The DOI matches its Crossref record; 114 of the 119 references it cites were found in a registry or an index, and 4 are not checked yet.
A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection
Abstract
This survey paper describes a focused literature survey of machine learning (ML) and data mining (DM) methods for cyber analytics in support of intrusion detection. Short tutorial descriptions of each ML/DM method are provided. Based on the number of citations or the relevance of an emerging method, papers representing each method were identified, read, and summarized. Because data are so important in ML/DM approaches, some well-known cyber data sets used in ML/DM are described. The complexity of ML/DM algorithms is addressed, discussion of challenges for using ML/DM for cyber security is presented, and some recommendations on when to use a given method are provided.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“The C4.5 algorithm [200], the ID3 algorithm [199], and the CART algorithm [55] are among the well-known decision tree algorithms used for intrusion detection.”
From Comparative Analysis of Intrusion Detection Systems and Machine Learning Based Model Analysis through Decision Tree (2023) · cites this paper as [55]
In the citing paper
“Though there are various surveys on ML in networking [18,61,82,142,246,339], this survey is purposefully different.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [82]
In the citing paper
“Whereas, Fadlullah et al. [142] and Buczak et al. [82], both state-of-theart surveys, have a specialized treatment of ML to specific problems in networking.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [82]
Citations
Cites
Breiman, L. (2001) · Machine Learning · doi:10.1023/a:1010933404324 · Cited by 133,538
Zadeh, L. A. (1965) · Information and Control · doi:10.1016/s0019-9958(65)90241-x · Cited by 67,855
Kennedy, J., & Eberhart, R. (2002) · Proceedings of ICNN'95 - International Conference on Neural Networks · doi:10.1109/icnn.1995.488968 · Cited by 58,192
Maximum Likelihood from Incomplete Data Via the EM Algorithm
Dempster, A. P., Laird, N. M., & Rubin, D. B. (1977) · Journal of the Royal Statistical Society Series B: Statistical Methodology · doi:10.1111/j.2517-6161.1977.tb01600.x · Cited by 50,444
Zadeh, L. A. (1996) · Cited by 46,960
The Nature of Statistical Learning Theory
Vapnik, V. (2000) · Statistics for Engineering and Information Science · doi:10.1007/978-1-4757-3264-1 · Cited by 46,387
Collective dynamics of ‘small-world’ networks
Watts, D. J., & Strogatz, S. H. (1998) · Nature · doi:10.1038/30918 · Cited by 43,060
The Nature of Statistical Learning Theory
Vapnik, V. N. (1995) · doi:10.1007/978-1-4757-2440-0 · Cited by 39,138
Data Mining: Practical Machine Learning Tools and Techniques
Witten, I. H., Frank, E., & Hall, M. A. (2011) · Elsevier eBooks · doi:10.1016/c2009-0-19715-5 · Cited by 25,543
(1992) · Cited by 23,431
Flagged first, then by citations
1 of the 119 references couldn’t be matched to a known paper.
Research works printed but not linked: 14
- Shearer, 2000, The CRISP-DM model: The new blueprint for data mining, J. Data Warehouse., 5, 13
- 2000, R Core Team
- Jacobson, 1989, The Tcpdump Manual Page
- Combs, 2014, Wireshark
- 2014, Sourcefire
- Stolfo, 2014, KDD Cup 1999 Data Set
- 2015, IBM
- 10.4108/wkdd.2008.2686 · DOI
- 2014, Politecnico di Torino, Analyzer 3.0
- Baralis, 2008, Generalized Itemset Discovery by Means of Opportunistic Aggregation
- Markov, 1971, Extension of the limit theorems of probability theory to a sum of variables connected in a chain, Dynamic Probabilistic Systems, 1
- 10.2307/2984875 · DOI
- Brauckhoff, 2008, Flame: A low-level anomaly modeling engine
- Paxson, 2004, Bro 0.9
Cited by
Sorted by citations
A Deep Learning Approach for Intrusion Detection Using Recurrent Neural Networks
Yin, C., Zhu, Y., Fei, J., & He, X. (2017) · IEEE Access · doi:10.1109/access.2017.2762418 · Cited by 2,100
Survey of intrusion detection systems: Techniques, datasets and challenges
Khraisat, A., Gondal, I., Vamplew, P., & Kamruzzaman, J. (2019) · Cybersecurity · doi:10.1186/s42400-019-0038-7 · Cited by 2,024
“AIDS methods can be categorized into three main groups: Statistics-based (Chao et al., 2015), knowledge-based (Elhag et al., 2015; Can & Sahingoz, 2015), and machine learning-based (Buczak & Guven, 2016; Mesh-ram & Haas, 2017).”
Deep Learning in Mobile and Wireless Networking: A Survey
Zhang, C., Patras, P., & Haddadi, H. (2019) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2019.2904897 · Cited by 1,913
A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security
Al-Garadi, M. A., Mohamed, A., Al-Ali, A. K., Du, X., Ali, I., & Guizani, M. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.2988293 · Cited by 1,392
Ahmad, Z., Khan, A. S., Shiang, C. W., Abdullah, J., & Ahmad, F. (2020) · Transactions on Emerging Telecommunications Technologies · doi:10.1002/ett.4150 · Cited by 1,514
Metadata
- Authors
- Buczak, A. L., & Guven, E.
- Affiliations
- Johns Hopkins University (US)
- ORCID
- Buczak, Anna L.
- Venue
- IEEE Communications Surveys & Tutorials
- Published
- 2016
- Volume
- 18
- Issue
- 2
- Pages
- 1153-1176
- ISSN
- 1553-877X (ISSN-L)
- 2373-745X
- OpenAlex
- W2342408547
- Semantic Scholar
- 971766088dfaf63fb55e6f0190b14f28f2c98ad0
- Cited by
- 3,332
- References
- 119
- Citations by year
- 2026: 460 · 2025: 395 · 2024: 297 · 2023: 319 · 2022: 403 · 2021: 447 · 2020: 394 · 2019: 314 · 2018: 217 · 2017: 73 · 2016: 11
- FWCI
- 115.39
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- IEEE Communications Surveys & Tutorials (publishedVersion)
- Funders
- Department of Homeland Security Network Security Deployment Division (HSSA01-13-C-2709)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Hardware and Architecture › Network Packet Processing and Optimization
- Physical Sciences › Computer Science › Artificial Intelligence › Artificial Immune Systems Applications
- Keywords
- intrusion detection, cybersecurity, machine learning, data mining, algorithmic complexity
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
