Network intrusion detection system: A survey on artificial intelligence-based techniques

High data rate requirements in recent years have resulted in the massive expansion of communication systems, network size and the amount of data generated and processed. This has eventually caused many threats to the communication networks as well due to a more frequent generation of security attacks that are either novel or the mutation of the existing attacks. To secure the networks against such threats, an intrusion detection system (IDS) is considered as one of the promising solutions. The main problem with the IDS is its increased false alarm rate (FAR) in detecting the zero-day attacks. To improve the detection accuracy and minimizing the FAR, the researchers proposed IDS solutions using artificial intelligence (AI) approaches. In this research, we have systematically reviewed the recent AI-based network IDS (NIDS) solutions proposed during the period 2016-2021 by the research community. We systematically analysed the proposed NIDS solutions based on their strengths, shortcomings, AI methodology adopted, datasets, and the evaluation metrics used for evaluation purposes. From the review, we observed that the hybrid approach is mostly adopted by the researchers to propose AI-based NIDS solutions, with a trend shifting to deep learning-based approaches over the last 2 years. Also, most of the proposed solutions are evaluated using a very old dataset with only a few studies opting for the latest datasets. Finally based on our observations, we highlighted the research challenges and the future research directions to help young researchers to contribute to this field.

Automated summary

Recent high data rate requirements have led to the expansion of communication systems and networks, resulting in increased security threats. To address these threats, researchers have proposed intrusion detection system (IDS) solutions based on artificial intelligence (AI). However, IDSs face a challenge of increased false alarm rate (FAR) in detecting zero-day attacks.