The proposed framework demonstrates strong stabil- ity and low false alarm rates under reconstruction-based anomaly detection. Nevertheless, improving anomaly sen- sitivity, particularly for rare and

The gap

Consensus across the literature

Supporting evidence — 3 representative gaps

• Securing campus networks with intelligence: a review of machine learning techniques for ddos and arp protection (2026) · doi

  Could only detect known attacks; poor scalabil- ity; high false negatives; manual tuning required Depended heavily on fea- ture engineering; struggled with high-dimensional data; limited real-time capability High false positive rates; limited adaptability to novel attacks; resource-intensive for IoT/WBAN devices High computational cost; requires large labeled datas- ets; deployment complexity in resource-constrained environments (IoT/WBAN); explainability challenges Richard et al. Discover Networks (2026) 2:11 Page 6 of 32 models, such as SVMs, Decision Trees, and RFs, which leveraged labeled datasets of normal versus malicious traffic to detect anomalies in real time [45]. This represented a breakthrough compared to static rule systems, as it enabled high-volume classification of traffic and adaptive anomaly detection and prevention. In parallel, clustering methods like k-Means and k-Nearest Neighbor were introduced to uncover hidden patterns of ARP spoofing within campus LANs, providing the first automated mechanisms for iden- tifying insider threats and local man-in-the-middle attacks [46]. A critical limitation identified in traditional protocol-based defenses is their inabil- ity to scale in response to emerging trends such as the proliferation of IoT, the adop- tion of BYOD, the implementation of SDNs, and the increasing integration of WBANs within campus infrastructures. While mechanisms like Dynamic ARP Inspection and DHCP snooping have improved ARP security, their reliance on significant administra- tive overhead and specialized hardware has constrained deployment in resource-limited academic settings [47]. TCP hardening measures, such as SYN cookies, were effective against basic volumetric floods but fell short against more sophisticated multi-vector DDoS campaigns. These shortcomings highlighted a critical gap; although protocol rules provided baseline resilience, they lacked the intelligence to detect unknown anomalies, adapt to evolving adversarial strategies, or autonomously respond to subtle deviations in network behavior [48]. These challenges become more pronounced in environments shaped by SDN-driven traffic management, IoT device diversity, and WBAN communi- cations [49]. Significant advancement in campus network prevention has been the integration of multiple machine learning algorithms into ensemble learning frameworks, improving detection and prevention accuracy, robustness, and reliability by leveraging the strengths of different models. Recent breakthroughs have increasingly focused on embedding ML intelligence into protocol monitoring and enforcement, transforming static defenses into adaptive and proactive prevention [50]. Supervised approaches, such as RFs and SVMs, facilitated the classification of malicious versus legitimate flows. Meanwhile, deep learn- ing models,

  Keywords: high prevention detect attacks limited resource wban models traffic campus protocol false real time labeled
• Deep Learning–Driven Anomaly Detection for IoT-Enabled Smart Engineering Systems (2026) · doi

  The proposed framework demonstrates strong stabil- ity and low false alarm rates under reconstruction-based anomaly detection. Nevertheless, improving anomaly sen- sitivity, particularly for rare and subtle events, remains an important direction for future research. Potential enhance- ments include adaptive thresholding strategies that can adjust to evolving system dynamics, as well as the integra- tion of prediction-based components or latent-space regu- larization to improve feature separability. In addition, hy- brid detection schemes that combine reconstruction error with supervised or semi-supervised decision mechanisms may further enhance robustness in complex cyber–physi- cal environments. From a deployment perspective, the relatively com- pact architecture and stable inference behavior indicate that the model is suitable for IoT-enabled engineering sys- tems with constrained resources. Future work may there- fore explore edge-assisted or hierarchical deployment sce- narios, where real-time anomaly detection is required un- der limitations in latency, bandwidth, and computational capacity. This balance between detection performance and efficiency is critical for large-scale smart infrastructure ap- plications. Furthermore, a more comprehensive evaluation is re- quired to strengthen the validity of the approach. This in- cludes benchmarking against alternative methods such as LSTM autoencoders, CNN autoencoders, Isolation Forest, and statistical anomaly detection techniques. In addition, incorporating precision–recall AUC (PR-AUC) is recom- mended to provide a more informative evaluation under highly imbalanced conditions.

  Keywords: detection anomaly reconstruction based future enhance addition supervised deployment evaluation autoencoders proposed framework demonstrates strong
• Hybrid bagging and boosting with SHAP based feature selection for enhanced predictive modeling in intrusion detection systems (2024) · doi

  The SHAP-based feature selection, a hybrid form of bagging and boosting algorithms used for detection, and the residual correction are huge advancements towards better-designed, highly supple, and exceptionally robust-accuracy IDPSs. These statistical approaches mutually enhanced the predictive and explanatory models of intrusion detection. Simultaneously, the combined statistical approach resolves two modeling pitfalls in traditional cyber-security approaches. With the stacking approach, model boosting resolves concerns such as overfitting the data, and model averaging resolves the inherent credibility crisis faced by the intrusion detection models in the ex-ante environment. This solution can open a future research avenue to test other statistical innovations, if possible, to boost the predictive power of IDPSs. Precise areas on which the researchers can build up their findings include the following: Firstly, identifying how these hybrid methods adapt to the dynamic nature of evolving cyber threats is of great importance. Another critical area could be how real-time data processing impacts the effectiveness and efficiency of IDPS models, showing their practical usability. The scalability of these models in large-scale network environments and their resilience against advanced persistent threats are other aspects to be considered. Finally, this trade-off between model complexity and interpretability will contribute to designing more transparent and user-friendly intrusion detection systems. Answering such questions and focusing on the highlighted areas would lead to further steps in improving this field by offering robust and adaptive cybersecurity solutions.

  Keywords: detection models statistical intrusion resolves model hybrid boosting robust idpss approaches predictive approach cyber areas