Cited by 3,332Network Security and Intrusion DetectionNetwork Packet Processing and OptimizationArtificial Immune Systems Applications

The DOI matches its Crossref record; 114 of the 119 references it cites were found in a registry or an index, and 4 are not checked yet.

A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection

Buczak, Anna L., Guven, Erhan·2016·IEEE Communications Surveys & Tutorials

DOI 10.1109/comst.2015.2494502

Open this paper in CoChat — free account

Abstract

This survey paper describes a focused literature survey of machine learning (ML) and data mining (DM) methods for cyber analytics in support of intrusion detection. Short tutorial descriptions of each ML/DM method are provided. Based on the number of citations or the relevance of an emerging method, papers representing each method were identified, read, and summarized. Because data are so important in ML/DM approaches, some well-known cyber data sets used in ML/DM are described. The complexity of ML/DM algorithms is addressed, discussion of challenges for using ML/DM for cyber security is presented, and some recommendations on when to use a given method are provided.

Integrity signals

Registry

Crossref · 10.1109/comst.2015.2494502

Cites

114 of 118 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Random Forests
Breiman, L. (2001) · Machine Learning · doi:10.1023/a:1010933404324 · Cited by 133,538
Fuzzy sets
Zadeh, L. A. (1965) · Information and Control · doi:10.1016/s0019-9958(65)90241-x · Cited by 67,855
Particle swarm optimization
Kennedy, J., & Eberhart, R. (2002) · Proceedings of ICNN'95 - International Conference on Neural Networks · doi:10.1109/icnn.1995.488968 · Cited by 58,192
Maximum Likelihood from Incomplete Data Via the EM Algorithm
Dempster, A. P., Laird, N. M., & Rubin, D. B. (1977) · Journal of the Royal Statistical Society Series B: Statistical Methodology · doi:10.1111/j.2517-6161.1977.tb01600.x · Cited by 50,444
Fuzzy sets
Zadeh, L. A. (1996) · Cited by 46,960
The Nature of Statistical Learning Theory
Vapnik, V. (2000) · Statistics for Engineering and Information Science · doi:10.1007/978-1-4757-3264-1 · Cited by 46,387
Collective dynamics of ‘small-world’ networks
Watts, D. J., & Strogatz, S. H. (1998) · Nature · doi:10.1038/30918 · Cited by 43,060
The Nature of Statistical Learning Theory
Vapnik, V. N. (1995) · doi:10.1007/978-1-4757-2440-0 · Cited by 39,138
Data Mining: Practical Machine Learning Tools and Techniques
Witten, I. H., Frank, E., & Hall, M. A. (2011) · Elsevier eBooks · doi:10.1016/c2009-0-19715-5 · Cited by 25,543
Untitled work
(1992) · Cited by 23,431

Flagged first, then by citations

Show all 119 references

1 of the 119 references couldn’t be matched to a known paper.

Research works printed but not linked: 14

Shearer, 2000, The CRISP-DM model: The new blueprint for data mining, J. Data Warehouse., 5, 13
2000, R Core Team
Jacobson, 1989, The Tcpdump Manual Page
Combs, 2014, Wireshark
2014, Sourcefire
Stolfo, 2014, KDD Cup 1999 Data Set
2015, IBM
10.4108/wkdd.2008.2686 · DOI
2014, Politecnico di Torino, Analyzer 3.0
Baralis, 2008, Generalized Itemset Discovery by Means of Opportunistic Aggregation
Markov, 1971, Extension of the limit theorems of probability theory to a sum of variables connected in a chain, Dynamic Probabilistic Systems, 1
10.2307/2984875 · DOI
Brauckhoff, 2008, Flame: A low-level anomaly modeling engine
Paxson, 2004, Bro 0.9

Sorted by citations

Items 501–600 of 1,003

Euler : Detecting Network Lateral Movement via Scalable Temporal Link Prediction
King, I. J., & Huang, H. H. (2023) · ACM Transactions on Privacy and Security · doi:10.1145/3588771 · Cited by 63
HAE-HRL: A network intrusion detection system utilizing a novel autoencoder and a hybrid enhanced LSTM-CNN-based residual network
Xue, Y., Kang, C., & Yu, H. (2025) · Computers & Security · doi:10.1016/j.cose.2025.104328 · Cited by 58
Development of Machine Learning Algorithms for Prediction of 5-Year Spinal Chordoma Survival
Karhade, A. V., Thio, Q. C. B. S., Ogink, P. T., Kim, J., Lozano‐Calderón, S. A., Raskin, K. A., & Schwab, J. H. (2018) · World Neurosurgery · doi:10.1016/j.wneu.2018.07.276 · Cited by 51
A Data Sharing Protocol to Minimize Security and Privacy Risks of Cloud Storage in Big Data Era
Han, S. Y., Han, K., & Zhang, S. (2019) · IEEE Access · doi:10.1109/access.2019.2914862 · Cited by 51
“They includes processing methods such as data collection [33], data mining [34] and data aggregation [35].”
Method
Data-Driven Decision Support for Optimizing Cyber Forensic Investigations
Nisioti, A., Loukas, G., Lászka, Á., & Panaousis, E. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3054966 · Cited by 49
A collective AI via lifelong learning and sharing at the edge
Soltoggio, A., Ben-Iwhiwhu, E., Braverman, V., Eaton, E., Epstein, B., Ge, Y., Halperin, L., How, J., Itti, L., Jacobs, M. A., et al. (2024) · Nature Machine Intelligence · doi:10.1038/s42256-024-00800-2 · Cited by 51
Unsupervised Machine Learning Techniques for Network Intrusion Detection on Modern Data
Verkerken, M., D’hooge, L., Wauters, T., et al. (2020) · Cyber Security in Networking Conference (CSNet) · doi:10.1109/csnet50428.2020.9265461 · Cited by 48
Large-scale cyber attacks monitoring using Evolving Cauchy Possibilistic Clustering
Škrjanc, I., Ozawa, S., Ban, T., & Dovžan, D. (2017) · Applied Soft Computing · doi:10.1016/j.asoc.2017.11.008 · Cited by 48
A Method for Guaranteeing Wireless Communication Based on a Combination of Deep and Shallow Learning
Tian, Q., Li, J., & Liu, H. (2019) · IEEE Access · doi:10.1109/access.2019.2905754 · Cited by 48
Exploring anomalous behaviour detection and classification for insider threat identification
Le, D. C., & Zincir‐Heywood, N. (2021) · International Journal of Network Management · doi:10.1002/nem.2109 · Cited by 56
“29,30 In this paper, we employed feed forward neural networks with up to three fully connected hidden layers, as well as rectified linear unit 31 and logistic as the activation functions for hidden layers and the output layer, respectively.”
BackgroundMethod
Evaluation of Machine Learning Techniques for Traffic Flow-Based Intrusion Detection
Rodríguez, M., Alesanco, Á., Mehavilla, L., et al. (2022) · Sensors · doi:10.3390/s22239326 · Cited by 47
“When training classification methods aimed to work in real-time mode at least three factors should be considered: time complexity, incremental update capability, and generalization capacity [9].”
BackgroundMethod
Enhanced Quantum-Secure Ensemble Intrusion Detection Techniques for Cloud Based on Deep Learning
Salvakkam, D. B., Saravanan, V., Jain, P. K., & Pamula, R. (2023) · Cognitive Computation · doi:10.1007/s12559-023-10139-2 · Cited by 52
SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detection
Apruzzese, G., Laskov, P., & Schneider, J. (2023) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp57164.2023.00042 · Cited by 73
Network intrusion datasets: A survey, limitations, and recommendations
Goldschmidt, P., & Chudá, D. (2025) · Computers & Security · doi:10.1016/j.cose.2025.104510 · Cited by 76
“Additional IDSs characteristics include the ability to operate in real-time and whether they merely report the attack or actively participate in its mitigation [6, 7].”
A cyber‐secure control‐detector architecture for nonlinear processes
Chen, S., Wu, Z., & Christofides, P. D. (2020) · AIChE Journal · doi:10.1002/aic.16907 · Cited by 47
Kernel-level tracing for detecting stegomalware and covert channels in Linux environments
Caviglione, L., Mazurczyk, W., Repetto, M., Schaffhauser, A., & Zuppelli, M. (2021) · Computer Networks · doi:10.1016/j.comnet.2021.108010 · Cited by 52
A Deep Learning Model for Information Loss Prevention From Multi-Page Digital Documents
Guha, A., Samanta, D., Banerjee, A., et al. (2021) · IEEE Access · doi:10.1109/access.2021.3084841 · Cited by 46
A Novel Intrusion Detection Approach Using Machine Learning Ensemble for IoT Environments
Verma, P., Dumka, A., Singh, R., Ashok, A., Gehlot, A., Malik, P. K., Gaba, G. S., & Hedabou, M. (2021) · Applied Sciences · doi:10.3390/app112110268 · Cited by 46
Towards unbalanced multiclass intrusion detection with hybrid sampling methods and ensemble classification
Le, T.-T.-H., Shin, Y., Kim, M., & Kim, H. (2024) · Applied Soft Computing · doi:10.1016/j.asoc.2024.111517 · Cited by 58
Measuring the accuracy of software vulnerability assessments: experiments with students and professionals
Allodi, L., Cremonini, M., Massacci, F., & Shim, W. (2020) · Empirical Software Engineering · doi:10.1007/s10664-019-09797-4 · Cited by 45
“…mitigating the uncertainty of human-driven security assessments through AI techniques is gaining traction in the cybersecurity field, with several attempts to automate security decisions, from software development to maintenance and deployment (Conti et al. 2018; Morel 2011; Buczak and Guven 2016).”
STAN: Synthetic Network Traffic Generation with Generative Neural Models
Xu, S., Marwah, M., Arlitt, M. F., & Ramakrishnan, N. (2021) · Communications in computer and information science · doi:10.1007/978-3-030-87839-9_1 · Cited by 60
A comprehensive review on deep learning algorithms: Security and privacy issues
Tayyab, M. A., Marjani, M., Jhanjhi, N. Z., Hashem, M., Usmani, R. S. A., & Qamar, F. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103297 · Cited by 50
AI and Cyber-Security: Enhancing threat detection and response with machine learning.
Katiyar, N., Tripathi, M. S., Kumar, M. P., Verma, M. S., Sahu, A. K., & Saxena, S. (2024) · doi:10.53555/kuey.v30i4.2377 · Cited by 60
Review of intrusion detection system in cyber‐physical system based networks: Characteristics, industrial protocols, attacks, data sets and challenges
Ji, R., Padha, D., Singh, Y. P., & Sharma, S. (2024) · Transactions on Emerging Telecommunications Technologies · doi:10.1002/ett.5029 · Cited by 45
Network Intrusion Detection: An IoT and Non IoT-Related Survey
Abdulkareem, S. A., Foh, C. H., Shojafar, M., Carrez, F., & Moessner, K. (2024) · IEEE Access · doi:10.1109/access.2024.3473289 · Cited by 47
A Two-Stage Classifier Approach for Network Intrusion Detection
Zong, W., Chow, Y.-W., & Susilo, W. (2018) · Lecture notes in computer science · doi:10.1007/978-3-319-99807-7_20 · Cited by 45
“While the most effective method for the development of NIDS remains a challenging and open question, machine learning is seen as a very promising approach as these techniques can perform real-time automated detection of potential threats [2, 17].”
BackgroundMethod
Supervised Machine Learning Techniques for Efficient Network Intrusion Detection
Aboueata, N. M., Al-Rasbi, S., Erbad, A., et al. (2019) · International Conference on Computer Communication and Networks (ICCCN) · doi:10.1109/icccn.2019.8847179 · Cited by 45
Leveraging siamese networks for one-shot intrusion detection model
Hindy, H., Tachtatzis, C., Atkinson, R. C., Brosset, D., Bureš, M., Andonović, I., Michie, C., & Bellekens, X. (2022) · Journal of Intelligent Information Systems · doi:10.1007/s10844-022-00747-z · Cited by 50
“ne-Shot Learning, Siamese Network. F 1 INTRODUCTION I Ntrusion Detection System (IDS) development has its roots in statistical models [1], and has recently evolved to the use of Machine Learning (ML) [2] based on hybrid models and adaptive techniques [3]. Developments to date have highlighted two fundamental considera…”
Generative-Adversarial Class-Imbalance Learning for Classifying Cyber-Attacks and Faults - A Cyber-Physical Power System
Farajzadeh-Zanjani, M., Hallaji, E., Razavi‐Far, R., & Saif, M. (2021) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3118636 · Cited by 45
Detection of DoS Attack using AdaBoost Algorithm on IoT System
Rachmadi, S., Mandala, S., & Oktaria, D. (2021) · International Conference on Data Science and Its Applications (ICoDSA) · doi:10.1109/icodsa53588.2021.9617545 · Cited by 44
Blockchain and Machine Learning: A Critical Review on Security
Taherdoost, H. (2023) · Information · doi:10.3390/info14050295 · Cited by 57
“Data analysis techniques have historically been extensively used in the cybersecurity area [13], and the recent proliferation of powerful ML techniques has enabled the accurate identiﬁcation of cyberattacks and the detection of threats, both in real-time and in post-incident assessments [14,15].”
Big Data and Machine Learning in Defence
Weng, Y., & Wu, J. (2024) · International Journal of Computer Science and Information Technology · doi:10.5121/ijcsit.2024.16203 · Cited by 44
A Collaborative Study of Intrusion Detection and Prevention Techniques in Cloud Computing
Alam, S., Shuaib, M., & Samad, A. (2018) · Lecture notes in networks and systems · doi:10.1007/978-981-13-2324-9_23 · Cited by 44
Deep in the Dark - Deep Learning-Based Malware Traffic Detection Without Expert Knowledge
Marín, G., Casas, P., & Capdehourat, G. (2019) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2019.00019 · Cited by 44
Malware Attack Predictive Analytics in a Cyber Supply Chain Context Using Machine Learning
Yeboah-Ofori, A., & Boachie, C. (2019) · International Conference on Cyber Security and Internet of Things (ICSIoT) · doi:10.1109/icsiot47925.2019.00019 · Cited by 46
The Challenges in ML-Based Security for SDN
Nguyen, T. N. (2018) · Cyber Security in Networking Conference (CSNet) · doi:10.1109/csnet.2018.8602680 · Cited by 44
Machine Learning, Data Mining, and Big Data Analytics for 5G-Enabled IoT
Aggarwal, P. K., Jain, P., Mehta, J., Garg, R., Makar, K., & Chaudhary, P. (2021) · Springer eBooks · doi:10.1007/978-3-030-67490-8_14 · Cited by 44
MidSiot: A Multistage Intrusion Detection System for Internet of Things
Nguyen, D.-T., Xuan-Ninh, H., & Le, K.-H. (2022) · Wireless Communications and Mobile Computing · doi:10.1155/2022/9173291 · Cited by 52
Recurrent Neural Network Language Models for Open Vocabulary Event-Level Cyber Anomaly DetectionPreprint
Tuor, A. R., Baerwolf, R., Knowles, N., Hutchinson, B., Nichols, N., & Jasper, R. J. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1712.00557 · Cited by 50
“Extensive discussion of machine learning applications in cyber security is presented in (Bhattacharyya and Kalita 2013; Buczak and Guven 2016; Dua and Du 2016; Kumar, Kumar, and Sachdeva 2010; Zuech, Khoshgoftaar, and Wald 2015; Rubin-Delanchy, Lawson, and Heard 2016).”
Background
Security Approaches in Machine Learning for Satellite Communication
Rath, M., & Mishra, S. (2019) · Studies in computational intelligence · doi:10.1007/978-3-030-20212-5_10 · Cited by 43
Intelligent Software-Defined Network for Cognitive Routing Optimization using Deep Extreme Learning Machine Approach
Alhaidari, F. A., Almotiri, S. H., Ghamdi, M. A. A., Khan, M. A., Rehman, A., Abbas, S., Khan, K. M., & Rahman, A. (2021) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2021.013303 · Cited by 43
A scalable network intrusion detection system towards detecting, discovering, and learning unknown attacks
Zhang, Z., Zhang, Y., Guo, D., & Song, M. N. (2021) · International Journal of Machine Learning and Cybernetics · doi:10.1007/s13042-020-01264-7 · Cited by 43
MGA-IDS: Optimal feature subset selection for anomaly detection framework on in-vehicle networks-CAN bus based on genetic algorithm and intrusion detection approach
Aksu, D., & Aydın, M. A. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102717 · Cited by 50
Point Cloud Analysis for ML-Based Malicious Traffic Detection: Reducing Majorities of False Positive Alarms
Fu, C., Li, Q. L., Xu, K., & Wu, J. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3616631 · Cited by 45
Enhancing Network Intrusion Detection Using an Ensemble Voting Classifier for Internet of Things
Farooqi, A. H., Akhtar, S., Rahman, H., Sadiq, T., & Abbass, W. (2023) · Sensors · doi:10.3390/s24010127 · Cited by 44
“In this regard, extensive research efforts have been devoted to the exploration of intrusion detection systems (IDSs) aimed at identifying and thwarting malicious activities within computer networks [4–7].”
Background
A systematic review on intrusion detection based on the Hidden Markov Model
Ramaki, A. A., Rasoolzadegan, A., & Jafari, A. J. (2018) · Statistical Analysis and Data Mining The ASA Data Science Journal · doi:10.1002/sam.11377 · Cited by 43
Deep Radial Intelligence with Cumulative Incarnation approach for detecting Denial of Service attacks
Amma, N. G. B., & Selvakumar, S. (2019) · Neurocomputing · doi:10.1016/j.neucom.2019.02.047 · Cited by 42
Detecting Cyber Attacks Using Anomaly Detection with Explanations and Expert Feedback
Siddiqui, A., Stokes, J. W., Seifert, C., Argyle, E., McCann, R., Neil, J., & Carroll, J. (2019) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp.2019.8683212 · Cited by 43
“Detecting cyber attacks using machine learning techniques is a promising new field, and a number of supervised methods have been employed for that purpose [2, 3].”
Method
Supervised Machine Learning Based Network Intrusion Detection System for Internet of Things
Rani, D., & Kaushal, N. C. (2020) · International Conference on Computing, Communication and Networking Technologies (ICCCNT) · doi:10.1109/icccnt49239.2020.9225340 · Cited by 43
Human Falling Detection Algorithm Based on Multisensor Data Fusion with SVM
Pan, D., Liu, H., Qu, D., & Zhang, Z. (2020) · Mobile Information Systems · doi:10.1155/2020/8826088 · Cited by 44
“Finally, DG uterine distance was used as the input of MDS to obtain the result of reducing the size [19, 20].”
Method
Lightweight Hybrid Detection of Data Exfiltration using DNS based on Machine Learning
Mahdavifar, S., Salem, A. H., Victor, P., et al. (2021) · doi:10.1145/3507509.3507520 · Cited by 42
“Authority and additional sections inherit the format of the answer section, moreover can be exploited by the server to deliver commands and data to the infected clients [9].”
Background
An Effective Ensemble Automatic Feature Selection Method for Network Intrusion Detection
Zhang, Y., Zhang, H., & Zhang, B. (2022) · Information · doi:10.3390/info13070314 · Cited by 42
Deep learning-based image encryption techniques: Fundamentals, current trends, challenges and future directions
Singh, O. P., Singh, K. N., Singh, A. K., & Agrawal, A. K. (2024) · Neurocomputing · doi:10.1016/j.neucom.2024.128714 · Cited by 44
Can Ternary Computing Improve Information Assurance?
Cambou, B., Flikkema, P. G., Palmer, J., Telesca, D. A., & Philabaum, C. R. (2018) · Cryptography · doi:10.3390/cryptography2010006 · Cited by 40
A Network Intrusion Detection System Based On Ensemble CVM Using Efficient Feature Selection Approach
Divyasree, T., & Sherly, K. K. (2018) · Procedia Computer Science · doi:10.1016/j.procs.2018.10.416 · Cited by 42
Training Guidance with KDD Cup 1999 and NSL-KDD Data Sets of ANIDINR: Anomaly-Based Network Intrusion Detection System
Serinelli, B. M., Collen, A., & Nijdam, N. A. (2020) · Procedia Computer Science · doi:10.1016/j.procs.2020.07.080 · Cited by 42
Cyber intrusion detection through association rule mining on multi-source logs
Lou, P., Lu, G., Jiang, X., et al. (2020) · Applied Intelligence · doi:10.1007/s10489-020-02007-5 · Cited by 42
“The intrusion detection methods proposed by researchers are mainly two types: misuse-based and anomaly-based [6] [24].”
Method
Evaluation of Classification algorithms for Distributed Denial of Service Attack Detection
Gohil, M., & Kumar, S. (2020) · IEEE International Conference on Artificial Intelligence and Knowledge Engineering (AIKE) · doi:10.1109/aike48582.2020.00028 · Cited by 42
A Multinomial DGA Classifier for Incipient Fault Detection in Oil-Impregnated Power Transformers
Odongo, G. Y., Musabe, R., & Hanyurwimfura, D. (2021) · Algorithms · doi:10.3390/a14040128 · Cited by 42
Remora whale optimization-based hybrid deep learning for network intrusion detection using CNN features
Pingale, S. V., & Sutar, S. R. (2022) · Expert Systems with Applications · doi:10.1016/j.eswa.2022.118476 · Cited by 42
MLIDS: A Machine Learning Approach for Intrusion Detection for Real Time Network Dataset
Rokade, M. D., & Sharma, Y. K. (2021) · International Conference on Emerging Smart Computing and Informatics (ESCI) · doi:10.1109/esci50559.2021.9396829 · Cited by 41
Scope of machine learning applications for addressing the challenges in next‐generation wireless networks
Samanta, R. K., Sadhukhan, B., Samaddar, H., Sarkar, S., Koner, C., & Ghosh, M. (2022) · CAAI Transactions on Intelligence Technology · doi:10.1049/cit2.12114 · Cited by 47
Recurrent nonsymmetric deep auto encoder approach for network intrusion detection system
M, S. Y., & Kalpana, R. (2022) · Measurement Sensors · doi:10.1016/j.measen.2022.100527 · Cited by 46
Communications Security in Industry X: A Survey
Ahmad, I., Rodriguez, F., Kumar, T., Suomalainen, J., Jagatheesaperumal, S. K., Walter, S., Asghar, M. Z., Li, G., Papakonstantinou, N., Ylianttila, M., et al. (2024) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2024.3356076 · Cited by 43
ANN-DPC: Density peak clustering by finding the adaptive nearest neighbors
Yan, H., Wang, M., & Xie, J. (2024) · Knowledge-Based Systems · doi:10.1016/j.knosys.2024.111748 · Cited by 41
Sustainable securing of Medical Cyber-Physical Systems for the healthcare of the future
Celdrán, A. H., Pérez, M. G., Clemente, F. J. G., & Pérez, G. M. (2018) · Sustainable Computing Informatics and Systems · doi:10.1016/j.suscom.2018.02.010 · Cited by 43
Unsupervised intrusion detection through skip-gram models of network behavior
Carrasco, R. S. M., & Sicilia, M. (2018) · Computers & Security · doi:10.1016/j.cose.2018.07.003 · Cited by 41
A fast unsupervised preprocessing method for network monitoring
Lopez, M. A., Mattos, D. M. F., Duarte, O. C. M. B., & Pujolle, G. (2018) · Annals of Telecommunications · doi:10.1007/s12243-018-0663-2 · Cited by 41
“We selected these algorithms because they are the most used ones for network security [33].”
Method
Detecting IoT User Behavior and Sensitive Information in Encrypted IoT-App Traffic
Subahi, A., & Theodorakopoulos, G. (2019) · Sensors · doi:10.3390/s19214777 · Cited by 41
“To support our choice, a recent survey on ML methods for security [49] discusses the advantages of using Random Forest.”
Method
Detection of anomaly intrusion utilizing self-adaptive grasshopper optimization algorithm
Shukla, A. K. (2020) · Neural Computing and Applications · doi:10.1007/s00521-020-05500-7 · Cited by 42
“Most of asymmetric circulation of information and distinguishing the boundaries between typical and unusual parameters problems are revealed by feature selection approach, it is also usually used before ML algorithms to increase the efﬁciency of training [18].”
BackgroundMethod
IoT Wireless Intrusion Detection and Network Traffic Analysis
Ponnusamy, V., Aun, Y., Jhanjhi, N. Z., et al. (2021) · Computer Systems Science and Engineering · doi:10.32604/csse.2022.018801 · Cited by 41
Adaptive Anomaly Detection Framework Model Objects in Cyberspace
Alkahtani, H. S., Aldhyani, T. H. H., & Al‐Yaari, M. (2020) · Applied Bionics and Biomechanics · doi:10.1155/2020/6660489 · Cited by 40
Retracted
Malware detection on windows audit logs using LSTMs
Ring, M., Schlör, D., Wunderlich, S., Landes, D., & Andreas Hotho, A. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102389 · Cited by 45
A novel flow-vector generation approach for malicious traffic detection
Hou, J., Liu, F., Lu, H. D., Tan, Z., Zhuang, X., & Tian, Z. (2022) · Journal of Parallel and Distributed Computing · doi:10.1016/j.jpdc.2022.06.004 · Cited by 40
Advanced Persistent Threat Identification with Boosting and Explainable AI
Hasan, M. M., Islam, M. U., & Uddin, J. (2023) · SN Computer Science · doi:10.1007/s42979-023-01744-x · Cited by 40
Machine Learning as an Adversarial Service: Learning Black-Box Adversarial Examples.
Hayes, J., & Danezis, G. (2017) · Cited by 44
Machine learning applications in imaging analysis for patients with pituitary tumors: a review of the current literature and future directions
Saha, A., Tso, S., Rabski, J., Sadeghian, A., & Cusimano, M. D. (2020) · Pituitary · doi:10.1007/s11102-019-01026-x · Cited by 41
“…of the manuscript. increasing applicability to develop sophisticated tools in various areas of data processing such as natural language processing (NLP) [2], computer vision (analyzing images or videos) [3–5], data mining [6, 7], robotics [8], gaming [9, 10], and big data in general [11].”
Background
Comprehensive analysis and recommendation of feature evaluation measures for intrusion detection
Binbusayyis, A., & Vaiyapuri, T. (2020) · Heliyon · doi:10.1016/j.heliyon.2020.e04262 · Cited by 40
“In this line, many researches are being carried out to develop intelligent IDS and achieve better network security [12].”
Background
MalDIST: From Encrypted Traffic Classification to Malware Traffic Detection and Classification
Bader, O., Lichy, A., Hajaj, C., Dubin, R., & Dvir, A. Z. (2022) · IEEE Consumer Communications and Networking Conference · doi:10.1109/ccnc49033.2022.9700625 · Cited by 41
Badminton match outcome prediction model using Naïve Bayes and Feature Weighting technique
Sharma, M., Monika, Kumar, N., et al. (2020) · Journal of Ambient Intelligence and Humanized Computing · doi:10.1007/s12652-020-02578-8 · Cited by 39
“…(Le et al. 2018a), intelligent agents and fraud detection (Le et al. 2018a, b, c, d), pattern recognition (Le et al. 2018d),cyber security (Buczak and Guven 2015; Shaukat et al. 2020),internet traffic classification (Nguyen and Armitage 2008), cognitive radios (Bkassiny et al. 2012), drug…”
Background
Development of a network intrusion detection system using Apache Hadoop and Spark
Kato, K., & Klyuev, V. (2017) · IEEE Conference on Dependable and Secure Computing (DSC) · doi:10.1109/desec.2017.8073860 · Cited by 39
Towards Viable Intrusion Detection Methods For The Automotive Controller Area Network
Tomlinson, A., Bryans, J. W., & Shaikh, S. A. (2018) · Pure (Coventry University) · doi:10.1145/3273946.3273950 · Cited by 38
“Support Vector Machines O(n2) Medium Low Can deal with highdimensional data and small samples [3, 33].”
BackgroundMethodInfluential
Review of Cybersecurity Research Topics, Taxonomy and Challenges: Interdisciplinary Perspective
Suryotrisongko, H., & Musashi, Y. (2019) · IEEE International Conference on Service-Oriented Computing and Applications (SOCA) · doi:10.1109/soca.2019.00031 · Cited by 42
Large-Scale and Robust Intrusion Detection Model Combining Improved Deep Belief Network With Feature-Weighted SVM
Wu, Y., Lee, W. W., Xu, Z., & Ni, M. (2020) · IEEE Access · doi:10.1109/access.2020.2994947 · Cited by 41
An intrusion detection system for packet and flow based networks using deep neural network approach
Farhana, K., Rahman, M., & Ahmed, M. T. (2020) · International Journal of Power Electronics and Drive Systems/International Journal of Electrical and Computer Engineering · doi:10.11591/ijece.v10i5.pp5514-5525 · Cited by 39
Artificial Intelligence (AI)-Centric Management of Resources in Modern Distributed Computing Systems
Ilager, S., Muralidhar, R., & Buyya, R. (2020) · IEEE Cloud Summit · doi:10.1109/ieeecloudsummit48914.2020.00007 · Cited by 43
Towards a Secure Internet of Things: A Comprehensive Study of Second Line Defense Mechanisms
Kamaldeep, Dutta, M., & Granjal, J. (2020) · IEEE Access · doi:10.1109/access.2020.3005643 · Cited by 42
An Efficient Mixed Attribute Outlier Detection Method for Identifying Network Intrusions
Beulah, J. R., & Punithavathani, D. S. (2020) · International Journal of Information Security and Privacy · doi:10.4018/ijisp.2020070107 · Cited by 38
Dynamic user-centric access control for detection of ransomware attacks
McIntosh, T. R., Kayes, A. S. M., Chen, Y. P., Ng, A., & Watters, P. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102461 · Cited by 38
Study of Multi-Class Classification Algorithms’ Performance on Highly Imbalanced Network Intrusion Datasets
Bulavas, V., Marcinkevičius, V., & Rumiński, J. (2021) · Informatica · doi:10.15388/21-infor457 · Cited by 44
Intelligent Cyber-Security System for IoT-Aided Drones Using Voting Classifier
Majeed, R., Abdullah, N. A., Mushtaq, M. F., Umer, M., & Nappi, M. (2021) · Electronics · doi:10.3390/electronics10232926 · Cited by 39
Network Intrusion Detection Using Machine Learning Techniques
Almutairi, Y., Alhazmi, B., & Munshi, A. (2022) · Advances in Science and Technology – Research Journal · doi:10.12913/22998624/149934 · Cited by 58
ChatGPT or Bard: Who is a better Certified Ethical Hacker?
Raghu Raman, R., Calyam, P. P., & Achuthan, K. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103804 · Cited by 48
Anomaly Detection Methods for IIoT Networks
Zhou, L., & Guo, H. (2018) · IEEE International Conference on Service Operations and Logistics, and Informatics (SOLI) · doi:10.1109/soli.2018.8476769 · Cited by 38
Embedded Intrusion Detection System for Detecting Attacks over CAN-BUS
Casillo, M., Coppola, S., Santo, M. D., Pascale, F., & Santonicola, E. (2019) · International Conference on System Reliability and Safety (ICSRS) · doi:10.1109/icsrs48664.2019.8987605 · Cited by 38
Information Security threats and attacks with conceivable counteraction
Sinha, P., Kumar, A., & Bhushan, B. (2019) · International Conference on Intelligent Computing, Instrumentation and Control Technologies (ICICICT) · doi:10.1109/icicict46008.2019.8993384 · Cited by 38
A survey on analysis and detection of Android ransomware
Sharma, S. G., Kumar, R., & Krishna, C. R. (2021) · Concurrency and Computation Practice and Experience · doi:10.1002/cpe.6272 · Cited by 38
“Consider the following simple state transition: state 1-> state 2 which are interconnected to each other so that state 1 can be reachable from state 2 and vice-versa.”
Background
Investigating the practicality of adversarial evasion attacks on network intrusion detection
Merzouk, M. A., Cuppens, F., Cuppens-Boulahia, N., & Yaich, R. (2022) · Annals of Telecommunications · doi:10.1007/s12243-022-00910-1 · Cited by 47
A Method of Intrusion Detection Based on WOA‐XGBoost Algorithm
Song, Y. X., Li, H., Xu, P., & Liu, D. (2022) · Discrete Dynamics in Nature and Society · doi:10.1155/2022/5245622 · Cited by 40
SoK: The Impact of Unlabelled Data in Cyberthreat Detection
Apruzzese, G., Laskov, P., & Tastemirova, A. (2022) · European Symposium on Security and Privacy · doi:10.1109/eurosp53844.2022.00010 · Cited by 53

Authors: Buczak, A. L., & Guven, E.
Affiliations: Johns Hopkins University (US)
ORCID: Buczak, Anna L.
Venue: IEEE Communications Surveys & Tutorials
Publisher: Institute of Electrical and Electronics Engineers (IEEE)
Published: 2016
Volume: 18
Issue: 2
Pages: 1153-1176
ISSN: 1553-877X (ISSN-L)
2373-745X
DOI: 10.1109/comst.2015.2494502
OpenAlex: W2342408547
Semantic Scholar: 971766088dfaf63fb55e6f0190b14f28f2c98ad0
Cited by: 3,332
References: 119
Citations by year: 2026: 460 · 2025: 395 · 2024: 297 · 2023: 319 · 2022: 403 · 2021: 447 · 2020: 394 · 2019: 314 · 2018: 217 · 2017: 73 · 2016: 11
FWCI: 115.39
Type: journal article
Language: en
Open access: closed
Licence: ieeexplore.ieee.org/Xplorehelp/downloads/license-information/OAPA.html (vor)
Locations: IEEE Communications Surveys & Tutorials (publishedVersion)
Funders: Department of Homeland Security Network Security Deployment Division (HSSA01-13-C-2709)
Topics: Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
Physical Sciences › Computer Science › Artificial Intelligence › Artificial Immune Systems Applications
Keywords: intrusion detection, cybersecurity, machine learning, data mining, algorithmic complexity

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection

Abstract

Overview

Integrity signals

Verification

Claims the paper makes

Claims other papers make about this one

Citations

Cites

Cited by

Related

Metadata

Record

About these checks