Existing deep learning models often excel in isolated aspects, such as spatial or temporal feature extraction

The gap

Evidence profile

Sourced from the future work and inline gaps and stated research gap of the source papers, classified as general, drawn from work published between 2025 and 2026, spanning 4 journals. Those papers have been cited 40 times in total.

Supporting evidence — 5 representative gaps

• Enhancing security in iov: an ensemble learning approach for DDoS detection (2026) · Peer-to-Peer Networking and Applications · doi

  This paper addressed the key limitations of existing IDSs in the IoV. These limitations include poor detection of diverse DDoS attack types and weak adaptability to high network density, dynamic topology, and limited computational resources. Such issues reduce IDS effectiveness in real-time vehicular environments. To overcome these challenges, an ensemble learning– based IDS was proposed. The framework integrates two optimized CNN models for both binary and multi-class classification. The system effectively detects twelve types of DDoS attacks and adapts to changing IoV conditions. A dynamic deployment algorithm was also introduced to select the best IDS location among fog nodes, RSUs, and UAVs. This ensures continuous detection during congestion and partial system failures. In addition, a game-theoretic optimization strategy was designed to activate the IDS only when an attack is likely. This approach reduces energy con- sumption and limits unnecessary processing overhead. The proposed system was evaluated using three bench- mark datasets: VDoS-LRS, CICDDoS2019, and VDDD. The experimental results showed detection accuracy of over 99%. The proposed method outperformed existing approaches in terms of accuracy, scalability, adaptability, and efficiency. The simulation results also confirmed the effectiveness of the game-theoretic mechanism in limiting attacker advantage. For future work, advanced feature selection techniques such as information gain and Fast Correlation-Based Filter (FCBF) will be investigated. More efficient image-based packet representation methods will also be explored. These improvements aim to reduce per-packet classification time and enhance real-time performance in large-scale IoV systems. Authors’ contributions S.H. and Z.J. designed the study. Z.J. and S.S. and A.M. implemented the proposed model and conducted the experi- ments. S.H. and Z.J. analyzed the results and prepared figures. Z.J. and S.S. and A.M. wrote the main manuscript text. All authors reviewed and approved the final manuscript. Funding The authors declare that no funds, grants, or other support were received for conducting this study. Data availability No datasets were generated or analysed during the current study.

  generalfuture workevidence 5/5
  Keywords: proposed detection time based system authors limitations existing ddos attack types adaptability dynamic reduce effectiveness
• Hybrid Protocol-Based Network Anomaly Detection Using Machine Learning (2026) · International Journal of Drug Delivery Technology · doi

  Future work will investigate replacing or augmenting the Ran- dom Forest classifier with CNN–LSTM hybrid architectures in order to improve the detection of complex and multi-stage cyber attacks. Finally, future work will focus on extending the protocol- aware detection modules to support IoT-specific communica- tion protocols such as MQTT, CoAP, and Zigbee. Future work will focus on integrating deep learning models, supporting edge-based deployment, and exploring federated learning approaches to further enhance scalability, adaptability, and privacy in large-scale network environments.

  generalinline gapsevidence 5/5
  Keywords: future detection focus learning investigate replacing augmenting forest classifier lstm hybrid architectures order improve complex
• An intelligent cloud firewall framework for multi-cloud security using lstm anomaly detection and federated learning (2026) · Scientific Reports · doi

  firewall systems. With Future research directions for the proposed MLAF framework include investigating how the framework's components address the dynamic needs of distributed cloud-edge networks, intelligent automation, resilient cyber defense increasing reliance on architectures, and cloud decentralized edge computing environments and Internet of Things (IoT), the operational boundaries of cloud firewalls expand dramatically, and there is a pressing need for lightweight, adaptive security mechanisms that can perform effectively under resource-constrained operating conditions. Therefore, it is crucial to develop the most efficient versions of the long short-term memory (LSTM) anomaly detection module for deployment on edge devices (which generally have limited hardware capabilities, for example, 256 MB memory and processors at approximately 1 GHz). Techniques like model compression, knowledge distillation, quantization-aware training and neural architecture ARTICLE IN PRESSARTICLE IN PRESS ACCEPTED MANUSCRIPT search allow building of compact models of deep learning while keeping detection performance of the models. Furthermore, the combination of federated learning mechanisms offers an interesting way to establish cooperative threat intelligence across various nodes of a network while at the same time avoiding to send sensitive operational data to central cloud environments (which could especially be important for industrial control systems and critical infrastructure networks which have to meet very high cybersecurity standards, such as IEC 62443). One of the main research areas related to the proposed framework is to utilize the emerging capabilities of large language models to automatically convert human- readable threat intelligence into machine-executable firewall policies so that less dependency exists on the time-consuming and often prone-to-error manual creation of firewall policies. Future systems can therefore generate firewall policies that are syntactically correct and context-aware using structured datasets containing threat intelligence reports associated with validated firewall-rule sets. Subsequently, these generated firewall policies can be tested for their correctness using blockchain- based validation frameworks to ensure rule origin, validity and accountability before they are being deployed. Large Language Models can also serve as Explainable Artificial Intelligence interfaces. They can convert complex anomaly detection results from deep learning models into understandable natural-language explanations for security analysts, thereby improving transparency, trust and oversight of AI-driven cybersecurity decisions. Expanding the MLAF framework toward an Autonomous Security Operations Center (

  generalfuture workevidence 5/5
  Keywords: firewall models framework cloud intelligence policies systems edge security detection learning threat language future proposed
• Privacy-preserving multiclass intrusion detection in in-vehicle CAN networks using federated learning (2026) · Scientific Reports · doi

  This study presented and experimentally validated a federated learning–based intrusion detection system for multiclass classification of in-vehicle CAN bus traffic. Advanced deep learning architectures, including a deep LSTM and a hybrid CNN-BiLSTM model, were employed to distinguish between benign messages and multiple categories of malicious CAN traffic. The experimental results demonstrate that the proposed models achieve high detection performance, with classification accuracy reaching up to 99% across the evaluated attack classes. These findings ARTICLE IN PRESSARTICLE IN PRESS ACCEPTED MANUSCRIPT suggest that the models are well suited to handling the inherent complexity of multi-intrusion detection in connected vehicle environments. Performance evaluation using accuracy, precision, recall, and F1-score confirms the robustness and reliability of the proposed approaches, with only a limited number of misclassifications observed during testing. In particular, the hybrid CNN-BiLSTM architecture shows a strong capability to jointly model spatial characteristics and temporal dependencies in CAN traffic, enabling more effective detection of sophisticated attack patterns. Moreover, the adoption of federated learning allows collaborative model training across distributed clients while preserving data privacy, making the framework suitable for deployment in privacy-sensitive vehicular networks. Future research may assess the scalability of the proposed framework by evaluating its performance on larger, more heterogeneous real-world automotive datasets. The integration of explainable artificial intelligence techniques or attention-based mechanisms could further enhance model interpretability and support practical deployment. In addition, implementing the proposed IDS in real-time embedded environments, such as electronic control units or vehicular telematics systems, represents an important direction for future work. Further investigation into robustness against adversarial attacks and adaptation to other in-vehicle communication protocols, including FlexRay and Automotive Ethernet, would also be valuable. Moreover, future research will focus on cross-dataset validation on other CAN bus benchmarks, in order to achieve a further increase in the generalizability and robustness of the proposed federated IDS framework, by defining a standardized pipeline for extracting features at the flow level, which can be applied across heterogeneous vehicular intrusion datasets. 7. Declarations: Funding: This work was supported and funded by the Deanship of Scientific Research at Imam Mohammad Ibn Saud Islamic University (IMSIU) (grant number IMSIU-DDRSP2604). Conflict of interest / Competing interests: The authors declare that they have no known competing financial interests or personal relationships that could have influenced the work reported in this paper. Ethics approval: ARTICLE IN PRESSARTICLE IN PRESS ACCEPTED MANUSCRIPT No human participants were involved in this research Dataset Availability:

  generalfuture workevidence 5/5
  Keywords: proposed detection model article press federated learning intrusion vehicle traffic performance across robustness framework vehicular
• Intelligent Intrusion Detection System Against Various Attacks Based on a Hybrid Deep Learning Algorithm (2025) · Sensors · cited 40× · doi

  Existing deep learning models often excel in isolated aspects, such as spatial or temporal feature extraction, but lack a comprehensive approach to capturing network traffic's diverse and dynamic nature. Traditional intrusion detection systems often fall short when faced with the immense scale of IoT-generated data and the increasingly sophisticated nature of cyberattacks.

  generalstated research gapevidence 5/5
  Keywords: existing deep learning models often excel isolated aspects

Questions about this gap