Cited by 3,332Network Security and Intrusion DetectionNetwork Packet Processing and OptimizationArtificial Immune Systems Applications

The DOI matches its Crossref record; 114 of the 119 references it cites were found in a registry or an index, and 4 are not checked yet.

A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection

Buczak, Anna L., Guven, Erhan·2016·IEEE Communications Surveys & Tutorials

DOI 10.1109/comst.2015.2494502

Open this paper in CoChat — free account

Abstract

This survey paper describes a focused literature survey of machine learning (ML) and data mining (DM) methods for cyber analytics in support of intrusion detection. Short tutorial descriptions of each ML/DM method are provided. Based on the number of citations or the relevance of an emerging method, papers representing each method were identified, read, and summarized. Because data are so important in ML/DM approaches, some well-known cyber data sets used in ML/DM are described. The complexity of ML/DM algorithms is addressed, discussion of challenges for using ML/DM for cyber security is presented, and some recommendations on when to use a given method are provided.

Integrity signals

Registry

Crossref · 10.1109/comst.2015.2494502

Cites

114 of 118 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Random Forests
Breiman, L. (2001) · Machine Learning · doi:10.1023/a:1010933404324 · Cited by 133,538
Fuzzy sets
Zadeh, L. A. (1965) · Information and Control · doi:10.1016/s0019-9958(65)90241-x · Cited by 67,855
Particle swarm optimization
Kennedy, J., & Eberhart, R. (2002) · Proceedings of ICNN'95 - International Conference on Neural Networks · doi:10.1109/icnn.1995.488968 · Cited by 58,192
Maximum Likelihood from Incomplete Data Via the EM Algorithm
Dempster, A. P., Laird, N. M., & Rubin, D. B. (1977) · Journal of the Royal Statistical Society Series B: Statistical Methodology · doi:10.1111/j.2517-6161.1977.tb01600.x · Cited by 50,444
Fuzzy sets
Zadeh, L. A. (1996) · Cited by 46,960
The Nature of Statistical Learning Theory
Vapnik, V. (2000) · Statistics for Engineering and Information Science · doi:10.1007/978-1-4757-3264-1 · Cited by 46,387
Collective dynamics of ‘small-world’ networks
Watts, D. J., & Strogatz, S. H. (1998) · Nature · doi:10.1038/30918 · Cited by 43,060
The Nature of Statistical Learning Theory
Vapnik, V. N. (1995) · doi:10.1007/978-1-4757-2440-0 · Cited by 39,138
Data Mining: Practical Machine Learning Tools and Techniques
Witten, I. H., Frank, E., & Hall, M. A. (2011) · Elsevier eBooks · doi:10.1016/c2009-0-19715-5 · Cited by 25,543
Untitled work
(1992) · Cited by 23,431

Flagged first, then by citations

Show all 119 references

1 of the 119 references couldn’t be matched to a known paper.

Research works printed but not linked: 14

Shearer, 2000, The CRISP-DM model: The new blueprint for data mining, J. Data Warehouse., 5, 13
2000, R Core Team
Jacobson, 1989, The Tcpdump Manual Page
Combs, 2014, Wireshark
2014, Sourcefire
Stolfo, 2014, KDD Cup 1999 Data Set
2015, IBM
10.4108/wkdd.2008.2686 · DOI
2014, Politecnico di Torino, Analyzer 3.0
Baralis, 2008, Generalized Itemset Discovery by Means of Opportunistic Aggregation
Markov, 1971, Extension of the limit theorems of probability theory to a sum of variables connected in a chain, Dynamic Probabilistic Systems, 1
10.2307/2984875 · DOI
Brauckhoff, 2008, Flame: A low-level anomaly modeling engine
Paxson, 2004, Bro 0.9

Sorted by citations

Items 601–700 of 1,004

Spectrum of advancements and developments in multidisciplinary domains for generative adversarial networks (GANs)
Rizvi, S. K. J., Azad, M. A., & Fraz, M. M. (2021) · Archives of Computational Methods in Engineering · doi:10.1007/s11831-021-09543-4 · Cited by 37
D-Fence: A Flexible, Efficient, and Comprehensive Phishing Email Detection System
Lee, J.-H., Tang, F., Ye, P., Abbasi, F. H., Hay, P., & Divakaran, D. M. (2021) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp51992.2021.00045 · Cited by 43
Zero-Trust Marine Cyberdefense for IoT-Based Communications: An Explainable Approach
Nkoro, E. C., Njoku, J. N., Nwakanma, C. I., Lee, J., & Kim, D. (2024) · Electronics · doi:10.3390/electronics13020276 · Cited by 50
“The decision not to leverage SMOTE in the proposed ZTA marine framework is justified by existing NIDS literature in [50,51] and the acknowledgment of the intrinsic imbalances within network traffic data, inherently reflective of authentic network dynamics, which fosters a trustworthy and adaptable…”
Using Multilayer Perceptron Neural Network to Assess the Critical Factors of Traffic Accidents
Ruangkanjanases, A., Sivarak, O., Weng, Z.-J., Khan, A., & Chen, S. (2024) · HighTech and Innovation Journal · doi:10.28991/hij-2024-05-01-012 · Cited by 37
LAN: Learning Adaptive Neighbors for Real-Time Insider Threat Detection
Cai, X., Wang, Y., Xu, S., Li, H., Zhang, Y., Liu, Z., & Yuan, X. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3488527 · Cited by 46
Adaptive evolutionary multitask optimization based on anomaly detection transfer of multiple similar sources
Song, Y., & Song, C. (2025) · Expert Systems with Applications · doi:10.1016/j.eswa.2025.127599 · Cited by 37
Systematic Review: Malware Detection and Classification in Cybersecurity
Berríos, S., Leiva, D., Olivares, B., Allende‐Cid, H., & Hermosilla, P. (2025) · Applied Sciences · doi:10.3390/app15147747 · Cited by 54
On efficiency enhancement of the correlation-based feature selection for intrusion detection systems
Shahbaz, M. B., Wang, X., Behnad, A., & Samarabandu, J. K. (2016) · IEEE Annual Information Technology, Electronics and Mobile Communication Conference (IEMCON) · doi:10.1109/iemcon.2016.7746286 · Cited by 38
Contextual information fusion for intrusion detection: a survey and taxonomy
AlEroud, A. F., & Karabatis, G. (2017) · Knowledge and Information Systems · doi:10.1007/s10115-017-1027-3 · Cited by 40
On the performance of a deep learning-based anomaly detection system for 5G networks
Maimó, L. F., Clemente, F. J. G., Pérez, M. G., & Pérez, G. M. (2017) · IEEE SmartWorld, Ubiquitous Intelligence & Computing, Advanced & Trusted Computing, Scalable Computing & Communications, Cloud & Big Data Computing, Internet of People and Smart City Innovation (SmartWorld/SCALCOM/UIC/ATC/CBDCom/IOP/SCI) · doi:10.1109/uic-atc.2017.8397440 · Cited by 37
Current Applications of Machine Learning Techniques in CRM: A Literature Review and Practical Implications
Chagas, B. N. R., Viana, J. A. N., Reinhold, O., Lobato, F. M. F., Jacob, A. F. L., & Alt, R. (2018) · IEEE/WIC/ACM International Conference on Web Intelligence · doi:10.1109/wi.2018.00-53 · Cited by 39
“[9], [10], [11], [12], [13]”
BackgroundMethod
Survey on security and privacy issues in cyber physical systems
Nazarenko, A. A., & Safdar, G. A. (2019) · AIMS Electronics and Electrical Engineering · doi:10.3934/electreng.2019.2.111 · Cited by 37
Using Conceptual Modeling to Support Machine Learning
Lukyanenko, R., Castellanos, A., Parsons, J., Tremblay, M. C., & Storey, V. C. (2019) · Lecture notes in business information processing · doi:10.1007/978-3-030-21297-1_15 · Cited by 37
A Survey on Representation Learning Efforts in Cybersecurity Domain
Usman, M., Jan, M. A., He, X., & Chen, J. (2019) · ACM Computing Surveys · doi:10.1145/3331174 · Cited by 37
“Many survey papers on machine learning algorithms can be found in the literature [2, 13, 89].”
Background
Enhancing network intrusion detection classifiers using supervised adversarial training
Yin, C., Zhu, Y., Liu, S., Fei, J., & Zhang, H. (2019) · The Journal of Supercomputing · doi:10.1007/s11227-019-03092-1 · Cited by 36
“…learning methods, including support vector machine (SVM) [3, 4], artificial neural network (ANN) [5, 6], K-nearest neighbors (KNN) [7, 8], random forest (RF) [9] and others [10, 11], have been implemented as classifiers to improve the performance of intrusion detection and have made good progress.”
Method
PcapGAN: Packet Capture File Generator by Style-Based Generative Adversarial Networks
Baik, D., Jung, Y., & Choi, C.-H. (2019) · IEEE International Conference on Machine Learning and Applications (ICMLA) · doi:10.1109/icmla.2019.00191 · Cited by 37
Unknown Security Attack Detection Using Shallow and Deep ANN Classifiers
Al‐Zewairi, M., Almajali, S., & Ayyash, M. (2020) · Electronics · doi:10.3390/electronics9122006 · Cited by 39
“The effectiveness of an IDS is measured by several metrics and is often dependent on whether a supervised or an unsupervised model is used, as well as whether a binary classification model or a multi-classification model is used [8].”
TL-NID: Deep Neural Network with Transfer Learning for Network Intrusion Detection
Masum, M., & Shahriar, H. (2020) · International Conference for Internet Technology and Secured Transactions · doi:10.23919/icitst51030.2020.9351317 · Cited by 37
Grey Wolf Optimization Parameter Control for Feature Selection in Anomaly Detection
Almazini, H. F., & Ku‐Mahamud, K. R. (2021) · International journal of intelligent engineering and systems · doi:10.22266/ijies2021.0430.43 · Cited by 37
A Model for Anomalies Detection in Internet of Things (IoT) Using Inverse Weight Clustering and Decision Tree.
Alghuried, A. (2017) · Arrow@dit (Dublin Institute of Technology) · doi:10.21427/d7wk7s · Cited by 37
Advanced-Level Security in Network and Real-Time Applications Using Machine Learning Approaches
Rath, M., & Mishra, S. (2019) · Advances in computational intelligence and robotics book series · doi:10.4018/978-1-5225-8100-0.ch003 · Cited by 36
Soft computing for anomaly detection and prediction to mitigate IoT-based real-time abuse
Bhatia, M. P. S., & Sangwan, S. R. (2021) · Personal and Ubiquitous Computing · doi:10.1007/s00779-021-01567-8 · Cited by 36
Metamorphic Malware and Obfuscation: A Survey of Techniques, Variants, and Generation Kits
Brezinski, K., & Ferens, K. (2023) · Security and Communication Networks · doi:10.1155/2023/8227751 · Cited by 45
“A thorough examination of the state of data mining approaches as it pertains to cyber security are covered in [357].”
Background
A federated learning approach to network intrusion detection using residual networks in industrial IoT networks
Chaurasia, N., Ram, M., Verma, P., Mehta, N., & Bharot, N. (2024) · The Journal of Supercomputing · doi:10.1007/s11227-024-06153-2 · Cited by 36
ScaleNet: Scalable and Hybrid Framework for Cyber Threat Situational Awareness Based on DNS, URL, and Email Data Analysis
Vinayakumar, R., Soman, K. P., Poornachandran, P., Mohan, V. S., & Kumar, A. D. (2018) · Journal of Cyber Security and Mobility · doi:10.13052/jcsm2245-1439.823 · Cited by 50
Performance Analysis of Machine Learning Classifiers for Intrusion Detection
Zwane, S. G., Tarwireyi, P., & Adigun, M. O. (2018) · International Conference on Intelligent and Innovative Computing Applications · doi:10.1109/iconic.2018.8601203 · Cited by 36
“Recent approaches in intrusion detection have applied machine learning to improve detection rate [7] [8] [9].”
Background
Performance Improvement of Decision Trees for Diagnosis of Coronary Artery Disease Using Multi Filtering Approach
Abdar, M., Nasarian, E., Zhou, X., et al. (2019) · IEEE International Conference on Computer and Communication Systems (ICCCS) · doi:10.1109/ccoms.2019.8821633 · Cited by 36
“Each of these categories includes different algorithms which were applied on different subjects such as diseases and cancers [4, 5, 6, 7, 8, 9], security and networks [10, 11], transportation [12, 13], economics [14], energy [15,16,17], etc.”
Background
Improved Network Traffic Classification Using Ensemble Learning
Possebon, I. P., Silva, A. S., Granville, L. Z., Schaeffer-Filho, A. E., & Marnerides, A. K. (2019) · IEEE Symposium on Computers and Communications (ISCC) · doi:10.1109/iscc47284.2019.8969637 · Cited by 37
DEMISe
Parker, L. R., Yoo, P. D., Asyhari, A. T., et al. (2019) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3339252.3340497 · Cited by 36
Use of Machine Learning algorithms for designing efficient cyber security solutions
Soni, S., & Bhushan, B. (2019) · International Conference on Intelligent Computing, Instrumentation and Control Technologies (ICICICT) · doi:10.1109/icicict46008.2019.8993253 · Cited by 36
Predictive Cyber Situational Awareness and Personalized Blacklisting
Husák, M., Bajtoš, T., Kašpar, J., et al. (2020) · ACM Transactions on Management Information Systems · doi:10.1145/3386250 · Cited by 36
“In recent years, the cybersecurity field started to adopt data mining for its ability to extract concealed and indistinct patterns in the data for various requirements, including alert correlation [3].”
Background
Network Intrusion Detection Using Wrapper-based Decision Tree for Feature Selection
Umar, M. A., Chen, Z., & Liu, Y. (2020) · International Conference on Internet Computing for Science and Engineering · doi:10.1145/3424311.3424330 · Cited by 36
“ajor downside is the expensive computational time required during feature selection and training, however, giving that IDSs are kind of systems that can be trained offline and deployed online for use [40], [41], this should not be a major point of concern since our method is capable of detecting malicious network atta…”
Background
When Machine Learning meets Security Issues: A survey
Guan, Z., Bian, L., Shang, T., & Liu, J. (2018) · IEEE International Conference on Intelligence and Safety for Robotics (ISR) · doi:10.1109/iisr.2018.8535799 · Cited by 37
DeepTLF: robust deep neural networks for heterogeneous tabular data
Borisov, V., Broelemann, K., Kasneci, E., & Kasneci, G. (2022) · International Journal of Data Science and Analytics · doi:10.1007/s41060-022-00350-z · Cited by 40
“Tabular data is the most commonly used form of data, and it is ubiquitous in various applications [1], such as medical diagnosis based on patient history [2], predictive analytics for financial applications [3], cybersecurity [4].”
Method
Challenges in internet of things towards the security using deep learning techniques
Ravikumar, K. C., Chiranjeevi, P., Devarajan, N. M., Kaur, C., & Taloba, A. I. (2022) · Measurement Sensors · doi:10.1016/j.measen.2022.100473 · Cited by 35
Self-Supervised Learning Malware Traffic Classification Based on Masked Autoencoder
Xu, K., Zhang, X., Wang, Y., Ohtsuki, T. O., Adebisi, B., Sari, H., & Gui, G. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3357072 · Cited by 38
Machine learning and deep learning for user authentication and authorization in cybersecurity: A state-of-the-art review
Pritee, Z. T., Anik, M. H., Alam, S. B., Jim, J. R., Kabir, M. M., & Mridha, M. F. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103747 · Cited by 41
A Survey on the Applications of Semi-supervised Learning to Cyber-security
Mvula, P. K., Branco, P., Jourdan, G.-V., & Viktor, H. L. (2024) · ACM Computing Surveys · doi:10.1145/3657647 · Cited by 42
A Two-Level Ensemble Learning Framework for Enhancing Network Intrusion Detection Systems
Arreche, O., Bibers, I., & Abdallah, M. (2024) · IEEE Access · doi:10.1109/access.2024.3407029 · Cited by 35
Industrial Internet of Things Intrusion Detection System Based on Graph Neural Network
Yang, S., Pan, W., Li, M., Yin, M., Ren, H., Chang, Y., Liu, Y., Zhang, S., & Lou, F. (2025) · Symmetry · doi:10.3390/sym17070997 · Cited by 36
Cyber Security: Threat Detection Model based on Machine learning Algorithm
Dalal, K. R., & Rele, M. (2018) · International Conference on Communication and Electronics Systems (ICCES) · doi:10.1109/cesys.2018.8724096 · Cited by 35
A Deep Learning Approach for Detecting Security Attacks on Blockchain.
Scicchitano, F., Liguori, A., Guarascio, M., Ritacco, E., & Manco, G. (2020) · Cited by 35
Intrusion Detection with Segmented Federated Learning for Large-Scale Multiple LANs
Sun, Y., Ochiai, H., & Esaki, H. (2020) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn48605.2020.9207094 · Cited by 35
MalPhase: Fine-Grained Malware Detection Using Network Flow Data
Piskozub, M., Gaspari, F. D., Barr-Smith, F., et al. (2021) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3433210.3453101 · Cited by 35
An Analysis of IoT Cyber Security Driven by Machine Learning
Strecker, S., Haaften, W. V., & Dave, R. (2021) · Algorithms for intelligent systems · doi:10.1007/978-981-16-3246-4_55 · Cited by 35
Artificial Intelligence Algorithms for Detecting and Classifying MQTT Protocol Internet of Things Attacks
Alzahrani, A., & Aldhyani, T. H. H. (2022) · Electronics · doi:10.3390/electronics11223837 · Cited by 35
Reinforcement Learning-Based Adaptive Feature Boosting for Smart Grid Intrusion Detection
Hu, C., Yan, J., & Liu, X. (2022) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2022.3230730 · Cited by 39
A Fully Streaming Big Data Framework for Cyber Security Based on Optimized Deep Learning Algorithm
Hussen, N., Elghamrawy, S. M., Salem, M. M., & El-Desouky, A. I. (2023) · IEEE Access · doi:10.1109/access.2023.3281893 · Cited by 34
A Survey on Enterprise Network Security: Asset Behavioral Monitoring and Distributed Attack Detection
Lyu, M., Gharakheili, H. H., & Sivaraman, V. (2024) · IEEE Access · doi:10.1109/access.2024.3419068 · Cited by 34
A Federated Learning Framework for Enhanced Data Security and Cyber Intrusion Detection in Distributed Network of Underwater Drones
Popli, M. S., Singh, R. P., Popli, N. K., & Mamun, M. (2025) · IEEE Access · doi:10.1109/access.2025.3530499 · Cited by 36
A deep learning/machine learning approach for anomaly based network intrusion detection
Al-Muhanna, R., & Dardouri, S. (2025) · Frontiers in Artificial Intelligence · doi:10.3389/frai.2025.1625891 · Cited by 34
Implementation of Machine Learning and Data Mining to Improve Cybersecurity and Limit Vulnerabilities to Cyber Attacks
Alloghani, M. A., Al‐Jumeily, D., Hussain, A. J., Mustafina, J., Baker, T., & Aljaaf, A. J. (2019) · Studies in computational intelligence · doi:10.1007/978-3-030-28553-1_3 · Cited by 34
Insider Threat Detection Using Supervised Machine Learning Algorithms on an Extremely Imbalanced Dataset
Moradpoor, N., & Hall, A. J. (2020) · International Journal of Cyber Warfare and Terrorism · doi:10.4018/ijcwt.2020040101 · Cited by 36
SMOTE: Class Imbalance Problem In Intrusion Detection System
ALFRHAN, A. A., AlHusain, R., & Khan, R. U. (2020) · International Conference on Computing and Information Technology (ICCIT) · doi:10.1109/iccit-144147971.2020.9213728 · Cited by 34
Preventing crimes against public health with artificial intelligence and machine learning capabilities
Wang, H., & Ma, S. (2021) · Socio-Economic Planning Sciences · doi:10.1016/j.seps.2021.101043 · Cited by 40
On the Robustness of Domain Constraints
Sheatsley, R., Hoak, B., Pauley, E., Beugin, Y., Weisman, M. J., & McDaniel, P. D. (2021) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3460120.3484570 · Cited by 43
Research and Challenges of Reinforcement Learning in Cyber Defense Decision-Making for Intranet Security
Wang, W., Sun, D., Jiang, F. X., Chen, X., & Zhu, C. (2022) · Algorithms · doi:10.3390/a15040134 · Cited by 37
Intrusion Detection in Internet of Things With MQTT Protocol—An Accurate and Interpretable Genetic-Fuzzy Rule-Based Solution
Gorzałczany, M. B., & Rudziński, F. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3194837 · Cited by 34
Artificial Intelligence and Human Psychology in Online Transaction Fraud
Firdaus, R., Xue, Y., Gang, L., et al. (2022) · Frontiers in Psychology · doi:10.3389/fpsyg.2022.947234 · Cited by 34
“Protection of these computer system networks has careened into a danger zone during the last decade (Buczak and Guven, 2016; Greengard, 2016); each of the computer network security systems should have, at a minimum, an intrusion detection system (IDS), antivirus software, and firewalls.”
Background
Meta-survey on outlier and anomaly detection
Olteanu, M., Fabrice Rossi, A., & Yger, F. (2023) · Neurocomputing · doi:10.1016/j.neucom.2023.126634 · Cited by 44
“For instance in intrusion detection [49, 64, 69, 12], the normal behavior model is not interesting per se and serves only as a detector of intrusions.”
Toward Improved Machine Learning-Based Intrusion Detection for Internet of Things Traffic
Alkadi, S., Al-Ahmadi, S. A., & Ismail, M. M. B. (2023) · Computers · doi:10.3390/computers12080148 · Cited by 36
“A terabyte of data is labeled in a manual manner by a knowledge expert within the IDS ﬁeld, meaning only a limited number of datasets are available for benchmarking [35].”
Method
An Intrusion Detection Model using election-Based Feature Selection and K-NN
Mohy-eddine, M., Guezzaz, A., Benkirane, S., et al. (2023) · Microprocessors and Microsystems · doi:10.1016/j.micpro.2023.104966 · Cited by 33
Cybersecurity vulnerability and resilience of cooperative driving automation for energy efficiency and flow stability in smart cities
Khattak, Z. H. (2024) · Sustainable Cities and Society · doi:10.1016/j.scs.2024.105368 · Cited by 33
ARCS: Adaptive Reinforcement Learning Framework for Automated Cybersecurity Incident Response Strategy Optimization
Ren, S., Jin, J., Niu, G., et al. (2025) · Applied Sciences · doi:10.3390/app15020951 · Cited by 33
EnClass: Ensemble-Based Classification Model for Network Anomaly Detection in Massive Datasets
Garg, S., Singh, A., Batra, S., et al. (2017) · Globecom · doi:10.1109/glocom.2017.8255025 · Cited by 33
“still the importance of network based techniques for large scale datsets has not been explored to its full potential [4].”
Background
Risk-Based Scheduling of Security Tasks in Industrial Control Systems With Consideration of Safety
Zhou, C., Li, X., Yang, S., & Tian, Y. (2019) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2019.2903224 · Cited by 33
How Deep Learning Is Making Information Security More Intelligent
Singla, A., & Bertino, E. (2019) · IEEE Security & Privacy · doi:10.1109/msec.2019.2902347 · Cited by 33
FREDPC: A Feasible Residual Error-Based Density Peak Clustering Algorithm With the Fragment Merging Strategy
Parmar, M. D., Pang, W., Hao, D., Jiang, J., Wang, L., Wang, L., & Zhou, Y. (2019) · IEEE Access · doi:10.1109/access.2019.2926579 · Cited by 33
A Hybrid Nested Genetic-Fuzzy Algorithm Framework for Intrusion Detection and Attacks
Elhefnawy, R., Abounaser, H., & Badr, A. A. (2020) · IEEE Access · doi:10.1109/access.2020.2996226 · Cited by 33
Not Afraid of the Unseen: a Siamese Network based Scheme for Unknown Traffic Discovery
Chen, Y., Li, Z., Shi, J., Gou, G., Liu, C., & Xiong, G. (2020) · IEEE Symposium on Computers and Communications (ISCC) · doi:10.1109/iscc50000.2020.9219734 · Cited by 33
Cryptojacking Detection with CPU Usage Metrics
Gomes, F., & Correia, M. P. (2020) · IEEE International Symposium on Network Computing and Applications (NCA) · doi:10.1109/nca51143.2020.9306696 · Cited by 33
Evaluation of Machine Learning Algorithms Used on Attacks Detection in Industrial Control Systems
Arora, P., Kaur, B., & Teixeira, M. A. (2021) · Journal of The Institution of Engineers (India) Series B · doi:10.1007/s40031-021-00563-z · Cited by 34
A Code Centric Evaluation of C/C++ Vulnerability Datasets for Deep Learning Based Vulnerability Detection Techniques
Jain, R., Gervasoni, N., Ndhlovu, M., & Rawat, S. (2023) · Innovations in Software Engineering Conference (ISEC) · doi:10.1145/3578527.3578530 · Cited by 33
A heuristics approach to mine behavioural data logs in mobile malware detection system
Nguyen, G., Nguyen, B. M., Tran, D., & Hluchý, L. (2018) · Data & Knowledge Engineering · doi:10.1016/j.datak.2018.03.002 · Cited by 33
Review on Intrusion Detection System (IDS) for Network Security using Machine Learning Algorithms
Nusrath Unnisa, A., Yerva, M., & Kurian, M. Z. (2022) · International Research Journal on Advanced Science Hub · doi:10.47392/irjash.2022.014 · Cited by 32
Benchmarking the Benchmark - Comparing Synthetic and Real-World Network Ids Datasets
Layeghy, S., Gallagher, M. R., & Portmann, M. (2022) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2023.103689 · Cited by 32
The role of artificial intelligence in nuclear crisis decision making: a complement, not a substitute
Holmes, M., & Wheeler, N. J. (2024) · Australian Journal Of International Affairs · doi:10.1080/10357718.2024.2333814 · Cited by 32
A Secure High-Order Lanczos-Based Orthogonal Tensor SVD for Big Data Reduction in Cloud Environment
Feng, J., Yang, L. T., Dai, G., Wang, W., & Zou, D. (2018) · IEEE Transactions on Big Data · doi:10.1109/tbdata.2018.2803841 · Cited by 32
Adaptive security-related data collection with context awareness
Lin, H., Yan, Z., & Fu, Y. (2018) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2018.11.002 · Cited by 32
Improving the effectiveness of intrusion detection systems for hierarchical data
Yahalom, R., Steren, A., Nameri, Y., Roytman, M., Porgador, A., & Elovici, Y. (2019) · Knowledge-Based Systems · doi:10.1016/j.knosys.2019.01.002 · Cited by 33
MalRank
Najafi, P., Mühle, A., Pünter, W., Cheng, F., & Meinel, C. (2019) · Annual Computer Security Applications Conference · doi:10.1145/3359789.3359791 · Cited by 32
“There are numerous works introduced over the last decade that explore these dark data stored within SIEMs to derive security value, thus introducing concepts such as big data analytics, machine learning, data mining and pattern matching into cybersecurity [9].”
Background
AppCon: Mitigating Evasion Attacks to ML Cyber Detectors
Apruzzese, G., Andreolini, M., Marchetti, M., Colacino, V. G., & Russo, G. (2020) · Symmetry · doi:10.3390/sym12040653 · Cited by 32
“Security operators often adopt machine learning techniques [3,32], which allow for detecting anomalies and may even reveal novel attacks that are not easily recognizable through traditional signature-based approaches [33,34], thus increasing protection against advanced threats.”
BackgroundMethodInfluential
HSTF-Model: An HTTP-based Trojan detection model via the Hierarchical Spatio-temporal Features of Traffics
Xie, J., Li, S., Yun, X., Zhang, Y., & Chang, P. (2020) · Computers & Security · doi:10.1016/j.cose.2020.101923 · Cited by 32
“There are many anomaly detection methods that use traditional machine learning meth-ods to detect malicious traffic[28] anomaly detection.”
Method
Securing Additive Manufacturing with Blockchains and Distributed Physically Unclonable Functions
Cambou, B., Gowanlock, M., Heynssens, J. B., Jain, S., Philabaum, C. R., Booher, D., Burke, I., Garrard, J., Telesca, D. A., & Njilla, L. (2020) · Cryptography · doi:10.3390/cryptography4020017 · Cited by 32
AI and machine learning: A mixed blessing for cybersecurity
Kamoun, F., Iqbal, F., Esseghir, M. A., & Baker, T. (2020) · International Symposium on Networks, Computers and Communications (ISNCC) · doi:10.1109/isncc49221.2020.9297323 · Cited by 32
Data-Sharing Markets: Model, Protocol, and Algorithms to Incentivize the Formation of Data-Sharing Consortia
Fernandez, R. C. (2023) · Proceedings of the ACM on Management of Data · doi:10.1145/3589317 · Cited by 31
Outliers detection methods in wireless sensor networks
Gil, P. S., Martins, H., & Januário, F. (2018) · Artificial Intelligence Review · doi:10.1007/s10462-018-9618-2 · Cited by 31
“A significant amount of work has been undertaken in the context of anomaly detection, as documented on a number of surveys [see e.g. (Gupta et al. 2014; Ahmed et al. 2016; Buczak and Guven 2016)].”
Background
Impact of Machine Learning in Various Network Security Applications
Banerjee, J., Maiti, S., Chakraborty, S., et al. (2019) · International Conference on Computing Methodologies and Communication (ICCMC) · doi:10.1109/iccmc.2019.8819811 · Cited by 31
“• If signature capture of the attack is necessary, then evolutionary computation, decision trees, and association rules are a good fit [3].”
Background
IPv6 Covert Channels in the Wild
Mazurczyk, W., Powójski, K., & Caviglione, L. (2019) · doi:10.1145/3360664.3360674 · Cited by 31
“Lastly, advancements in the development of tools for network security and intrusion detection systems could partially void the original vision [4], as IPv6 covert channels were initially introduced in 2006 [11].”
Background
Web Application Security: An Investigation on Static Analysis with other Algorithms to Detect Cross Site Scripting
Marashdih, A. W., Zaaba, Z. F., Suwais, K. M., et al. (2019) · Procedia Computer Science · doi:10.1016/j.procs.2019.11.230 · Cited by 31
TRUST‐based features for detecting the intruders in the Internet of Things network using deep learning
Bhor, H. N., & Kalla, M. (2021) · Computational Intelligence · doi:10.1111/coin.12473 · Cited by 31
“Difff (i, j) = √∑ q∈CIS(i,j) (Sat e f (i, q) − Sat e f (j, q))2 |CIS(i, j)| , (8)”
Cyber Security Politics
Cavelty, M. D., & Wenger, A. (2022) · Routledge eBooks · doi:10.4324/9781003110224 · Cited by 35
Investigation on Intrusion Detection Systems (IDSs) in IoT
(2022) · International Journal of Emerging Trends in Engineering Research · doi:10.30534/ijeter/2022/041032022 · Cited by 35
Cyberattacks on connected automated vehicles: A traffic impact analysis
Sun, Z., Liu, R., Hu, H., et al. (2022) · IET Intelligent Transport Systems · doi:10.1049/itr2.12259 · Cited by 31
Privacy leakage of LoRaWAN smart parking occupancy sensors
Rodić, L. D., Perković, T., Škiljo, M., & Šolić, P. (2022) · Future Generation Computer Systems · doi:10.1016/j.future.2022.08.007 · Cited by 32
Dendritic Cell Algorithm with Optimised Parameters Using Genetic Algorithm
Elisa, N., Yang, L., & Naik, N. (2018) · IEEE Congress on Evolutionary Computation (CEC) · doi:10.1109/cec.2018.8477932 · Cited by 31
Double layer detection of internal threat in enterprise systems based on deep learning
He, D., Lv, X., Xu, X., Chan, S., & Choo, K.-K. R. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3372771 · Cited by 31
Behavior-Based Anomaly Detection in Log Data of Physical Access Control Systems
Skopik, F., Wurzenberger, M., Höld, G., Landauer, M., & Kuhn, W. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3197265 · Cited by 36
A Systematic Review of Cyber Threat Intelligence: The Effectiveness of Technologies, Strategies, and Collaborations in Combating Modern Threats
Santos, P., Abreu, R., Reis, M. J. C. S., Serôdio, C., & Branco, F. (2025) · Sensors · doi:10.3390/s25144272 · Cited by 51
“Algorithms such as Support Vector Machines (SVMs) and convolutional neural networks (CNNs) can identify patterns and anomalies indicative of suspicious activity with significantly higher accuracy than traditional signature-based methods [1].”
Detection of phishing websites using a novel twofold ensemble model
Nagaraj, K., Bhattacharjee, B., Sridhar, A., & Sharvani, G. S. (2018) · Journal of Systems and Information Technology · doi:10.1108/jsit-09-2017-0074 · Cited by 32

Authors: Buczak, A. L., & Guven, E.
Affiliations: Johns Hopkins University (US)
ORCID: Buczak, Anna L.
Venue: IEEE Communications Surveys & Tutorials
Publisher: Institute of Electrical and Electronics Engineers (IEEE)
Published: 2016
Volume: 18
Issue: 2
Pages: 1153-1176
ISSN: 1553-877X (ISSN-L)
2373-745X
DOI: 10.1109/comst.2015.2494502
OpenAlex: W2342408547
Semantic Scholar: 971766088dfaf63fb55e6f0190b14f28f2c98ad0
Cited by: 3,332
References: 119
Citations by year: 2026: 460 · 2025: 395 · 2024: 297 · 2023: 319 · 2022: 403 · 2021: 447 · 2020: 394 · 2019: 314 · 2018: 217 · 2017: 73 · 2016: 11
FWCI: 115.39
Type: journal article
Language: en
Open access: closed
Licence: ieeexplore.ieee.org/Xplorehelp/downloads/license-information/OAPA.html (vor)
Locations: IEEE Communications Surveys & Tutorials (publishedVersion)
Funders: Department of Homeland Security Network Security Deployment Division (HSSA01-13-C-2709)
Topics: Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
Physical Sciences › Computer Science › Artificial Intelligence › Artificial Immune Systems Applications
Keywords: intrusion detection, cybersecurity, machine learning, data mining, algorithmic complexity

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection

Abstract

Overview

Integrity signals

Verification

Claims the paper makes

Claims other papers make about this one

Citations

Cites

Cited by

Related

Metadata

Record

About these checks