Cited by 3,332Network Security and Intrusion DetectionNetwork Packet Processing and OptimizationArtificial Immune Systems Applications

The DOI matches its Crossref record; 114 of the 119 references it cites were found in a registry or an index, and 4 are not checked yet.

A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection

Buczak, Anna L., Guven, Erhan·2016·IEEE Communications Surveys & Tutorials

DOI 10.1109/comst.2015.2494502

Open this paper in CoChat — free account

Abstract

This survey paper describes a focused literature survey of machine learning (ML) and data mining (DM) methods for cyber analytics in support of intrusion detection. Short tutorial descriptions of each ML/DM method are provided. Based on the number of citations or the relevance of an emerging method, papers representing each method were identified, read, and summarized. Because data are so important in ML/DM approaches, some well-known cyber data sets used in ML/DM are described. The complexity of ML/DM algorithms is addressed, discussion of challenges for using ML/DM for cyber security is presented, and some recommendations on when to use a given method are provided.

Integrity signals

Registry

Crossref · 10.1109/comst.2015.2494502

Cites

114 of 118 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Random Forests
Breiman, L. (2001) · Machine Learning · doi:10.1023/a:1010933404324 · Cited by 133,538
Fuzzy sets
Zadeh, L. A. (1965) · Information and Control · doi:10.1016/s0019-9958(65)90241-x · Cited by 67,855
Particle swarm optimization
Kennedy, J., & Eberhart, R. (2002) · Proceedings of ICNN'95 - International Conference on Neural Networks · doi:10.1109/icnn.1995.488968 · Cited by 58,192
Maximum Likelihood from Incomplete Data Via the EM Algorithm
Dempster, A. P., Laird, N. M., & Rubin, D. B. (1977) · Journal of the Royal Statistical Society Series B: Statistical Methodology · doi:10.1111/j.2517-6161.1977.tb01600.x · Cited by 50,444
Fuzzy sets
Zadeh, L. A. (1996) · Cited by 46,960
The Nature of Statistical Learning Theory
Vapnik, V. (2000) · Statistics for Engineering and Information Science · doi:10.1007/978-1-4757-3264-1 · Cited by 46,387
Collective dynamics of ‘small-world’ networks
Watts, D. J., & Strogatz, S. H. (1998) · Nature · doi:10.1038/30918 · Cited by 43,060
The Nature of Statistical Learning Theory
Vapnik, V. N. (1995) · doi:10.1007/978-1-4757-2440-0 · Cited by 39,138
Data Mining: Practical Machine Learning Tools and Techniques
Witten, I. H., Frank, E., & Hall, M. A. (2011) · Elsevier eBooks · doi:10.1016/c2009-0-19715-5 · Cited by 25,543
Untitled work
(1992) · Cited by 23,431

Flagged first, then by citations

Show all 119 references

1 of the 119 references couldn’t be matched to a known paper.

Research works printed but not linked: 14

Shearer, 2000, The CRISP-DM model: The new blueprint for data mining, J. Data Warehouse., 5, 13
2000, R Core Team
Jacobson, 1989, The Tcpdump Manual Page
Combs, 2014, Wireshark
2014, Sourcefire
Stolfo, 2014, KDD Cup 1999 Data Set
2015, IBM
10.4108/wkdd.2008.2686 · DOI
2014, Politecnico di Torino, Analyzer 3.0
Baralis, 2008, Generalized Itemset Discovery by Means of Opportunistic Aggregation
Markov, 1971, Extension of the limit theorems of probability theory to a sum of variables connected in a chain, Dynamic Probabilistic Systems, 1
10.2307/2984875 · DOI
Brauckhoff, 2008, Flame: A low-level anomaly modeling engine
Paxson, 2004, Bro 0.9

Sorted by citations

Items 401–500 of 1,003

An Ensemble Intrusion Detection Method for Train Ethernet Consist Network Based on CNN and RNN
Yue, C., Wang, L., Wang, D., Duo, R., & Nie, X. (2021) · IEEE Access · doi:10.1109/access.2021.3073413 · Cited by 67
A review of machine learning approaches for drug synergy prediction in cancer
Torkamannia, A., Omidi, Y., & Ferdousi, R. (2022) · Briefings in Bioinformatics · doi:10.1093/bib/bbac075 · Cited by 66
Euler: Detecting Network Lateral Movement via Scalable Temporal Graph Link Prediction
King, I. J., & Huang, H. (2022) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.24107 · Cited by 66
Explainable Artificial Intelligence for Cybersecurity
Sharma, D. K., Mishra, J., Singh, A., Govil, R., Srivastava, G., & Lin, J. C. (2022) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2022.108356 · Cited by 75
Swarm intelligence in anomaly detection systems: an overview
Mishra, S., Sagban, R., Al-Sultan, A. Y., & Gandhi, N. (2018) · International Journal of Computers and Applications · doi:10.1080/1206212x.2018.1521895 · Cited by 64
A Secure and Efficient Certificateless Authentication Scheme With Unsupervised Anomaly Detection in VANETs
Tan, H., Gui, Z., & Chung, I. (2018) · IEEE Access · doi:10.1109/access.2018.2883426 · Cited by 64
Data-Driven Edge Intelligence for Robust Network Anomaly Detection
Xu, S., Qian, Y., & Hu, R. Q. (2019) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2019.2936466 · Cited by 64
An Efficient Traffic Classification Scheme Using Embedded Feature Selection and LightGBM
Hua, Y. (2020) · Information Communication Technologies Conference (ICTC) · doi:10.1109/ictc49638.2020.9123302 · Cited by 64
Cybersecurity in process control, operations, and supply chain
Parker, S., Wu, Z., & Christofides, P. D. (2023) · Computers & Chemical Engineering · doi:10.1016/j.compchemeng.2023.108169 · Cited by 68
“Machine-learning meth-ods deployed for cyber-attack detection were presented in a number of works (Tsai et al., 2009; Buczak and Guven, 2015; Ozay et al., 2015).”
Background
Rallying Adversarial Techniques against Deep Learning for Network Security
Clements, J., Yang, Y., Sharma, A. A., Hu, H., & Lao, Y. (2021) · IEEE Symposium Series on Computational Intelligence (SSCI) · doi:10.1109/ssci50451.2021.9660011 · Cited by 75
“learning techniques are quickly being adopted in network security for use in intrusion detection [1], malware analysis [2], spam filtering [3], and phishing detection [4].”
Method
The Threat of Adversarial Attacks on Machine Learning in Network Security -- A SurveyPreprint
Ibitoye, O., Khamis, R. A., Shehaby, M. E., Matrawy, A., & Shafiq, M. O. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1911.02621 · Cited by 63
Widening Access to Applied Machine Learning with TinyML
Janapa Reddi, V., Plancher, B., Kennedy, S., Moroney, L., Warden, P., Suzuki, L., Agarwal, A., Banbury, C., Banzi, M., Bennett, M., et al. (2022) · Harvard Data Science Review · doi:10.1162/99608f92.762d171a · Cited by 62
“…accessible and scalable, we focused on the emerging TinyML domain and released the course as a MOOC on edX. autonomous vehicles [3, 4], robotics [5], health care [6], transportation [7, 8], security [9], and education [10, 11], with new application use cases continuously emerging every few days.”
BackgroundMethod
Survey of AI in Cybersecurity for Information Technology Management
Chan, L., Morgan, I., Simon, H., Alshabanat, F., Ober, D., Gentry, J. W., Min, D., & Cao, R. (2019) · IEEE Technology & Engineering Management Conference (TEMSCON) · doi:10.1109/temscon.2019.8813605 · Cited by 62
“Along with being highly efficient and again, requiring minimal human interaction, artificial intelligence has the ability to protect individuals, companies, and governments from being exploited online [33].”
Background
Robust deep auto-encoding Gaussian process regression for unsupervised anomaly detection
Fan, J., Zhang, Q., Zhu, J., Zhang, M., Yang, Z., & Cao, H. (2019) · Neurocomputing · doi:10.1016/j.neucom.2019.09.078 · Cited by 62
A Network Intrusion Detection Method Based on Stacked Autoencoder and LSTM
Yan, Y., Qi, L., Wang, J., et al. (2020) · International Conference on Communications · doi:10.1109/icc40277.2020.9149384 · Cited by 62
The Challenges of Leveraging Threat Intelligence to Stop Data Breaches
Ibrahim, A. S., Thiruvady, D., Schneider, J.-G., & Abdelrazek, M. (2020) · Frontiers in Computer Science · doi:10.3389/fcomp.2020.00036 · Cited by 67
Computational Intelligence Enabled Cybersecurity for the Internet of Things
Zhao, S., Li, S., Qi, L., & Xu, L. D. (2020) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2019.2941757 · Cited by 61
Machine Learning for Detecting Data Exfiltration
Sabir, B., Ullah, F., Babar, M. A., & Gaire, R. (2021) · ACM Computing Surveys · doi:10.1145/3442181 · Cited by 78
“rediction time of the classiﬁer. We assert that both prediction and training time are essential as data exﬁltration attacks need to detect as fast as possible [177] and models require frequent update [58]. We also suggest that with the advent of adversarial ML, additional measures such as robustness of features and se…”
BackgroundMethodInfluential
Generalized Outlier Gaussian Mixture Technique Based on Automated Association Features for Simulating and Detecting Web Application Attacks
Moustafa, N., Misra, G., & Slay, J. (2018) · IEEE Transactions on Sustainable Computing · doi:10.1109/tsusc.2018.2808430 · Cited by 63
“Anomaly-based detection methodology, on the other hand, relies on building a comprehensive normal profile of the system from different legitimate variations, which need careful analysis, and then treating any deviation from the profile as anomalous vectors [12], [13], [14].”
Background
A Survey on Game-Theoretic Approaches for Intrusion Detection and Response Optimization
Kiennert, C., Ismail, Z., Debar, H., et al. (2018) · ACM Computing Surveys · doi:10.1145/3232848 · Cited by 61
Intrusion Detection Based on Stacked Autoencoder for Connected Healthcare Systems
He, D., Qiao, Q., Gao, Y., et al. (2019) · IEEE Network · doi:10.1109/mnet.001.1900105 · Cited by 61
“For example, for a machine learning model [8], the final parameters of the model are usually determined by three datasets, that is, training set, verification set, and test set.”
Machine Learning for Traffic Analysis: A Review
Alqudah, N., & Yaseen, Q. M. (2020) · Procedia Computer Science · doi:10.1016/j.procs.2020.03.111 · Cited by 60
Development of the cybersecurity scale (CS-S): Evidence of validity and reliability
Arpacı, İ., & Sevinc, K. (2021) · Information Development · doi:10.1177/0266666921997512 · Cited by 60
“A bibliometric mapping analysis indicated that Wang and Lu (2013) (371 citations), Buczak and Guven (2015) (277 citations), Yan, Qian, Sharif, and Tipper (2012) (250 citations), Ten, Liu, and Manimaran (2008) These bibliometric findings suggested that there is an increasing number of studies on…”
Background
A Review of Computer Vision Methods in Network Security
Zhao, J., Masood, R., & Seneviratne, S. (2021) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2021.3086475 · Cited by 74
Intrusion Detection in Smart City Hospitals using Ensemble Classifiers
Saba, T. (2020) · International Conference on Developments in eSystems Engineering (DeSE) · doi:10.1109/dese51703.2020.9450247 · Cited by 60
Combining Long-Term Recurrent Convolutional and Graph Convolutional Networks to Detect Phishing Sites Using URL and HTML
Ariyadasa, S. N., Fernando, S., & Fernando, S. (2022) · IEEE Access · doi:10.1109/access.2022.3196018 · Cited by 72
What are the trend and core knowledge of information security? A citation and co-citation analysis
Shiau, W., Wang, X., & Zheng, F. (2023) · Information & Management · doi:10.1016/j.im.2023.103774 · Cited by 74
Adaptive anomaly detection for identifying attacks in cyber-physical systems: A systematic literature review
Moriano, P., Hespeler, S. C., Li, M., & Mahbub, M. (2025) · Artificial Intelligence Review · doi:10.1007/s10462-025-11292-w · Cited by 80
Distance Measurement Methods for Improved Insider Threat Detection
Lo, O., Buchanan, W. J., Griffiths, P., & Macfarlane, R. (2018) · Security and Communication Networks · doi:10.1155/2018/5906368 · Cited by 60
A Feature Selection Approach for Network Intrusion Detection Based on Tree-Seed Algorithm and K-Nearest Neighbor
Chen, F., Ye, Z., Wang, C., Yan, L., & Wang, R. (2018) · International Symposium on Wireless Systems within the Conferences on Intelligent Data Acquisition and Advanced Computing Systems (IDAACS-SWS) · doi:10.1109/idaacs-sws.2018.8525522 · Cited by 60
“Most of the traditional intrusion detection method based on data mining and machine learning methods [2], and they can be converted to the corresponding classification problem to be solved.”
Method
Survey of Public Safety Communications: User-Side and Network-Side Solutions and Future Directions
Yu, W., Xu, H., Nguyen, J. H., Blasch, E., Hematian, A., & Gao, W. (2018) · IEEE Access · doi:10.1109/access.2018.2879760 · Cited by 60
TANTRA: Timing-Based Adversarial Network Traffic Reshaping Attack
Sharon, Y., Berend, D., Liu, Y., Shabtai, A., & Elovici, Y. (2022) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2022.3201377 · Cited by 64
Machine Learning for Detecting Anomalies and Intrusions in Communication Networks
Li, Z., Rios, A. L. G., & Trajković, L. (2021) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2021.3078497 · Cited by 61
Intrusion detection and prevention in fog based IoT environments: A systematic literature review
de Souza, C. A., Westphall, C. B., Machado, R. B., Loffi, L., Westphall, C. M., & Gerônimo, G. A. (2022) · Computer Networks · doi:10.1016/j.comnet.2022.109154 · Cited by 65
Towards an AI-Enhanced Cyber Threat Intelligence Processing Pipeline
Alevizos, L., & Dekker, M. (2024) · Electronics · doi:10.3390/electronics13112021 · Cited by 83
Data-Driven Network Intelligence for Anomaly Detection
Xu, S., Qian, Y., & Hu, R. Q. (2019) · IEEE Network · doi:10.1109/mnet.2019.1800358 · Cited by 59
“As discussed earlier, most of the machine learning models and data mining algorithms were explicitly covered in [6].”
BackgroundInfluential
Big Data Analytics for Large Scale Wireless Networks: Challenges and OpportunitiesPreprint
Dai, H., Wong, R. C.-W., Wang, H. H., Zheng, Z., & Vasilakos, A. V. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1909.08069 · Cited by 60
“ssion. Anomaly Detection (or outlier detection) is to identify objects that do not comply with an expected pattern as given. Anomaly detection approaches can be categorized into the following types [184]: (a) supervised anomaly detection schemes, (b) unsupervised anomaly detection schemes, and (c) semi-supervised anom…”
Background
Software Engineering Repositories
Lima, M. H. T. D. F., Valle, V., Costa, E., et al. (2019) · doi:10.1145/3350768.3350776 · Cited by 58
“…possibilitando a previsão do risco de ocorrên-cia de doenças [7]; no comércio, quando aplicáveis à sistemas de recomendação [8]; em visão computacional, com objetivo de gerar descrições textuais a partir de imagens [18]; na área da segurança, promovendo a detecção de diferentes crimes [5, 31].”
Feature selection approach using ensemble learning for network anomaly detection
Doreswamy, Hooshmand, M. K., & Gad, I. (2020) · CAAI Transactions on Intelligence Technology · doi:10.1049/trit.2020.0073 · Cited by 58
Machine Learning for Misuse-Based Network Intrusion Detection: Overview, Unified Evaluation and Feature Choice Comparison Framework
Jeune, L. L., Goedemé, T., & Mentens, N. (2021) · IEEE Access · doi:10.1109/access.2021.3075066 · Cited by 62
Machine Learning With Variational AutoEncoder for Imbalanced Datasets in Intrusion Detection
Lin, Y., Liu, Z.-Q., Hwang, R., Nguyen, V.-L., Lin, P., & Lai, Y. (2022) · IEEE Access · doi:10.1109/access.2022.3149295 · Cited by 59
A Systematic and Comprehensive Survey of Recent Advances in Intrusion Detection Systems Using Machine Learning: Deep Learning, Datasets, and Attack Taxonomy
Momand, A., Jan, S. U., & Ramzan, N. (2023) · Journal of Sensors · doi:10.1155/2023/6048087 · Cited by 58
Detecting Internet Abuse by Analyzing Passive DNS Traffic: A Survey of Implemented Systems
Torabi, S., Boukhtouta, A., Assi, C. M., & Debbabi, M. (2018) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2018.2849614 · Cited by 58
Detection of slow port scans in flow-based network traffic
Ring, M., Landes, D., & Andreas Hotho, A. (2018) · PLoS ONE · doi:10.1371/journal.pone.0204507 · Cited by 58
Classifier Performance Evaluation for Lightweight IDS Using Fog Computing in IoT Security
Khater, B. S., Wahab, A. W. A., Idris, M. Y. I., Hussain, M. A., Ibrahim, A. A., Amin, M. A., & Shehadeh, H. A. (2021) · Electronics · doi:10.3390/electronics10141633 · Cited by 63
“- Generalization capability and suitability for data that involves huge number of features yet very little sample points [97].”
Background
Deep Semisupervised Learning-Based Network Anomaly Detection in Heterogeneous Information Systems
Lutsiv, N., Maksymyuk, T., Beshley, M., Lavriv, O., Andrushchak, V., Sachenko, A., Vokorokos, L., & Gazda, J. (2021) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2022.018773 · Cited by 58
Employing a Machine Learning Approach to Detect Combined Internet of Things Attacks against Two Objective Functions Using a Novel Dataset
Foley, J., Moradpoor, N., & Ochenyi, H. (2020) · Security and Communication Networks · doi:10.1155/2020/2804291 · Cited by 57
“Furthermore, unlike [17, 19], a novel IoT dataset has been developed focusing on MRHOF and OF0 attacks including preprocessing techniques, feature reduction, sampling, and normalisation.”
BackgroundMethodResultInfluential
A Novel Framework Design of Network Intrusion Detection Based on Machine Learning Techniques
Zhang, C., Chen, Y., Meng, Y., Ruan, F., Chen, R., Li, Y., & Yang, Y. (2021) · Security and Communication Networks · doi:10.1155/2021/6610675 · Cited by 61
Derin Öğrenme Modelleri ve Uygulama Alanlarına İlişkin Bir Derleme
Doğan, F., & Türkoğlu, İ. (2019) · DÜMF Mühendislik Dergisi · doi:10.24012/dumf.411130 · Cited by 65
Deep Learning-Based Hybrid Intelligent Intrusion Detection System
Khan, M. A., & Kim, Y. (2021) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2021.015647 · Cited by 64
Procedures, Criteria, and Machine Learning Techniques for Network Traffic Classification: A Survey
Sheikh, M. S., & Peng, Y. (2022) · IEEE Access · doi:10.1109/access.2022.3181135 · Cited by 65
Resilience analysis of cyber‐physical systems: A review of models and methods
Cassottana, B., Roomi, M. M., Mashima, D., & Sansavini, G. (2023) · Risk Analysis · doi:10.1111/risa.14089 · Cited by 58
Is It Worth It? Comparing Six Deep and Classical Methods for Unsupervised Anomaly Detection in Time Series
Rewicki, F., Denzler, J., & Niebling, J. (2023) · Applied Sciences · doi:10.3390/app13031778 · Cited by 70
Hybrid physics-machine learning models for predicting rate of penetration in the Halahatang oil field, Tarim Basin
Jiao, S., Li, W., Li, Z., et al. (2024) · Scientific Reports · doi:10.1038/s41598-024-56640-y · Cited by 56
“The ANN training process has a complexity of O(emnk), where e is the number of epochs and k is the number of neurons 59 .”
Intrusion detection system using Online Sequence Extreme Learning Machine (OS-ELM) in advanced metering infrastructure of smart grid
Li, Y., Qiu, R., & Jing, S. (2018) · PLoS ONE · doi:10.1371/journal.pone.0192216 · Cited by 56
Research on the Internet of Things Device Recognition Based on RF-Fingerprinting
Tu, Y., Zhang, Z., Li, Y., et al. (2019) · IEEE Access · doi:10.1109/access.2019.2904657 · Cited by 56
“What’s more, with the wide application of artificial intelligence technology in interdisciplinary disciplines, deep learning-based algorithm was also proved to be very accurate and efficient [26], [27] for device recognition.”
Background
Tiki-Taka
Zhang, C., Costa‐Pérez, X., & Patras, P. (2020) · Cloud Computing Security Workshop · doi:10.1145/3411495.3421359 · Cited by 56
“1 INTRODUCTION Network Intrusion Detection (NID) aims at identifying malicious traffic flows, so as to protect computers, networks, servers, and data from attacks, unauthorized access, modification, or destruction [6].”
Background
Machine Learning for Physical Layer in 5G and beyond Wireless Networks: A Survey
Tanveer, J., Haider, A., Ali, R., & Kim, A. (2021) · Electronics · doi:10.3390/electronics11010121 · Cited by 58
Artificial intelligence analysis in cyber domain: A review
Zhao, L., Zhu, D., Shafik, W., et al. (2022) · International Journal of Distributed Sensor Networks · doi:10.1177/15501329221084882 · Cited by 55
An AI-Powered Network Threat Detection System
Wang, B., Chen, J.-L., & Yu, C.-L. (2022) · IEEE Access · doi:10.1109/access.2022.3175886 · Cited by 55
Robustness of deep autoencoder in intrusion detection under adversarial contamination
Madani, P., & Vlajic, N. (2018) · doi:10.1145/3190619.3190637 · Cited by 55
Machine Learning Intrusion Detection in Big Data Era: A Multi-Objective Approach for Longer Model Lifespans
Viegas, E. K., Santin, A. O., & Abreu, V. (2020) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2020.3038618 · Cited by 54
A Deep Learning-Based Intrusion Detection Technique for a Secured IoMT System
Awotunde, J. B., Abiodun, M. K., Adeniyi, A. E., et al. (2022) · Communications in computer and information science · doi:10.1007/978-3-030-95630-1_4 · Cited by 54
Application of meta-learning in cyberspace security: a survey
Yang, A., Lu, C., Li, J., Huang, X., Ji, T., Li, X., & Sheng, Y. (2022) · Digital Communications and Networks · doi:10.1016/j.dcan.2022.03.007 · Cited by 62
RAIDS: Robust autoencoder-based intrusion detection system model against adversarial attacks
Sarıkaya, A., Günel, B., & Demirci, M. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103483 · Cited by 61
Flow-MAE: Leveraging Masked AutoEncoder for Accurate, Efficient and Robust Malicious Traffic Classification
Hang, Z., Lu, Y., Wang, Y., & Xie, Y. (2023) · International Symposium on Research in Attacks, Intrusions and Defenses (RAID) · doi:10.1145/3607199.3607206 · Cited by 63
“Machine Learning (ML) has emerged as a promising network security paradigm [3, 7], particularly for malicious traffic classification, complementing traditional rule or fingerprint-based approaches [43].”
Background
NLP methods in host-based intrusion detection systems: A systematic review and future directions
Sworna, Z. T., Mousavi, Z., & Babar, M. A. (2023) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2023.103761 · Cited by 73
“A large number of review studies (KP et al., 2020; Aleesa et al., 2020; Aldweesh et al., 2020; Kalimuthan and Renjit, 2020; Gümüşbaş et al., 2020; Liu and Lang, 2019; Berman et al., 2019; Khraisat et al., 2019; Salo et al., 2018; Xin et al., 2018; Ahmadian Ramaki et al., 2018; Aleroud and Karabatis, 2017; Hodo et al.,…”
Background
Hybrid Feature Selection Models for Machine Learning Based Botnet Detection in IoT Networks
Guerra-Manzanares, A., Bahşi, H., & Nõmm, S. (2019) · International Conference on Cyberworlds (CW) · doi:10.1109/cw.2019.00059 · Cited by 54
Development of an Efficient Network Intrusion Detection Model Using Extreme Gradient Boosting (XGBoost) on the UNSW-NB15 Dataset
Husain, A., Salem, A., Jim, C., et al. (2019) · IEEE International Symposium on Signal Processing and Information Technology (ISSPIT) · doi:10.1109/isspit47144.2019.9001867 · Cited by 54
Network intrusion detection system: A survey on artificial intelligence‐based techniques
Habeeb, M. S., & Babu, T. R. (2022) · Expert Systems · doi:10.1111/exsy.13066 · Cited by 60
Abnormal Traffic Detection: Traffic Feature Extraction and DAE-GAN With Efficient Data Augmentation
Li, Z., Chen, S., Dai, H., Xu, D., Chu, C., & Xiao, B. (2022) · IEEE Transactions on Reliability · doi:10.1109/tr.2022.3204349 · Cited by 53
Machine learning-inspired intrusion detection system for IoT: Security issues and future challenges
Ahanger, T. A., Ullah, I., Algamdi, S. A., & Tariq, U. (2025) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2025.110265 · Cited by 53
Important Complexity Reduction of Random Forest in Multi-Classification Problem
Hassine, K., Erbad, A., & Hamila, R. (2019) · International Wireless Communications and Mobile Computing Conference (IWCMC) · doi:10.1109/iwcmc.2019.8766544 · Cited by 59
A Survey on Botnet Detection Techniques
Gaonkar, S., Dessai, N. F., Costa, J., et al. (2020) · International Conference on Emerging Trends in Information Technology and Engineering (ICETITE) · doi:10.1109/ic-etite47903.2020.id-70 · Cited by 53
A Review on Machine Learning Approaches for Network Malicious Behavior Detection in Emerging Technologies
Rabbani, M., Wang, Y., Khoshkangini, R., Jelodar, H., Zhao, R., Ahmadi, S. B. B., & Ayobi, S. (2021) · Entropy · doi:10.3390/e23050529 · Cited by 61
A precise and stable machine learning algorithm: eigenvalue classification (EigenClass)
Erkan, U. (2020) · Neural Computing and Applications · doi:10.1007/s00521-020-05343-2 · Cited by 55
Anomaly-Based Intrusion Detection by Machine Learning: A Case Study on Probing Attacks to an Institutional Network
Tufan, E., Tezcan, C., & Acartürk, C. (2021) · IEEE Access · doi:10.1109/access.2021.3068961 · Cited by 53
When a RF beats a CNN and GRU, together—A comparison of deep learning and classical machine learning approaches for encrypted malware traffic classification
Lichy, A., Bader, O., Dubin, R., Dvir, A. Z., & Hajaj, C. (2022) · Computers & Security · doi:10.1016/j.cose.2022.103000 · Cited by 52
Anomaly detection model based on gradient boosting and decision tree for IoT environments security
Douiba, M., Benkirane, S., Guezzaz, A., & Azrour, M. (2022) · Journal of Reliable Intelligent Environments · doi:10.1007/s40860-022-00184-3 · Cited by 52
Review of Cyberattack Implementation, Detection, and Mitigation Methods in Cyber-Physical Systems
Mtukushe, N. F., Onaolapo, A. K., Aluko, A., & Dorrell, D. G. (2023) · Energies · doi:10.3390/en16135206 · Cited by 52
Anomaly Detection in Industrial Networks using Machine Learning: A Roadmap
Meshram, A., & Haas, C. S. (2016) · Springer eBooks · doi:10.1007/978-3-662-53806-7_8 · Cited by 52
A Real-Time Sequential Deep Extreme Learning Machine Cybersecurity Intrusion Detection System
Haider, A., Khan, M. A., Rehman, A., Rahman, M., & Kim, H. S. (2020) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2020.013910 · Cited by 52
An overview of deep reinforcement learning for spectrum sensing in cognitive radio networks
Obite, F., Usman, A. D., & Okafor, E. (2021) · Digital Signal Processing · doi:10.1016/j.dsp.2021.103014 · Cited by 55
Securing Public Safety Communications on Commercial and Tactical 5G Networks: A Survey and Future Research Directions
Suomalainen, J., Julku, J., Vehkaperä, M., & Posti, H. (2021) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2021.3093529 · Cited by 54
Evaluation of Machine Learning Classifiers for Zero-Day Intrusion Detection -- An Analysis on CIC-AWS-2018 datasetPreprint
Zhou, Q., & Pezaros, D. P. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1905.03685 · Cited by 52
DeepAir: Deep Reinforcement Learning for Adaptive Intrusion Response in Software-Defined Networks
Phan, T. V., & Bauschert, T. (2022) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2022.3158468 · Cited by 51
Revolutionizing Malware Detection
Omar, M. (2024) · Advances in medical technologies and clinical practice book series · doi:10.4018/979-8-3693-1906-2.ch011 · Cited by 51
Applications of Artificial Intelligence and Machine Learning in the Area of SDN and NFV: A Survey
Gebremariam, A. A., Usman, M., & Qaraqe, M. (2019) · International Multi-Conference on Systems, Signals & Devices (SSD) · doi:10.1109/ssd.2019.8893244 · Cited by 51
Adaptive Intrusion Detection in the Networking of Large-Scale LANs With Segmented Federated Learning
Sun, Y., Esaki, H., & Ochiai, H. (2020) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2020.3044323 · Cited by 50
Cybersecurity Deep: Approaches, Attacks Dataset, and Comparative Study
Barik, K., Misra, S., Konar, K., Sanz, L. F., & Koyuncu, M. (2022) · Applied Artificial Intelligence · doi:10.1080/08839514.2022.2055399 · Cited by 59
Random Forest Based on Federated Learning for Intrusion Detection
Markovic, T., León, M., Buffoni, D., & Punnekkat, S. (2022) · IFIP advances in information and communication technology · doi:10.1007/978-3-031-08333-4_11 · Cited by 55
Real-time fusion multi-tier DNN-based collaborative IDPS with complementary features for secure UAV-enabled 6G networks
Hadi, H. J., Cao, Y., Li, S., et al. (2024) · Expert Systems with Applications · doi:10.1016/j.eswa.2024.124215 · Cited by 50
Foundations and applications of artificial Intelligence for zero-day and multi-step attack detection
Parrend, P., Navarro, J., Guigou, F., Deruyver, A., & Collet, P. (2018) · EURASIP Journal on Information Security · doi:10.1186/s13635-018-0074-y · Cited by 51
“research studies present overviews of the domain, for example, from the point of view of anomaly detection [21] or data mining and machine learning [22].”
Background
A Machine Learning-Based Intrusion Detection System for Securing Remote Desktop Connections to Electronic Flight Bag Servers
Bitton, R., & Shabtai, A. (2019) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2019.2914035 · Cited by 51
DIDEROT
Grammatikis, P. I. R., Sarigiannidis, P. G., Efstathopoulos, G., Karypidis, P.-A., & Sarigiannidis, A. G. (2020) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3407023.3409314 · Cited by 52
“More detailed information is available in recent survey papers in [1, 4, 16].”
Background
A Review of Intrusion Detection Systems in RPL Routing Protocol Based on Machine Learning for Internet of Things Applications
Seyfollahi, A., & Ghaffari, A. (2021) · Wireless Communications and Mobile Computing · doi:10.1155/2021/8414503 · Cited by 51
Sequence Aggregation Rules for Anomaly Detection in Computer Network TrafficPreprint
Radford, B. J., Richardson, B. D., & Davis, S. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.03735 · Cited by 50
A Peek Into the Reasoning of Neural Networks: Interpreting with Structural Visual Concepts
Ge, Y., Xiao, Y., Xu, Z., Zheng, M., Karanam, S., Chen, T., Itti, L., & Wu, Z. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.00223 · Cited by 50
Memory-Efficient Deep Learning for Botnet Attack Detection in IoT Networks
Popoola, S. I., Adebisi, B., Ande, R., Hammoudeh, M. A. A., & Atayero, A. A. A. (2021) · Electronics · doi:10.3390/electronics10091104 · Cited by 49
Development of a Machine-Learning Intrusion Detection System and Testing of Its Performance Using a Generative Adversarial Network
Mari, A.-G., Zinca, D., & Dobrotă, V. (2023) · Sensors · doi:10.3390/s23031315 · Cited by 49

Authors: Buczak, A. L., & Guven, E.
Affiliations: Johns Hopkins University (US)
ORCID: Buczak, Anna L.
Venue: IEEE Communications Surveys & Tutorials
Publisher: Institute of Electrical and Electronics Engineers (IEEE)
Published: 2016
Volume: 18
Issue: 2
Pages: 1153-1176
ISSN: 1553-877X (ISSN-L)
2373-745X
DOI: 10.1109/comst.2015.2494502
OpenAlex: W2342408547
Semantic Scholar: 971766088dfaf63fb55e6f0190b14f28f2c98ad0
Cited by: 3,332
References: 119
Citations by year: 2026: 460 · 2025: 395 · 2024: 297 · 2023: 319 · 2022: 403 · 2021: 447 · 2020: 394 · 2019: 314 · 2018: 217 · 2017: 73 · 2016: 11
FWCI: 115.39
Type: journal article
Language: en
Open access: closed
Licence: ieeexplore.ieee.org/Xplorehelp/downloads/license-information/OAPA.html (vor)
Locations: IEEE Communications Surveys & Tutorials (publishedVersion)
Funders: Department of Homeland Security Network Security Deployment Division (HSSA01-13-C-2709)
Topics: Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
Physical Sciences › Computer Science › Artificial Intelligence › Artificial Immune Systems Applications
Keywords: intrusion detection, cybersecurity, machine learning, data mining, algorithmic complexity

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection

Abstract

Overview

Integrity signals

Verification

Claims the paper makes

Claims other papers make about this one

Citations

Cites

Cited by

Related

Metadata

Record

About these checks