A Survey of Deep Learning Methods for Cyber Security
Open accessAbstract
This survey paper describes a literature review of deep learning (DL) methods for cyber security applications. A short tutorial-style description of each DL method is provided, including deep autoencoders, restricted Boltzmann machines, recurrent neural networks, generative adversarial networks, and several others. Then we discuss how each of the DL methods is used for security applications. We cover a broad array of attack types including malware, spam, insider threats, network intrusions, false data injection, and malicious domain names used by botnets.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
DL has demonstrated advantages over conventional signature-based, rule-based, and classic ML solutions.
“Indeed, DL has demonstrated advantages over conventional signature-based, rule-based, and classic ML solutions (Berman et al. 2019).”
From Deepfakes: current and future trends (2024) · cites this paper as Berman et al. 2019
Cites
ImageNet classification with deep convolutional neural networks
Krizhevsky, A., Sutskever, I., & Hinton, G. E. (2017) · Communications of the ACM · doi:10.1145/3065386 · Cited by 112,155 · see citing works
Hochreiter, S., & Schmidhuber, J. (1997) · Neural Computation · doi:10.1162/neco.1997.9.8.1735 · Cited by 102,318 · see citing works
Photo-Realistic Single Image Super-Resolution Using a Generative Adversarial Network
Ledig, C., Theis, L., Huszar, F., Caballero, J., Cunningham, A., Acosta, A., Aitken, A., Tejani, A., Totz, J., Wang, Z., et al. (2017) · 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2017.19 · Cited by 12,696 · see citing works
The perceptron: A probabilistic model for information storage and organization in the brain.
Rosenblatt, F. (1958) · Psychological Review · doi:10.1037/h0042519 · Cited by 12,280 · see citing works
Hebb, D. O. (2005) · doi:10.4324/9781410612403 · Cited by 9,825 · see citing works
Liu, F. T., Ting, K. M., & Zhou, Z.-H. (2008) · 2008 Eighth IEEE International Conference on Data Mining · doi:10.1109/icdm.2008.17 · Cited by 6,601 · see citing works
Greedy layer-wise training of deep networks
Bengio, Y., Lamblin, P., Popovici, D., & Larochelle, H. (2007) · Advances in Neural Information Processing Systems 19 · doi:10.7551/mitpress/7503.003.0024 · Cited by 4,841 · see citing works
Flownet: Learning optical flow with convolutional networks
Dosovitskiy, A., Fischer, P., Ilg, E., Hausser, P., Hazirbas, C., Golkov, V., Smagt, P. V. D., Cremers, D., & Brox, T. (2015) · 2015 IEEE International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2015.316 · Cited by 4,313 · see citing works
The Limitations of Deep Learning in Adversarial Settings
Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z. B., & Swami, A. (2016) · 2016 IEEE European Symposium on Security and Privacy (EuroS&P) · doi:10.1109/eurosp.2016.36 · Cited by 3,993 · see citing works
A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection
Buczak, A. L., & Guven, E. (2016) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2015.2494502 · Cited by 3,332 · see citing works
Self-citationLearning Phrase Representations using RNN Encoder-Decoder for Statistical Machine Translation
Cho, K., van Merrienboer, B., Gulcehre, C., Bahdanau, D., Bougares, F., Schwenk, H., & Bengio, Y. (2014) · arXiv · doi:10.48550/arxiv.1406.1078 · Cited by 3,317 · see citing works
Phoneme recognition using time-delay neural networks
Waibel, A., Hanazawa, T., Hinton, G., Shikano, K., & Lang, K. J. (1989) · IEEE Transactions on Acoustics, Speech, and Signal Processing · doi:10.1109/29.21701 · Cited by 2,643 · see citing works
What is the best multi-stage architecture for object recognition?
Jarrett, K., Kavukcuoglu, K., Ranzato, M. A., & LeCun, Y. (2009) · 2009 IEEE 12th International Conference on Computer Vision · doi:10.1109/iccv.2009.5459469 · Cited by 2,153 · see citing works
A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security
Al-Garadi, M. A., Mohamed, A., Al-Ali, A. K., Du, X., Ali, I., & Guizani, M. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.2988293 · Cited by 1,392 · see citing works
End-to-end encrypted traffic classification with one-dimensional convolution neural networks
Wang, W., Zhu, M., Wang, J., Zeng, X., & Yang, Z. (2017) · 2017 IEEE International Conference on Intelligence and Security Informatics (ISI) · doi:10.1109/isi.2017.8004872 · Cited by 991 · cited 2× · see citing works
“[163] 9 Traffic Identification ISCX VPN–non-VPN traffic dataset [164]”
BackgroundMethodAn empirical comparison of botnet detection methods
García, S., Grill, M., Stiborek, J., & Zunino, A. (2014) · Computers & Security · doi:10.1016/j.cose.2014.05.011 · Cited by 962 · see citing works
Bridging the Gap: A Pragmatic Approach to Generating Insider Threat Data
Glasser, J., & Lindauer, B. (2013) · 2013 IEEE Security and Privacy Workshops · doi:10.1109/spw.2013.37 · Cited by 344 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Cybersecurity data science: an overview from machine learning perspective
Sarker, I. H., Kayes, A. S. M., Badsha, S., Alqahtani, H., Watters, P., & Ng, A. (2020) · Journal of Big Data · doi:10.1186/s40537-020-00318-5 · Cited by 766 · see citing works
Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research
Zhang, Z., Hamadi, H. A., Damiani, E., Yeun, C. Y., & Taher, F. (2022) · IEEE Access · doi:10.1109/access.2022.3204051 · Cited by 450 · see citing works
Explainable Artificial Intelligence in CyberSecurity: A Survey
Capuano, N., Fenza, G., Loia, V., & Stanzione, C. (2022) · IEEE Access · doi:10.1109/access.2022.3204171 · Cited by 330 · see citing works
“In the sphere of CyberSecurity, researchers apply DL techniques for a variety of applications such as detecting network intrusions, malware traffic detec-471 tion and classification, and so on, as analyzed extensively in [55], [56], [57], and [58].”
MethodAdversarial Machine Learning Attacks and Defense Methods in the Cyber Security Domain
Rosenberg, I., Shabtai, A., Elovici, Y., & Rokach, L. (2022) · ACM Computing Surveys · doi:10.1145/3453158 · Cited by 295 · see citing works
Reinforcement learning for iot security: A comprehensive survey
Uprety, A., & Rawat, D. B. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3040957 · Cited by 214 · see citing works
DDoS attack detection and mitigation using deep neural network in SDN environment
Hnamte, V., Najar, A. A., Nhung-Nguyen, H., Hussain, J., & Sugali, M. N. (2024) · Computers & Security · doi:10.1016/j.cose.2023.103661 · Cited by 164 · see citing works
Deepfakes: current and future trends
Gambín, Á. F., Yazidi, A., Vasilakos, A., Haugerud, H., & Djenouri, Y. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-023-10679-x · Cited by 145 · see citing works
A bird's-eye view of deep learning in bioimage analysis
Meijering, E. (2020) · Computational and Structural Biotechnology Journal · doi:10.1016/j.csbj.2020.08.003 · Cited by 126 · see citing works
Encrypted Network Traffic Analysis and Classification Utilizing Machine Learning
Alwhbi, I. A., Zou, C. C., & Alharbi, R. N. (2024) · Sensors · doi:10.3390/s24113509 · Cited by 81 · see citing works
“Identical to the study conducted by [10], the authors furnished us with comprehensive explanations and essential context regarding deep-learning methods, including Multi-layer perceptron (MLP), Convolutional neural networks (CNN), Long short-term memory (LSTM), Auto-encoder (AE), and GAN models.”
BackgroundA collective AI via lifelong learning and sharing at the edge
Soltoggio, A., Ben-Iwhiwhu, E., Braverman, V., Eaton, E., Epstein, B., Ge, Y., Halperin, L., How, J., Itti, L., Jacobs, M. A., et al. (2024) · Nature Machine Intelligence · doi:10.1038/s42256-024-00800-2 · Cited by 51 · see citing works
Deep Cybersecurity: A Comprehensive Overview from Neural Network and Deep Learning Perspective
Sarker, I. H. (2021) · doi:10.20944/preprints202102.0340.v1 · Cited by 295 · see citing works
ISP Meets Deep Learning: A Survey on Deep Learning Methods for Image Signal Processing
Santos, C. F. G. D., Arrais, R. R., Silva, J. V. S. D., Silva, M. H. M. D., Neto, W. B. G. D. A., Lopes, L. T., Bileki, G. A., Lima, I. O., Rondon, L. B., Souza, B. M. D., et al. (2025) · ACM Computing Surveys · doi:10.1145/3708516 · Cited by 9 · see citing works
“In the field of Deep Learning, a great number of surveys is already available in many different areas, such as agriculture [58], biometrics [27], cyber security [7], regularization [98], autonomous driving [33], medical imaging [71], and also on more technical areas, such as on CNN [69].”
Explainable anomaly detection in encrypted network traffic using data analytics
Rahman, M. M., Soumik, M. S., Farids, M. S., Abdullah, C. A., Sutrudhar, B., Ali, M., & HOSSAIN, M. S. (2024) · Journal of Computer Science and Technology Studies · doi:10.32996/jcsts.2024.6.1.31 · Cited by 1 · see citing works
- Authors
- Berman, D. S., Buczak, A. L., Chavis, J. S., & Corbett, C. L.
- Affiliations
- Johns Hopkins University Applied Physics Laboratory (US)
- Corresponding author
- Buczak, Anna L.
- ORCID
- Buczak, Anna L.
- Venue
- Information
- Publisher
- MDPI AG
- Published
- 2019-04-02
- Volume
- 10
- Issue
- 4
- Pages
- 122
- ISSN
- 2078-2489 (ISSN-L)
- OpenAlex
- W2929803724
- Cited by
- 569
- References
- 17
- Citations by year
- 2026: 44 · 2025: 72 · 2024: 74 · 2023: 87 · 2022: 95 · 2021: 109 · 2020: 76 · 2019: 12
- FWCI
- 39.95
- Type
- journal article
- Language
- en
- Open access
- gold
- dx.doi.org
- Licence
- Locations
- Information (publishedVersion, cc-by)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Funders
- JST-Mirai Program
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Signal Processing › Advanced Malware Detection Techniques
- Keywords
- deep learning for cybersecurity, deep autoencoder, restricted Boltzmann machine, recurrent neural networks, generative adversarial networks, malware detection, spam detection, insider threats, network intrusion detection, false data injection attacks, botnets, malicious domain names
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
