The need for effective intrusion detection systems that can handle complex attack types

The gap

Evidence profile

Sourced from the stated research gap and future work of the source papers, classified as general, drawn from work published between 2024 and 2026, spanning 6 journals. Those papers have been cited 67 times in total.

Supporting evidence — 6 representative gaps

• A Comparative Study of Two-Stage Intrusion Detection Using Modern Machine Learning Approaches on the CSE-CIC-IDS2018 Dataset (2025) · Knowledge · cited 14× · doi

  The paper identifies the need for effective intrusion detection systems that can handle complex attack types. The study highlights the limitations of traditional IDSs and the potential of machine learning techniques in advancing intrusion detection. The research gap is not explicitly stated, but it revolves around the development of novel intrusion detection frameworks using modern machine learning approaches.

  generalstated research gap
  Keywords: paper identifies need effective intrusion detection systems handle
• HREF-IDS: a hybrid recursive feature elimination model for enhanced feature selection in network intrusion detection systems (2026) · Telecommunication Systems · doi

  In this paper, we came up with an enhanced hybrid RFE IDS approach that improved feature selection in NIDS. It homog- enized RF and XGB models to achieve the intended target. The proposed research considered set theory operations to pinpoint the most representative features from RFE-RF and RFE-XGB models. The chosen features differentiated between benign and network attack traffic effectively. It maintained high intrusion detection accuracy across several machine learning models. This study used six classifiers for the evaluation of the proposed method by using the UNSW-NB15 benchmark. A set of parameters, like accuracy, F1-score, and some selected features, was used to evaluate system performance. The proposed IDS method achieved up to 95.36% accu- racy by using only nine features. To be specific, it helped in reducing 79% of features with minimal accuracy loss. The HREF approach and robust models selected for network traf- fic classification established that the proposed method can work accurately on any unseen network traffic. In real-world scenarios, this model is expected to sustain high intrusion detection performance. Nonetheless, the proposed system also has its own set of limitations. For instance, the binary classification framework does not differentiate between dif- ferent types of attacks. Consequently, it can lessen the granularity of the intrusion detection. Besides, in some situ- ations, the selected feature subset may exclude features that could be informative. The proposed anomaly-based IDS approach opened a number of future research prospects. For instance, testing the methodology on additional datasets and analyzing system 123 performance using parameters such as recall, false negative rate, false alarm rate, and sensitivity. Future research can be done by exploring the alternative machine learning models in order to identify and test the most important features. Acknowledgements This study was funded by Ajman University under Grant No. 2023-IRG-ENIT-26. This work was also partially funded by the Brazilian National Council for Scientific and Technological Devel- opment (CNPq) under Grant No. 306607/2023-9. Author Contributions All authors contributed equally. Funding The authors have not disclosed any funding. Data Availability No datasets were generated or analysed during the current study.

  generalfuture workevidence 5/5
  Keywords: features proposed models approach network traf intrusion detection accuracy classi using selected system performance feature
• Development of an AI-Enhanced Intrusion Detection System for Detecting Zero-Day Attacks in Enterprise Networks (2026) · Iconic Research and Engineering Journals · doi

  This study presented an AI-enhanced hybrid intrusion detection system for detecting zero-day attacks in enterprise networks. The proposed architecture improved detection accuracy and demonstrates reduced false positives compared to conventional IDS solutions. Future work will focus on integrating explainable AI techniques, evaluating performance using implementing automated incident response mechanisms. Further learning research will also explore threat to approaches intelligence while preserving data privacy. federated collaborative live enterprise traffic, and support REFERENCES [1] Sommer, R., & Paxson, V. (2010). Outside the closed world: On using machine learning for network intrusion detection. Proceedings of the IEEE Symposium on Security and Privacy, 305– 316. https://doi.org/10.1109/SP.2010.25 [2] Buczak, A. L., & Guven, E. (2016). A survey of data mining and machine learning methods for cybersecurity IEEE Communications Surveys & Tutorials, 18(2), 1153–1176. https://doi.org/10.1109/COMST.2015.2494502 detection. intrusion [3] Kim, G., Lee, S., & Kim, S. (2014). A novel hybrid intrusion detection method integrating anomaly detection with misuse detection. Expert Systems with Applications, 41(4), 1690–1700. https://doi.org/10.1016/j.eswa.2013.08.066 [4] Shone, N., Ngoc, T. N., Phai, V. D., & Shi, Q. (2018). A deep learning approach to network intrusion detection. IEEE Transactions on Emerging Topics in Computational Intelligence, 2(1), 41–50. https://doi.org/10.1109/TETCI.2017.2772792 [5] Chandola, V., Banerjee, A., & Kumar, V. (2009). Anomaly detection: A survey. ACM Computing Surveys, 1–58. https://doi.org/10.1145/1541880.1541882 41(3), [6] Zhang, J., & Zulkernine, M. (2006). Anomaly detection with intrusion network based IRE 1718202 ICONIC RESEARCH AND ENGINEERING JOURNALS 4832 © MAY 2026 | IRE Journals | Volume 9 Issue 11 | ISSN: 2456-8880 DOI: https://doi.org/10.64388/IREV9I11-1718202 unsupervised outlier detection. Proceedings of the on IEEE Communications, 2388–2393. https://doi.org/10.1109/ICC.2006.255060

  generalfuture workevidence 5/5
  Keywords: detection https intrusion learning ieee network anomaly hybrid enterprise integrating using intelligence privacy machine proceedings
• Hybrid bagging and boosting with SHAP based feature selection for enhanced predictive modeling in intrusion detection systems (2024) · Scientific Reports · cited 53× · doi

  The SHAP-based feature selection, a hybrid form of bagging and boosting algorithms used for detection, and the residual correction are huge advancements towards better-designed, highly supple, and exceptionally robust-accuracy IDPSs. These statistical approaches mutually enhanced the predictive and explanatory models of intrusion detection. Simultaneously, the combined statistical approach resolves two modeling pitfalls in traditional cyber-security approaches. With the stacking approach, model boosting resolves concerns such as overfitting the data, and model averaging resolves the inherent credibility crisis faced by the intrusion detection models in the ex-ante environment. This solution can open a future research avenue to test other statistical innovations, if possible, to boost the predictive power of IDPSs. Precise areas on which the researchers can build up their findings include the following: Firstly, identifying how these hybrid methods adapt to the dynamic nature of evolving cyber threats is of great importance. Another critical area could be how real-time data processing impacts the effectiveness and efficiency of IDPS models, showing their practical usability. The scalability of these models in large-scale network environments and their resilience against advanced persistent threats are other aspects to be considered. Finally, this trade-off between model complexity and interpretability will contribute to designing more transparent and user-friendly intrusion detection systems. Answering such questions and focusing on the highlighted areas would lead to further steps in improving this field by offering robust and adaptive cybersecurity solutions.

  generalfuture workevidence 5/5
  Keywords: detection models statistical intrusion resolves model hybrid boosting robust idpss approaches predictive approach cyber areas
• Improved Hybrid Model-Based Machine and Deep Learning Approach for Intrusion Detection System (2026) · International Research Journal of Multidisciplinary Technovation · doi

  This study presented a hybrid intrusion recognition structure which involves feature reduction using PCA algorithm, class balancing using SMote clustering and XGBoost algorithm, KMeans++ classification detection. Experimental evaluation based on the CICIDS2017 intrusion network for dataset showed that the usage of cluster derived structural information in boosted ensemble classifier can enhance the detection performance on multiple attack categories. The proposed framework was accurate and had low false positive rates when compared with several baseline ML and DL models. The results indicate that the combination of feature-level learning and structural clustering information can help improve the ability of intrusion detection systems to recognize complex attack patterns. The CICIDS2017 dataset has utilized to assess the performance of the hybrid approach rigorously, along with a comparison of the approach with traditional machine learning deep-learning-based approaches. In essence, we can say that these results were highly monolithic, where the proposed hybrid system produced rate of 99.87%, beyond all other an accuracy in all performance metrics, namely approaches Precision, Recall, F1-Score, AUC, and FPR. The proposed hybrid work accomplished an accuracy of 99.87%, precision of 99.5%, recall of 99.3%, F1-score of 99.4%, ROC-AUC of 0.999, and a false positive rate as low as 0.1%, representing its excellent performance across all assessment metrics. 5.1 Future Work Although this study leads to interesting results, there still exist some possibilities for future works and extensions: Real-Time Deployment: Despite being satisfactory at picking up batches of data well, it has not been deployed in an online streaming fashion that makes use of Apache Kafka or Spark Streaming to ensure improvements in latency and response time into live networks. Explainable AI (XAI): Given that XGBoost models are more interpretable when compared to deep- learning models, an additional step the incorporation of explainability frameworks, such as SHAP (Shapley Additive exPlanations) and LIME, should be encouraged so that the security analysts could understand the reasons behind the prediction, hence reinforcing trust and transparency. toward Hybridization with Other Techniques: There remains scope for further continuing the process in the current hybrid method by incorporating deep autoencoders and transformer-based architectures to improve learning for extremely complex patterns.

  generalfuture workevidence 5/5
  Keywords: hybrid learning performance intrusion detection based proposed models deep feature using algorithm clustering xgboost cicids
• A Lightweight Stacking Ensemble Intrusion Detection Framework for Software-Defined Networking Using the InSDN Dataset (2026) · Scientific Journal of Computer Science · doi

  Future research will focus on improving the detection performance of minority attack categories by incorporat- ing advanced class imbalance handling techniques such as SMOTE, adaptive synthetic sampling, class-weighted learning, and cost-sensitive ensemble strategies. Addi- tional studies will evaluate the proposed framework on multiple benchmark datasets and real-world SDN traffic traces in order to assess its generalization capability and robustness under diverse network conditions. Another important direction is the development of real-time de- ployment and online learning mechanisms that can adapt to evolving attack patterns in dynamic SDN environ- ments. Also, future work will investigate the integration of explainable artificial intelligence techniques, including SHAP and LIME, to provide more transparent explana- tions of ensemble predictions and improve the interpreta- bility of intrusion detection decisions. Finally, repeated experimental runs and statistical significance analysis will be conducted to provide stronger evidence regarding the comparative performance of the proposed framework against existing state-of-the-art ap- proaches.

  generalfuture workevidence 5/5
  Keywords: future detection performance attack class techniques learning ensemble proposed framework real provide focus improving minority

Questions about this gap