Deep learning for intrusion detection in emerging technologies: a comprehensive survey and new perspectives
Bibliographic record
Abstract
Abstract Intrusion Detection Systems (IDS) can help cybersecurity analysts detect malicious activities in computational environments. Recently, Deep Learning (DL) methods in IDS have demonstrated notable performance, revealing new underlying cybersecurity patterns in systems’ operations. Conversely, issues such as low performance in real systems, high false positive rates, and lack of explainability hinder its real-world deployment. In addition, the adoption of many new emerging technologies, such as cloud, edge computing, and the Internet of Things (IoT) introduces new forms of vulnerabilities. Therefore, the improvement of intrusion detection in emerging technologies depends on the clear definitions of challenging security problems and the limitations of existing solutions. The main goal of this research is to conduct a literature review of DL solutions for intrusion detection in emerging technologies to understand the state-of-the-art solutions and their limitations. Specifically, we conduct a comprehensive review of IDS-based automated threat defense methods, with the objective of identifying the landscape of, and opportunities for, incorporating DL methods into IDS. To accomplish this, a thorough review of IDS methods is conducted for multiple platforms and technologies, focusing on the use of common DL techniques. To expand on the study, several widely used IDS datasets are evaluated to assess their ability to train DL models and support researchers in understanding their characteristics and limitations. The analysis of attack vectors in emerging technologies is conducted, enabling an in-depth evaluation of security solutions in the future. Our findings show many clear opportunities for future research, including addressing the gap between solutions for controlled/simulated environments versus real systems, overcoming trustworthiness issues, including lack of explainability, and further exploring operationalization issues such as deployable solutions and continuous detection. Our analysis highlights that the operationalization of DL for intrusion detection in emerging technologies represents a key challenge to be addressed in the next few years.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
How this classification was reachedexpand
Full frame machine prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. The Gemma side is a direct model label for every work in the frame, read from the title-only record. The Codex side is a classifier learned from the 10,348 direct Codex labels and calibrated to design-weighted sample rates; fields without enough sample support carry no Codex call. Candidate is the union of the two sides; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels.
Distilled classifier scores by category (both heads)
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.002 | 0.004 |
| Meta-epidemiology (narrow) | 0.001 | 0.001 |
| Meta-epidemiology (broad) | 0.001 | 0.001 |
| Bibliometrics | 0.003 | 0.003 |
| Science and technology studies | 0.000 | 0.001 |
| Scholarly communication | 0.002 | 0.003 |
| Open science | 0.001 | 0.001 |
| Research integrity | 0.001 | 0.002 |
| Insufficient payload (model declined to judge) | 0.002 | 0.001 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from itClassification
machine, unvalidatedMachine predicted; a candidate call from one source (direct Gemma or distilled Codex), not a consensus.
How this classification was reached, model by model and score by score, is at the end of the page under "How this classification was reached".