3,332
References: 119
Citations by year: 2026: 460 · 2025: 395 · 2024: 297 · 2023: 319 · 2022: 403 · 2021: 447 · 2020: 394 · 2019: 314 · 2018: 217 · 2017: 73 · 2016: 11
FWCI: 115.39
Type: journal article
Language: en
Open access: closed
Licence: ieeexplore.ieee.org/Xplorehelp/downloads/license-information/OAPA.html (vor)
Locations: IEEE Communications Surveys & Tutorials (publishedVersion)
Funders: Department of Homeland Security Network Security Deployment Division (HSSA01-13-C-2709)
Topics: Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
Physical Sciences › Computer Science › Artificial Intelligence › Artificial Immune Systems Applications
Keywords: intrusion detection, cybersecurity, machine learning, data mining, algorithmic complexity

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection

Abstract

Overview

Integrity signals

Verification

Claims the paper makes

Claims other papers make about this one

Citations

Cites

Cited by

Related

Metadata

Record

About these checks