Deep learning for intrusion detection in emerging technologies: a comprehensive survey and new perspectives

Abstract

Intrusion Detection Systems (IDS) can help cybersecurity analysts detect malicious activities in computational environments. Recently, Deep Learning (DL) methods in IDS have demonstrated notable performance, revealing new underlying cybersecurity patterns in systems’ operations. Conversely, issues such as low performance in real systems, high false positive rates, and lack of explainability hinder its real-world deployment. In addition, the adoption of many new emerging technologies, such as cloud, edge computing, and the Internet of Things (IoT) introduces new forms of vulnerabilities. Therefore, the improvement of intrusion detection in emerging technologies depends on the clear definitions of challenging security problems and the limitations of existing solutions. The main goal of this research is to conduct a literature review of DL solutions for intrusion detection in emerging technologies to understand the state-of-the-art solutions and their limitations. Specifically, we conduct a comprehensive review of IDS-based automated threat defense methods, with the objective of identifying the landscape of, and opportunities for, incorporating DL methods into IDS. To accomplish this, a thorough review of IDS methods is conducted for multiple platforms and technologies, focusing on the use of common DL techniques. To expand on the study, several widely used IDS datasets are evaluated to assess their ability to train DL models and support researchers in understanding their characteristics and limitations. The analysis of attack vectors in emerging technologies is conducted, enabling an in-depth evaluation of security solutions in the future. Our findings show many clear opportunities for future research, including addressing the gap between solutions for controlled/simulated environments versus real systems, overcoming trustworthiness issues, including lack of explainability, and further exploring operationalization issues such as deployable solutions and continuous detection. Our analysis highlights that the operationalization of DL for intrusion detection in emerging technologies represents a key challenge to be addressed in the next few years.