A COMPREHENSIVE REVIEW OF INTRUSION DETECTION SYSTEMS ACROSS DATASET FAMILIES

Abstract

The available surveys in the field of intrusion detection are generally not comprehensive with some of the recent developments either underrepresented or even not mentioned. A major weakness of the previous studies is that the publications contain weaknesses like old sources, inadequate graphics, insufficient area of application, and lack of recommendations that can be applied by researchers and practitioners. Our approach to reviewing the literature is novel as it has a dataset-focused viewpoint, where we analyze in a systematic way the progress of benchmark datasets, starting with DARPA98 (approximately 90 percent accuracy using statistical anomaly detection) and KDD'99 (91-92 percent accuracy using SVMs and Neural Networks) and progressing to NSL-KDD (93-95 percent accuracy with Deep Belief Networks and LSTMs) and CICIDS2017 (94-95.1 percent accuracy using Random We also expand our discussion to newly created datasets of IoT of the Bot-IoT which present deep learning methods with more than 96 accuracy with reduced attack diversity. In contrast to previous surveys, our review does not just report on such performance benchmarks, but also critically assesses the merits and limitations of each dataset, realistic trade-offs, presents bias and fairness considerations, and comments on cross-domain generalizability across dataset families. This review will fill the gap between historical and modern research on IDS by synthesizing the results of both studies and providing a more practical and broad-based resource to junior researchers and practitioners by including findings based on accuracy and statistical analysis, informative plots, and recommendations that are easy to implement.