Existing security solutions are ineffective against

The gap

Evidence profile

Stated in the future work and conclusions and cells research gap sections of the source papers, classified as general, drawn from work published between 2024 and 2026, spanning 5 journals. Those papers have been cited 53 times in total.

Supporting evidence — 5 representative gaps

• Hybrid bagging and boosting with SHAP based feature selection for enhanced predictive modeling in intrusion detection systems (2024) · Scientific Reports · cited 53× · doi

  The SHAP-based feature selection, a hybrid form of bagging and boosting algorithms used for detection, and the residual correction are huge advancements towards better-designed, highly supple, and exceptionally robust-accuracy IDPSs. These statistical approaches mutually enhanced the predictive and explanatory models of intrusion detection. Simultaneously, the combined statistical approach resolves two modeling pitfalls in traditional cyber-security approaches. With the stacking approach, model boosting resolves concerns such as overfitting the data, and model averaging resolves the inherent credibility crisis faced by the intrusion detection models in the ex-ante environment. This solution can open a future research avenue to test other statistical innovations, if possible, to boost the predictive power of IDPSs. Precise areas on which the researchers can build up their findings include the following: Firstly, identifying how these hybrid methods adapt to the dynamic nature of evolving cyber threats is of great importance. Another critical area could be how real-time data processing impacts the effectiveness and efficiency of IDPS models, showing their practical usability. The scalability of these models in large-scale network environments and their resilience against advanced persistent threats are other aspects to be considered. Finally, this trade-off between model complexity and interpretability will contribute to designing more transparent and user-friendly intrusion detection systems. Answering such questions and focusing on the highlighted areas would lead to further steps in improving this field by offering robust and adaptive cybersecurity solutions.

  generalstated in future workevidence 5/5
  Keywords: detection models statistical intrusion resolves model hybrid boosting robust idpss approaches predictive approach cyber areas
• Advanced Network Threat Detection Using Deep Learning Models (2024) · Advances in Nonlinear Variational Inequalities · doi

  Future work could explore the development of hybrid models or ensemble methods to combine the unique strengths of MLP, LSTM, and Autoencoder, potentially improving both accuracy and adaptability in intrusion detection systems, especially in real-time or zero-day attack scenarios.

  generalstated in conclusionsevidence 5/5
  Keywords: future explore development hybrid models ensemble combine unique strengths lstm autoencoder potentially improving accuracy adaptability
• Improved Hybrid Model-Based Machine and Deep Learning Approach for Intrusion Detection System (2026) · International Research Journal of Multidisciplinary Technovation · doi

  This study presented a hybrid intrusion recognition structure which involves feature reduction using PCA algorithm, class balancing using SMote clustering and XGBoost algorithm, KMeans++ classification detection. Experimental evaluation based on the CICIDS2017 intrusion network for dataset showed that the usage of cluster derived structural information in boosted ensemble classifier can enhance the detection performance on multiple attack categories. The proposed framework was accurate and had low false positive rates when compared with several baseline ML and DL models. The results indicate that the combination of feature-level learning and structural clustering information can help improve the ability of intrusion detection systems to recognize complex attack patterns. The CICIDS2017 dataset has utilized to assess the performance of the hybrid approach rigorously, along with a comparison of the approach with traditional machine learning deep-learning-based approaches. In essence, we can say that these results were highly monolithic, where the proposed hybrid system produced rate of 99.87%, beyond all other an accuracy in all performance metrics, namely approaches Precision, Recall, F1-Score, AUC, and FPR. The proposed hybrid work accomplished an accuracy of 99.87%, precision of 99.5%, recall of 99.3%, F1-score of 99.4%, ROC-AUC of 0.999, and a false positive rate as low as 0.1%, representing its excellent performance across all assessment metrics. 5.1 Future Work Although this study leads to interesting results, there still exist some possibilities for future works and extensions: Real-Time Deployment: Despite being satisfactory at picking up batches of data well, it has not been deployed in an online streaming fashion that makes use of Apache Kafka or Spark Streaming to ensure improvements in latency and response time into live networks. Explainable AI (XAI): Given that XGBoost models are more interpretable when compared to deep- learning models, an additional step the incorporation of explainability frameworks, such as SHAP (Shapley Additive exPlanations) and LIME, should be encouraged so that the security analysts could understand the reasons behind the prediction, hence reinforcing trust and transparency. toward Hybridization with Other Techniques: There remains scope for further continuing the process in the current hybrid method by incorporating deep autoencoders and transformer-based architectures to improve learning for extremely complex patterns.

  generalstated in future workevidence 5/5
  Keywords: hybrid learning performance intrusion detection based proposed models deep feature using algorithm clustering xgboost cicids
• A Lightweight Stacking Ensemble Intrusion Detection Framework for Software-Defined Networking Using the InSDN Dataset (2026) · Scientific Journal of Computer Science · doi

  Future research will focus on improving the detection performance of minority attack categories by incorporat- ing advanced class imbalance handling techniques such as SMOTE, adaptive synthetic sampling, class-weighted learning, and cost-sensitive ensemble strategies. Addi- tional studies will evaluate the proposed framework on multiple benchmark datasets and real-world SDN traffic traces in order to assess its generalization capability and robustness under diverse network conditions. Another important direction is the development of real-time de- ployment and online learning mechanisms that can adapt to evolving attack patterns in dynamic SDN environ- ments. Also, future work will investigate the integration of explainable artificial intelligence techniques, including SHAP and LIME, to provide more transparent explana- tions of ensemble predictions and improve the interpreta- bility of intrusion detection decisions. Finally, repeated experimental runs and statistical significance analysis will be conducted to provide stronger evidence regarding the comparative performance of the proposed framework against existing state-of-the-art ap- proaches.

  generalstated in future workevidence 5/5
  Keywords: future detection performance attack class techniques learning ensemble proposed framework real provide focus improving minority
• A Hybrid Deep Learning Framework for Real-Time Network Intrusion Detection in IoT Environments (2026) · WSEAS TRANSACTIONS ON COMPUTER RESEARCH · doi

  Existing security solutions are ineffective against zero-day attacks and variants. - Traditional machine learning classifiers are limited in their ability to model complex patterns. - The proposed hybrid deep learning technique addresses the limitations of existing security solutions.

  generalstated in cells research gapevidence 5/5
  Keywords: existing security solutions ineffective against zero-day attacks variants

Questions about this gap