{"id":"https://openalex.org/W7224995241","doi":"https://doi.org/10.64820/aepjeer.32.16.20.122026","title":"Machine Learning for Intrusion Detection and Prevention Systems: A Review of Approaches and Challenges","display_name":"Machine Learning for Intrusion Detection and Prevention Systems: A Review of Approaches and Challenges","publication_year":2026,"publication_date":"2026-10-31","ids":{"openalex":"https://openalex.org/W7224995241","doi":"https://doi.org/10.64820/aepjeer.32.16.20.122026"},"language":"en","primary_location":{"id":"doi:10.64820/aepjeer.32.16.20.122026","doi":"https://doi.org/10.64820/aepjeer.32.16.20.122026","is_oa":true,"landing_page_url":"https://doi.org/10.64820/aepjeer.32.16.20.122026","pdf_url":null,"source":{"id":"https://openalex.org/S5407051530","display_name":"Journal of Electrical and Electronics Research","issn_l":"2978-4484","issn":["2978-4484"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Electrical and Electronics Research","raw_type":"journal-article"},"volume":null,"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.64820/aepjeer.32.16.20.122026","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5157956720","display_name":"Khayal Farzaliyev","orcid":"https://orcid.org/0009-0008-3744-5026","observed_orcids":["https://orcid.org/0009-0008-3744-5026"]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Khayal Farzaliyev","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5157956720"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.84017553,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"3","issue":"2","first_page":"16","last_page":"20"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9980000257492065,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9980000257492065,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.00139999995008111,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.00019999999494757503,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-and-prevention-systems","display_name":"intrusion detection and prevention systems","score":0.9649999737739563},{"id":"https://openalex.org/keywords/network-security","display_name":"network security","score":0.7300000190734863},{"id":"https://openalex.org/keywords/online-decision-making","display_name":"online decision making","score":0.5260000228881836},{"id":"https://openalex.org/keywords/resource-aware-scheduling","display_name":"resource-aware scheduling","score":0.6700000166893005},{"id":"https://openalex.org/keywords/class-imbalance","display_name":"class imbalance","score":0.8809999823570251},{"id":"https://openalex.org/keywords/cross-dataset-generalization","display_name":"cross-dataset generalization","score":0.9660000205039978},{"id":"https://openalex.org/keywords/adversarial-robustness","display_name":"adversarial robustness","score":0.9779999852180481},{"id":"https://openalex.org/keywords/interpretability","display_name":"interpretability","score":0.9459999799728394},{"id":"https://openalex.org/keywords/computational-cost","display_name":"computational cost","score":0.6740000247955322},{"id":"https://openalex.org/keywords/ensemble-methods","display_name":"ensemble methods","score":0.5090000033378601},{"id":"https://openalex.org/keywords/federated-learning","display_name":"federated learning","score":0.9940000176429749},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"anomaly detection","score":0.8130000233650208},{"id":"https://openalex.org/keywords/deep-learning-architectures","display_name":"deep learning architectures","score":0.4560000002384186},{"id":"https://openalex.org/keywords/cicids2017","display_name":"CICIDS2017","score":0.8119999766349792},{"id":"https://openalex.org/keywords/nsl-kdd","display_name":"NSL-KDD dataset","score":0.7860000133514404},{"id":"https://openalex.org/keywords/unsw-nb15","display_name":"UNSW-NB15","score":0.9829999804496765}],"concepts":[{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.7911999821662903},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.7854999899864197},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7494000196456909},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.7296000123023987},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6478000283241272},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6057999730110168},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.6015999913215637},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.5361999869346619},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.4803999960422516},{"id":"https://openalex.org/C136389625","wikidata":"https://www.wikidata.org/wiki/Q334384","display_name":"Supervised learning","level":3,"score":0.44510000944137573},{"id":"https://openalex.org/C8038995","wikidata":"https://www.wikidata.org/wiki/Q1152135","display_name":"Unsupervised learning","level":2,"score":0.41999998688697815},{"id":"https://openalex.org/C2779530757","wikidata":"https://www.wikidata.org/wiki/Q1207505","display_name":"Quality (philosophy)","level":2,"score":0.4106000065803528},{"id":"https://openalex.org/C2776950860","wikidata":"https://www.wikidata.org/wiki/Q2914681","display_name":"Originality","level":3,"score":0.3522999882698059},{"id":"https://openalex.org/C2778403875","wikidata":"https://www.wikidata.org/wiki/Q20312394","display_name":"Adversarial machine learning","level":3,"score":0.33469998836517334},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.3208000063896179},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.3179999887943268},{"id":"https://openalex.org/C58973888","wikidata":"https://www.wikidata.org/wiki/Q1041418","display_name":"Semi-supervised learning","level":2,"score":0.30809998512268066},{"id":"https://openalex.org/C2778464652","wikidata":"https://www.wikidata.org/wiki/Q309849","display_name":"Open research","level":2,"score":0.2994000017642975},{"id":"https://openalex.org/C45942800","wikidata":"https://www.wikidata.org/wiki/Q245652","display_name":"Ensemble learning","level":2,"score":0.2955000102519989},{"id":"https://openalex.org/C2776145971","wikidata":"https://www.wikidata.org/wiki/Q30673951","display_name":"Labeled data","level":2,"score":0.29420000314712524},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.26910001039505005},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.260699987411499},{"id":"https://openalex.org/C115903097","wikidata":"https://www.wikidata.org/wiki/Q7094097","display_name":"Online machine learning","level":3,"score":0.25609999895095825}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.64820/aepjeer.32.16.20.122026","doi":"https://doi.org/10.64820/aepjeer.32.16.20.122026","is_oa":true,"landing_page_url":"https://doi.org/10.64820/aepjeer.32.16.20.122026","pdf_url":null,"source":{"id":"https://openalex.org/S5407051530","display_name":"Journal of Electrical and Electronics Research","issn_l":"2978-4484","issn":["2978-4484"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Electrical and Electronics Research","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.64820/aepjeer.32.16.20.122026","doi":"https://doi.org/10.64820/aepjeer.32.16.20.122026","is_oa":true,"landing_page_url":"https://doi.org/10.64820/aepjeer.32.16.20.122026","pdf_url":null,"source":{"id":"https://openalex.org/S5407051530","display_name":"Journal of Electrical and Electronics Research","issn_l":"2978-4484","issn":["2978-4484"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Electrical and Electronics Research","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7169783435","https://openalex.org/W7166534189","https://openalex.org/W7222119321","https://openalex.org/W7165769583","https://openalex.org/W4285246616","https://openalex.org/W4225305765","https://openalex.org/W4415381431","https://openalex.org/W4403675371","https://openalex.org/W4377230298","https://openalex.org/W4414129871"],"abstract_inverted_index":{"Purpose":[0],"\u2013":[1,73,121,194],"Machine":[2],"learning":[3,7,95],"(ML)":[4],"and":[5,18,22,33,59,63,67,69,75,86,94,117,189,204,207,219],"deep":[6,58],"(DL)":[8],"have":[9],"emerged":[10],"as":[11,30,229],"the":[12,43,47,82,129,133,147,171,199,211],"dominant":[13],"paradigm":[14],"for":[15,26,184,216],"intrusion":[16],"detection":[17,23,90,139,228],"prevention":[19],"systems":[20],"(IDPS),":[21],"accuracies":[24],"reported":[25],"benchmark":[27],"datasets":[28],"such":[29],"CIC-IDS2017,":[31],"UNSW-NB15,":[32],"NSL-KDD":[34],"now":[35],"consistently":[36],"surpass":[37],"99%.":[38],"To":[39],"situate":[40],"this":[41],"progress,":[42],"present":[44],"review":[45,196],"examines":[46],"main":[48],"families":[49],"of":[50,136,150,174],"ML-based":[51],"IDPS":[52],"mechanisms,":[53],"encompassing":[54],"classical":[55],"supervised":[56],"learning,":[57],"hybrid":[60],"architectures,":[61],"unsupervised":[62],"semi-supervised":[64],"anomaly":[65],"detection,":[66],"ensemble":[68],"federated":[70],"approaches.":[71],"Design/methodology/approach":[72],"Representative":[74],"highly":[76],"cited":[77],"studies":[78,137],"were":[79,105],"found":[80],"in":[81,128,131],"major":[83],"scholarly":[84],"databases":[85],"arranged":[87],"according":[88],"to":[89],"strategy,":[91],"deployment":[92,104],"setting,":[93],"paradigm.":[96],"The":[97,122,195],"recurring":[98],"challenges":[99],"that":[100,132,198,226],"restrict":[101],"their":[102],"operational":[103],"consolidated,":[106],"namely":[107],"class":[108],"imbalance,":[109],"weak":[110],"cross-dataset":[111],"generalization,":[112],"adversarial":[113],"fragility,":[114],"limited":[115],"interpretability,":[116],"computational":[118],"cost.":[119],"Findings":[120],"synthesis":[123],"exposes":[124],"a":[125,175,222,237],"structural":[126],"bias":[127],"literature,":[130],"vast":[134],"majority":[135],"assess":[138],"quality":[140],"on":[141,161,170],"full,":[142],"post-hoc":[143],"flow":[144,163,176],"records":[145],"under":[146],"implicit":[148],"assumption":[149],"unbounded":[151],"inspection":[152],"capacity.":[153],"In":[154],"contrast,":[155],"there":[156],"is":[157,182],"relatively":[158],"little":[159],"research":[160,224],"early":[162],"classification,":[164],"which":[165],"involves":[166],"making":[167],"decisions":[168],"based":[169],"initial":[172],"packets":[173],"before":[177],"it":[178,220],"concludes.":[179],"This":[180],"capability":[181],"crucial":[183],"inline":[185],"prevention,":[186],"reducing":[187],"latency,":[188],"optimizing":[190],"resource-aware":[191,232],"scheduling.":[192],"Originality":[193],"shows":[197],"disparity":[200],"between":[201],"offline":[202],"accuracy":[203],"online,":[205],"early,":[206,231],"resource-limited":[208],"decision-making":[209],"constitutes":[210],"most":[212],"consequential":[213],"open":[214],"problem":[215,234],"practical":[217],"IDPS,":[218],"outlines":[221],"corresponding":[223],"agenda":[225],"reframes":[227],"an":[230],"decision":[233],"rather":[235],"than":[236],"purely":[238],"accuracy-driven":[239],"one.":[240]},"counts_by_year":[],"updated_date":"2026-11-02T09:45:03.842371","created_date":"2026-11-01T00:00:00"}