Machine Learning Methods for Intrusion Detection: A Comprehensive Survey

Abstract

The exponential growth in connected networks, driven by the proliferation of the Internet of Things (IoT) and cloud computing, has resulted in surge in cyberattacks. Advanced and highly sophisticated threats have increased in prevalence, now encompassing advanced persistent threats, distributed denial-of-service attacks, and ransomware. Unfortunately, the signature- and rule-based detection mechanisms used in conventional Intrusion Detection Systems (IDSs) are failing to keep pace, especially with the increasing number of zero-day and newly discovered threats. Machine learning promises to be a futuristic technology due to its capability to identify patterns of activity, autonomously detect new attack designs, and instantly detect deviations in real-time. This survey comprehensively explores and examines the application of supervised, unsupervised, semi-supervised, hybrid, and deep learning methods in Intrusion Detection Systems (IDS), highlighting their unique contributions, strengths, and limitations.