Bridging Domains: Advances in Explainable, Automated, and Privacy-Preserving AI for Computer Science and Cybersecurity

Abstract

Artificial intelligence (AI) is rapidly redefining both computer science and cybersecurity by enabling more intelligent, scalable, and privacy-conscious systems. While most prior surveys treat these fields in isolation, this paper provides a unified review of 256 peer-reviewed publications to bridge that gap. We examine how emerging AI paradigms, such as explainable AI (XAI), AI-augmented software development, and federated learning, are shaping technological progress across both domains. In computer science, AI is increasingly embedded throughout the software development lifecycle to boost productivity, improve testing reliability, and automate decision making. In cybersecurity, AI drives advances in real-time threat detection and adaptive defense. Our synthesis highlights powerful cross-cutting findings, including shared challenges such as algorithmic bias, interpretability gaps, and high computational costs, as well as empirical evidence that AI-enabled defenses can reduce successful breaches by up to 30%. Explainability is identified as a cornerstone for trust and bias mitigation, while privacy-preserving techniques, including federated learning and local differential privacy, emerge as essential safeguards in decentralized environments such as the Internet of Things (IoT) and healthcare. Despite transformative progress, we emphasize persistent limitations in fairness, adversarial robustness, and the sustainability of large-scale model training. By integrating perspectives from two traditionally siloed disciplines, this review delivers a unified framework that not only maps current advances and limitations but also provides a foundation for building more resilient, ethical, and trustworthy AI systems.

1. Introduction

Artificial intelligence (AI) and machine learning (ML) have rapidly transformed the landscape of computer science and cybersecurity, becoming essential technologies in both foundational research and practical applications. In recent years, there has been a surge in innovative AI-driven methods, such as deep learning architectures, representation learning, and automated machine learning, that have enabled breakthroughs across various computer science subfields including natural language processing, computer vision, automated software engineering, and human–computer interaction [1,2]. These advances have contributed to smarter systems capable of complex pattern recognition, adaptive decision making, and enhanced user interaction. For example, contemporary surveys highlight how the integration of vision and language tasks through multimodal AI models pushes the boundaries of what is possible in core computer science domains, independent of security applications [3]. Simultaneously, the field of cybersecurity has experienced significant benefits and new challenges with the integration of AI and ML. Sophisticated machine learning techniques are now integral to the detection of intrusions, malware identification, phishing prevention, and automated threat response. Surveys and systematic reviews consistently report that AI/ML-based cybersecurity solutions outperform traditional approaches in real-time anomaly detection, predictive analytics, and large-scale data processing [4,5]. However, this rapid evolution also introduces persistent challenges, such as adversarial machine learning, data quality limitations, and the need for greater model interpretability and ethical oversight [6]. The increasing ubiquity of AI/ML in these two domains not only reflects technological progress, but also raises crucial questions about social impact, ethics, governance, and workforce adaptation [7,8]. As AI technologies continue to shape the practice and philosophy of computer science and cybersecurity, it is essential to critically assess recent advances, ongoing challenges, and future trends within each field.

Although recent years have seen a proliferation of specialized surveys and systematic reviews, either on AI applications within computer science or, separately, within cybersecurity, there remains a notable lack of comprehensive, state-of-the-art reviews that rigorously address these two fields side by side while respecting their unique boundaries. Most of the existing literature focuses narrowly on advances in general computer science domains, such as natural language processing, computer vision, and software engineering [1,2], or on security-specific topics such as intrusion detection and threat mitigation [4,5]. Few works synthesize and compare the transformative impact, challenges, and emerging trends of AI in both sectors without conflating the two or leaving coverage incomplete. This paper aims to address this gap by providing a comprehensive, state-of-the-art review of artificial intelligence in computer science and cybersecurity, synthesizing the typical advances of AI that are actively transforming these disciplines, while also identifying unresolved issues and future trends that will define their continued development.

This study adopts a comprehensive literature review (CLR) to survey the field broadly. The research questions are intentionally wide in scope and refined iteratively as the review proceeds. Consistent with this approach, we use a flexible and selective search across reputable databases and apply informal and lightly structured screening to keep only highly cited research papers from strong journals (Q1 or Q2) with high impact factors. The following are the research questions:

• RQ1: What are the major advances in artificial intelligence that have influenced the fields of computer science and cybersecurity?
• RQ2: How has artificial intelligence been integrated into core domains such as the Internet of Things (IoT), software development, and cybersecurity frameworks?
• RQ3: What are the current challenges and ethical concerns that limit the widespread adoption of AI in computer science and cybersecurity?
• RQ4: What emerging trends and technologies are expected to shape the future development of AI in these fields?

1.1. Previous Surveys

Although the literature features numerous surveys and reviews on artificial intelligence and machine learning, almost all of these focus exclusively on computer science or cybersecurity, rarely both. Existing work routinely delves into AI/ML applications within specific computer science subfields, such as natural language processing, computer vision, or software engineering, or targets security-centric topics such as threat detection, intrusion prevention, or malware analysis. However, comprehensive examinations that bridge both domains and provide an integrated view remain exceedingly scarce [9].

Table 1. Comparison of existing surveys with our work (legend: ✓ means included; × means not included; ≈ means partially included).

Reference	Methodology	Advances of AI in CS	Advances of AI in Cyber	Challenges	Future Trends
[10]	NLR 1	×	✓	✓	×
[11]	NLR	×	✓	✓	×
[12]	SLR 2	×	✓	✓	✓
[13]	TLR 3	✓	×	×	≈
[14]	TLR	×	✓	✓	✓
[15]	CLR 4	×	✓	≈	≈
[16]	CLR	×	✓	×	≈
[14]	CLR	×	✓	≈	≈
[17]	CLR	×	✓	✓	×
[18]	CLR	×	✓	✓	✓
[19]	SLR	×	✓	≈	×
[20]	SLR	×	✓	✓	≈
[21]	CLR	×	✓	✓	×
[22]	CLR	×	✓	✓	×
[23]	NLR	×	✓	✓	✓
[24]	NLR	×	✓	×	✓
[25]	SLR	×	✓	×	✓
[26]	SLR	×	✓	✓	✓
[27]	NLR	×	✓	✓	×
[9]	SLR	✓	✓	≈	≈
[28]	NLR	×	✓	✓	✓
[1]	CLR	✓	×	✓	✓
Our paper	CLR	✓	✓	✓	✓

¹ Narrative Literature Review: Descriptive overview without strict methods, inclusion based on author choice. ² Systematic Literature Review: Structured search with predefined criteria and quality checks. ³ Traditional Literature Review: Broad thematic coverage without systematic protocols. ⁴ Comprehensive Literature Review: Applies structured methods while integrating findings across multiple databases, themes, or domains to provide broader and more holistic insights.

presents a classification of recent AI survey articles, organized according to whether they mainly address computer science or cybersecurity. It summarizes key reviews in both computer science and cybersecurity. A closer examination reveals that, while these studies have advanced knowledge in their respective domains, they rarely integrate insights across fields.

On the cybersecurity side, refs. [10,11] provide broad surveys of AI in security, with an emphasis on intrusion detection, attack prediction, and adversarial threats. The authors in [12] similarly focus on the challenges of applying AI to dynamic threat landscapes, while refs. [19,20] analyze AI-based defenses for IoT systems. These works demonstrate the growing role of AI in security, but do not connect their findings to broader advances in computer science research, such as explainability or federated learning.

On the computer science side, ref. [13] surveys AI for IoT and general CS applications. These reviews highlight technical breakthroughs and applications within computing, but make little reference to cybersecurity challenges such as adversarial robustness or secure deployment. The authors in [14] provide an overview of AI for cybersecurity, but without methodological rigor or deep integration between domains. Even when reviews address explainable AI, such as [17,26], the discussion is often framed narrowly as a defensive mechanism to interpret security alerts, rather than as part of a broader effort to build a trustworthy and accountable AI across disciplines.

Together, these examples illustrate the siloed nature of existing reviews. Computer science surveys tend to advance automation and model performance, while cybersecurity reviews focus on defense mechanisms, often without incorporating lessons from software engineering or explainability research. This fragmentation underscores the literature gap that our comprehensive review of the literature addresses. By synthesizing 256 studies across both domains, we identify shared challenges such as bias, interpretability, and resource intensity, while also highlighting cross-cutting solutions in explainable AI, software automation, and privacy-preserving methods. The review is written for researchers and professionals in both computer science and cybersecurity, with a focus on those seeking integrated insights that can guide future research directions and applied practices.

1.2. Contributions

Only a few survey papers explore how AI is advancing in the fields of computer science and cybersecurity. Even when such surveys exist, they often leave out important parts, such as the challenges these systems face or the future trends. This shows a need for a more complete overview that covers not just the progress made, but also the problems that remain and what comes next. Our research contributions can be summarized in the following points:

• Comprehensive review of advances in AI in computer science and cybersecurity.
• Examination of the dual role of AI in cybersecurity.
• Analysis of emerging AI trends in computing and cybersecurity.
• Exploring ethical, security, and privacy challenges related to the use of AI.

This paper contributes to the research field by delineating how recent advances in artificial intelligence and machine learning are shaping both computer science and cybersecurity as distinct domains. By synthesizing cross-disciplinary challenges such as algorithmic bias, fairness, transparency, and resource demands, the review draws attention to persistent gaps and the need for further methodological innovation. In the context of computer science, the paper highlights research priorities that include the development of explainable and interpretable AI models, the adoption of fairness-aware learning strategies, and the exploration of privacy-preserving approaches such as federated learning and decentralized AI. These themes urge researchers to address the risks of biased training data and model opacity and to improve equity and accountability across applications. In the context of cybersecurity, the review documents the effectiveness of AI-based systems for automated threat detection and response, but also identifies research needs to mitigate false positives, improve robustness to adversarial attacks, and ensure ethical operation in real-world settings. The separation of these fields within the review supports new avenues for specialized research: for instance, benchmarking and optimizing the computational efficiency of AI deployments, and advancing strategies that balance security outcomes with privacy and fairness considerations. By articulating these domain-specific challenges and trends, the paper lays a foundation for targeted investigations and more responsible innovation in AI-driven computing and security research.

1.3. Survey Structure

In the following sections, this manuscript explores the transformative advances that AI has introduced in computer science and cybersecurity, examines the associated challenges and limitations, and discusses the trends likely to shape its future. By presenting a holistic synthesis of the field, this work seeks to contribute to the growing body of knowledge, providing valuable insight to researchers, practitioners, and policymakers alike. The rest of this paper is organized as follows. Section 2 provides a concise overview of the methodology used in this study to conduct the survey. Section 3 presents key foundational studies in AI and provides a brief overview of its evolution within computer science and cybersecurity. Section 4 explores recent advances of AI in computer science, while Section 5 focuses on its applications and progress in cybersecurity. Case studies of AI applications in computer science and cybersecurity are provided in Section 6. Section 7 discusses the main challenges facing AI adoption in both fields and outlines emerging trends that can guide future developments. Finally, Section 8 concludes the paper.

2. Methodology

The research methodology flow chart for this survey is described in Figure 1. As we mentioned in Section 1, the objective of this study is to investigate existing research on AI advances in computer science and cybersecurity, challenges, and future trends. Therefore, to collect the reviewed research articles, the following criteria were established:

• The relevant articles were retrieved by querying IEEE Xplore [29], ACM Digital Library [30], SpringerLink [31], ScienceDirect [32], Elsevier [33], Web of Science [34], and Google Scholar [35].
• The searching keywords for this survey paper were constituted as three aspects: “AI”, “Computer Science”, and “Cybersecurity”. To create the search string, all potential pertinent synonyms of the given terms were discovered in different databases. The following synonyms may be pertinent to the subject: “Cyber Security”, “Artificial Intelligence”, “AI”, and “Computing”. Using Boolean operators (AND, OR, NOT), we built queries that included synonyms and related terms. We then screened titles, abstracts, and a brief skim of the text, retaining only closely relevant papers for full analysis.
• Only articles published between 2011 and 2025 were selected to highlight the most recent trends in the application of AI in computer science and cybersecurity, except Section 3, which refers to developments dating back to the early 1940s to provide historical context on the origins of artificial intelligence.
• Only publications written in English were considered for this review, and duplicate studies were excluded from the analysis.
• Our review draws on peer-reviewed journal articles, conference papers, and selected books. The majority of conference works are from IEEE, and most journal papers are from highly ranked outlets. Books were consulted mainly to cover the historical development of AI. We have also considered arXiv preprints, but only when they showed clear academic value, such as strong methodological contributions or recognition through citations.

The article selection process was conducted in two stages. First, the search results were screened by reviewing the titles and abstracts based on predefined selection criteria. The documents that passed the initial screening were then read in full to create a shortlist of studies, selected according to the inclusion and exclusion criteria.

3. AI History and Foundation

The origins and foundational theories of artificial intelligence trace back to the 1940s and 1950s, a period marked by the pioneering work of [36], widely regarded as the father of modern AI, who introduced the famous Turing test as a criterion for evaluating a machine’s ability to exhibit intelligent behavior indistinguishable from that of a human.

Ref. [37] introduced a pioneering mathematical model of the artificial neuron in their research. Their work proposed that neurons could be modeled as binary threshold units—firing either “on” or “off” based on the presence of input signals. By combining these units through logic gates (AND, OR, NOT), they demonstrated that neural networks could theoretically compute any function that a digital computer could perform, given the right structure and inputs.

Ref. [38] laid the foundation for understanding control and communication systems in both machines and living organisms. It marked the birth of cybernetics as a formal interdisciplinary field, influencing not only artificial intelligence, but also robotics, neuroscience, and systems theory. Wiener’s core idea was that systems could improve through an auto-learning process that continuously analyzes their output and adjusts behavior accordingly. This concept became central to understanding intelligence and control, laying the groundwork for early AI, particularly in autonomous and adaptive systems.

During the Dartmouth Workshop in 1956, ref. [39] formally established artificial intelligence as a distinct field of research. The participants proposed that “every aspect of learning or any other feature of intelligence can in principle be so precisely described that a machine can be made to simulate it,” laying the philosophical foundation for subsequent AI exploration. The workshop catalyzed research into diverse areas, including automated reasoning, neural networks, natural language processing, machine learning, and the simulation of human intelligence. Shortly thereafter, ref. [40] introduced LISt Processing (LISP), a programming language designed specifically for symbolic computation. LISP provided a theoretical and practical framework for manipulating symbolic data through recursion and linked-list core mechanisms that would become fundamental to AI programming.

The 1970s marked the onset of what became known as the AI winter, a period characterized by a decline in interest and investment in artificial intelligence. During this time, research efforts focused on rule-based expert systems, which sought to formalize human expertise through explicitly defined sets of rules. Although these systems demonstrated success in narrowly defined domains, they struggled with scalability, adaptability, and knowledge maintenance. As the limitations of these approaches became apparent, particularly their inability to learn from new data, enthusiasm began to wane. Coupled with overinflated expectations and underwhelming real-world performance, these shortcomings led to a significant decline in funding and support, a period often referred to as the AI winter. Furthermore, the era was constrained by limited computing resources, which further hindered progress and practical deployment.

The period spanning the 1980s to 1990s, often referred to as AI’s second wind, witnessed a resurgence of interest driven by the emergence of machine learning and neural networks. A key breakthrough during this era was the introduction of the backpropagation algorithm by [41], which revitalized research on connectionism and made multilayer neural networks training feasible. This era also saw the rise of influential machine learning techniques, including decision trees (DTs), support vector machines (SVMs), and unsupervised learning methods. AI began to integrate with broader areas of computer science, such as robotics, game theory, and distributed computing. These advances enabled practical applications in early prototypes of autonomous vehicles, speech recognition systems, and intelligent game-playing agents.

In the late 1990s and early 2000s, AI began to intersect meaningfully with the field of cybersecurity, particularly through the development of intrusion detection systems (IDS). AI techniques such as anomaly detection and pattern recognition became instrumental in powering IDS and anti-malware solutions. Machine learning played a crucial role in enabling these systems to identify novel cyber threats, including zero-day attacks, by learning behavioral patterns rather than relying solely on predefined signatures. Foundational research in this domain includes the work of [42], who applied machine learning to model normal system behavior and detect anomalies in Unix processes. Similarly, ref. [43] introduced artificial immune systems (AIS), inspired by the human immune system, to detect intrusions through adaptive pattern recognition and negative selection mechanisms. These pioneering efforts laid the foundation for modern AI-driven cybersecurity solutions.

As will be demonstrated in the following sections, the 2010s to 2020s marked a renaissance in deep learning, leading to transformative advancements in numerous domains of computer science, including computer vision, speech recognition, machine translation, and natural language processing. The emergence of transformer architectures and AI foundation models revolutionized the field by enabling systems to process vast amounts of data with unprecedented accuracy and efficiency. In the context of cybersecurity, these advances significantly improved capabilities in areas such as threat intelligence, automated incident response, proactive threat hunting using behavioral AI, and cyber forensics. Using the power of deep learning, modern security systems can now detect sophisticated attack patterns, adapt to evolving threats, and support analysts to uncover complex intrusion scenarios with greater speed and precision.

4. Advances of AI in Computer Science

The purpose of this section is to explore the most prominent advances in AI within the field of computer science. We have identified four key areas of focus: Internet of Things (IoT), machine learning and deep learning, natural language processing (NLP), and software development.

4.1. AI in Internet of Things

Internet of Things (IoT) has evolved from an experimental idea to a cornerstone technology in the modern digital world. Early examples can be traced back to the 1990s, such as the John Romkey’s internet-connected toaster [44], but IoT has since grown into a highly advanced system of interconnected devices capable of automation and real-time exchange. Today, the IoT is assimilated as a vast network of sensors, actuators, and communication technologies that enable data collection, sharing, and automation in several domains of applications [45]. Figure 2 shows the diversity of IoT applications. As the growth of IoT networks continues, AI has become instrumental in equipping devices with the power not only to collect and share data but also to make intelligent decisions. This evolution is particularly evident in various application domains, from home-based networks to industrial systems, where AI-driven IoT systems have shown improved responsiveness compared to traditional systems [46]. In addition to improving responsiveness, AI also contributes to improving performance and security in IoT networks. By integrating with blockchain, for example, AI facilitates tamper-proof, decentralized authentication mechanisms for key management. In practice, as described by [47], blockchain provides an immutable, decentralized ledger for device authentication and key distribution, whereas AI improves this framework by dynamically monitoring device behavior and applying adaptive trust policies. This synergy between AI and blockchain prevents key compromise and tampering, but also supports real-time anomaly detection, ensuring that even valid keys are not misused for spoofing or session hijacking. The combination of AI and blockchain provides a scalable, tamper-resistant approach to IoT authentication that strengthens resilience against insider threats and man-in-the-middle exploits. Moreover, beyond the improvement in responsiveness and security, AI techniques are also used to optimize resource allocation and reduce energy consumption in various application domains (smart cities, healthcare, agriculture, industrial IoT systems, etc.). For example, artificial intelligence of things (AIoT) has been used in agriculture to optimize irrigation and crop health monitoring, thus improving both efficiency and resource management [48]. AIoT has also been applied to smart city functions, such as optimizing traffic flow [49].

Furthermore, AI is instrumental in improving real-time data processing [50]. Edge computing, in particular, enables data processing closer to the source, reducing latency and bandwidth consumption in IoT networks. Using AI on the edge, IoT applications benefit from capabilities such as predictive analytics, anomaly detection, and autonomous decision making [50,51]. A concrete example of these benefits is provided by [52], who demonstrated that coupling AI-based decision-making algorithms with IoT sensors can effectively predict system failures and optimize production processes in cyber-physical production systems (CPPS) in real time. Building on these local improvements, AI is also showing its mark in next-generation communications. In particular, AI has been used to optimize network design and operation for 5G and Beyond 5G (B5G) technologies in complex environments such as massive multiple-input multiple-output (MIMO) systems [53]. Another key advancement influenced by AI as discussed by [54] is in digital twins, where AI-enabled sensors, combined with 5G and IoT, improve the efficiency of sensing technologies and enable real-time data processing and decision making across various domains, including smart homes and robotic control systems. While digital twins exemplify its integration with virtual applications, AI’s impact extends to human-centered applications as well. This is particularly visible in domains such as elderly care and autonomous robotics, where AI-driven systems provide real-time assistance through federated platforms and edge computing [55,56].

Figure 2. Internet of Things. Selected reference for each IoT domain: smart homes [57]; smart health [58]; smart retail [59]; smart power and water grids [60]; smart agriculture [61]; infrastructure monitoring [62]; intelligent transportation [63]; smart cities [64]; environmental monitoring [65]; factory automation and industry 4.0 [66].

Figure 2. Internet of Things. Selected reference for each IoT domain: smart homes [57]; smart health [58]; smart retail [59]; smart power and water grids [60]; smart agriculture [61]; infrastructure monitoring [62]; intelligent transportation [63]; smart cities [64]; environmental monitoring [65]; factory automation and industry 4.0 [66].

Recent advancements in AI for edge computing have further enhanced IoT systems by addressing the specific security challenges faced by edge nodes (ENs). AI-driven techniques are used to improve intrusion detection systems (IDS), which detect denial of service (DoS) and distributed denial of service (DDoS) attacks with greater precision [67]. Machine learning (ML) extracts malicious patterns from previous datasets, improving IDS detection rates compared to traditional methods [68]. AI is also used to optimize access control by categorizing ENs based on privileges. This enables stricter access restrictions for high-privilege IoT devices, mitigating potential attacks [68]. The integration of AI across these systems helps provide real-time decision making and improves the scalability of IoT networks, making them more efficient and secure. Next, AI’s role in real-time detection of security attacks is emphasized by its integration with complex event processing (CEP) models, which collect and correlate data to identify threats such as DoS, malware, and privacy breaches [69]. By combining CEP with machine learning, these systems can rapidly adapt to new types of attacks, even those not explicitly modeled. This has proven to be very effective in sectors such as IoT healthcare, where real-time attack detection is critical [69]. This is further evidenced by techniques such as support vector machines (SVM) and random forest (RF), known for their high detection accuracy and commonly used for feature selection and attack classification [20]. In addition, deep neural networks (DNNs) and convolutional neural networks (CNNs) offer alternatives for learning complex features [68]. Recent research has highlighted the role of AI in enabling autonomic behaviors in next-generation computing systems, particularly in cloud, fog, and edge computing environments. AI-driven edge computing facilitates real-time data processing and autonomous decision making, reducing latency and enhancing the efficiency of IoT applications [51,70]. Moreover, AI-based resource management in edge and fog computing optimizes resource allocation while minimizing energy consumption [50]. In addition, AI has proven critical for the development of self-healing and self-protecting IoT systems, allowing automated anomaly detection and system optimization. This autonomic capacity enables IoT networks to scale efficiently and handle the huge data loads generated by billions of interconnected devices, ensuring robust security and performance [20,70].

AI has been at the core of many advancements in IoT, as supported by the literature, yet we believe there is still untapped potential to unlock, provided certain challenges are addressed. Firstly, while IoT security has improved, data privacy remains a sensitive area [71]. This is due to the immersive nature of IoT: a widespread integration across several domains and a continuous collection and sharing of data across devices. Subsequent solutions of AI in IoT need to account for data privacy. In designing future AI-driven solutions in IoT, the findings of recent research on privacy preservation methods should be considered, such as privacy partition, lightweight obfuscation, energy theft detection with energy privacy preservation in smart grids, and local differential privacy [71,72,73]. These methods ensure that privacy and security are integral components of the design process, rather than being an afterthought. Blockchain and federated learning are other techniques that can also be combined with AI to ensure data privacy. Federated learning allows training models without transferring sensitive data [74], while blockchain ensures secure and decentralized authentication [47]. Secondly, there is unpredictability and bias involved when decisions are made by AI models, especially in human-centered applications such as elderly care, smart healthcare monitoring, AI-driven rehabilitation systems. Therefore, AI models should be provided with considerable and diverse training data to ensure the optimal accuracy of their predictions and recommendations. The research in explainable AI conducted by [21,75,76] highlights how to identify and eliminate potential biases. It will facilitate a better understanding of the reasoning behind AI predictions, improve the user’s trust, and maintain a level of accountability regarding the decision making of AI models.

AI has engineered remarkable achievements in the Internet of Things by enhancing security, scalability, and real-time decision making. However, addressing challenges such as data privacy, unpredictability, and bias remains crucial to unlocking its future potential. As critical infrastructures continue to integrate with the Internet of Things, AI models will be needed to handle the vast amount of data that comes with them. Ensuring privacy will remain a key aspect within these systems. Future research trends towards the use of privacy-preserving techniques like federated learning and differential privacy to protect sensitive information while enabling the efficient use of AI. As IoT expands across more sectors, the urgency of these challenges and potential solutions will likely increase.

Table 2. Comparative synthesis of AI in IoT security.

Reference & Task	Dataset(s)	Model Family	Headline Metric	Limitations
[46]: Intrusion/anomaly detection in IoT networks	NSL-KDD, UNSW-NB15, CICIDS2017	RF, SVM, CNN, LSTM	Acc. > 95%	Datasets imbalanced/outdated, limiting realism
[54]: AI-enabled sensing for IoT (VR/AR, digital twin)	Synthetic sensing datasets	DL (CNNs, LSTMs)	Acc. > 90%	Heterogeneous data and privacy exposure
[69]: IoT attack detection via event processing + ML	IoT event streams (custom testbed)	CEP + ML classifiers	Acc. > 90%	Testbed-specific, scalability unproven
[20]: Intrusion detection in IoT (SLR)	NSL-KDD, UNSW-NB15, CICIDS2017	RF, SVM, DL models	Acc. > 95%	Reliance on outdated/imbalanced datasets
[71]: Privacy-preserving DL in IoT	MNIST, CIFAR-10 (LDP applied)	DNNs w/local diff. privacy	2–5% acc. drop w/privacy	Privacy–utility trade-off
[72]: Smart grid energy theft detection	Smart grid consumption (simulated)	CNN + Privacy-preserving ML	Acc. 93–95%	Synthetic setup, limited generalizability
[73]: Privacy partitioning for DNNs in edge IoT	CIFAR-10, ImageNet (edge-cloud)	Partitioned DNNs	Near-baseline acc.	Comm. overhead, trusted boundary
[74]: Federated learning in healthcare IoT	Hospital data (Parkinson’s diagnosis)	FL (FedAvg, CNNs)	Collaborative training w/privacy	Comm. cost and security

offers a comparative mini-synthesis of IoT-related studies, tabulating specific tasks, datasets, model families, headline metrics, and dataset limitations.

4.2. AI in Machine Learning and Deep Learning

Machine learning (ML) and deep learning (DL) are subfields of AI that have changed the way data are processed and interpreted. ML involves algorithms that make predictions and/or decisions based on the data they learned [77]. DL, on the other hand, employs multiple layers of artificial neural networks to find complex patterns in large datasets [78]. Both techniques have advanced enormously in recent years, and this is due to several factors such as the availability of extensive data, the prowess of computational power, and innovations in the field of algorithms [79]. Current progress in ML has focused on optimizing various learning techniques, such as supervised, unsupervised, and reinforcement learning. Refs. [75,80] discuss the use of reinforcement learning in dynamic environments where policies are continuously adapted to optimize outcomes. AI-driven decision-making systems in autonomous vehicles are an example where reinforcement learning techniques are adapted to real-time changes in traffic conditions and pedestrian behavior. Similarly, refs. [81,82] highlight advances in metalearning, a technique that enables models to learn new tasks with minimal training time and data. It has been used effectively in personalized healthcare to diagnose rare conditions using a limited number of labeled examples.

Further advances in reinforcement learning were explored in [83] by integrating reward-shaping techniques to accelerate the learning process. Fine-tuning reward signals are used to significantly improve the efficiency of training AI agents in complex environments such as game simulations and robotic control tasks. Active learning [84,85] is another example in which the model selectively asks the user for labels on the richest data points (the ones with the most information). With this technique, a model can achieve high accuracy despite accessing a limited amount of labeled data, making it highly suitable for applications in medical diagnostics, where obtaining labeled data is often expensive and time consuming.

Deep learning architectures have seen considerable innovation, with developments in convolutional neural networks (CNNs), recurrent neural networks (RNNs), and transformers enhancing performance across various tasks. The studies of [84,86] illustrate the superior precision of transformers in natural language processing tasks. They capture long-range dependencies in text specifically because of their self-attention mechanisms. For instance, refs. [87,88] illustrate examples of transformers being used in language translation, where they outperform traditional sequence-to-sequence models by producing more coherent translations. Meanwhile, medical imaging and autonomous driving are areas in which CNNs have broken through in addition to the field of traditional image processing. Refs. [56,89] discuss specific cases in which CNNs detect anomalies in medical scans. This has enabled the early diagnosis of conditions such as lung cancer and diabetic retinopathy in patients. Lightweight neural networks, such as MobileNet and SqueezeNet, are also efficient alternatives to traditional CNNs. They can be used in scenarios where computational resources are limited, but efficiency and accuracy are still expected. These architectures are the most suitable for devices with limited resources, such as smartphones and IoT sensors [90,91].

Hybrid models have emerged with the integration of ML and DL with other AI techniques. Refs. [77,92] discuss how combining ML algorithms with fuzzy logic, genetic algorithms, or traditional statistical approaches can improve decision-making processes in complex environments. Hybrid AI models have been used in predictive maintenance systems for manufacturing as an example [93]. The combination of ML and expert knowledge has produced a more accurate prediction of equipment failures. ML and DL have driven significant advancements in numerous domains. In healthcare, AI-powered diagnostic systems have improved the accuracy of disease detection and patient monitoring, as demonstrated in studies by [94,95,96]. For example, patients with skin cancer were accurately detected with the use of deep learning algorithms trained on large medical image data sets, at a level comparable to that of expert dermatologists [97]. In robotics and autonomous systems, reinforcement learning techniques are used to improve navigation and control algorithms, enabling more adaptive and resilient robot behaviors in unstructured environments [98]. Other studies highlight how deep learning was used to detect autonomous drones in real time and avoid collisions on complex terrains [99,100].

As AI models grow in complexity, scalability, privacy, and efficiency have become crucial areas of focus. Refs. [53,101,102] have proposed continuous improvements in hardware and algorithms to manage energy consumption and reduce costs, potential solutions to handle the growing computational requirements of state-of-the-art models.

The research discussed by [93,103,104] emphasizes the development of distributed training techniques and model parallelism, which allow for faster training of large-scale neural networks across multiple GPUs. These techniques have been applied to large-scale language models, such as GPT-3, to significantly reduce training times and computational costs [78,105,106]. Other methods such as model pruning, quantization, and knowledge distillation have been used to reduce the computational load of AI models without sacrificing accuracy, an ideal fit to deploy AI models on edge devices [107,108]. The emergence of federated learning is another key development that addresses scalability and data privacy. Federated learning enables models to decentralize training across data sources while preserving data privacy. Refs. [109,110] discuss how federated learning is being applied in healthcare, where models are trained on data from multiple hospitals without sharing sensitive patient information. Beyond decentralized training, federated learning also allows personalized model refinement as shown by [111], leading to more accurate and personalized predictions. Differential privacy is another method that offers solutions, especially for data leakage risks when training complex models [112,113].

Machine learning and deep learning have made substantial strides in advancing the field of AI, driving innovations across various applications, and improving automation, decision making, and predictive capabilities. Their success is largely driven by the increasing availability of data, advances in computational power, and the development of innovative learning algorithms. Improvements in accuracy and efficiency have been observed across several domains (healthcare, natural language processing, autonomous systems, smart agriculture, etc.) with the use of ML and DL techniques. However, challenges such as data privacy, scalability, and algorithmic bias persist. As models become more complex, researchers should focus on scalability and energy efficiency to avoid unsustainable computational costs. Likewise, protecting sensitive data and addressing bias are other issues that need to be considered. Advancements in explainable AI and hybrid models, which combine traditional methods with ML/DL techniques, will continue to improve transparency and trust in AI systems. Ultimately, the integration of ML and DL across industries will continue to shape the future of AI, opening up new possibilities in fields such as quantum computing, real-time decision making, and personalized AI applications.

Table 3. Comparative synthesis of ML/DL studies.

Reference & Task	Dataset(s)	Model Family	Headline Metric	Limitations
[83]: Subgoal-based RL for robotic tasks (four-rooms, pinball, pick-and-place)	Four-rooms gridworld, Pinball sim, Fetch Pick-and-Place (OpenAI Gym)	RL (SARSA, actor–critic, DDPG)	HSRS improved time-to-threshold, outperformed baselines in pinball/robotics	Sensitive to hyperparameter $\eta$; depends on human subgoals; poor generalization to hard-to-define subgoals.
[86]: AI/ML in nanosafety (toxicity prediction, safe-by-design)	15+ nanosafety datasets (metal oxides, CNTs, TiO2/ZnO, protein corona)	Regression, SVM, RF, kNN, Bayesian NN, CNN, DNN, GANs	$r^2$ up to 0.95; AUC 0.83; accuracy 78–100%	Limited datasets, weak nanospecific descriptors, risk of overfitting, interpretability gaps, scarce in vivo data.
[89]: AI in optometry (myopia, strabismus, keratoconus, IOL, amblyopia)	Ophthalmic datasets (fundus/OCT, EMR of 132k children, 11k–37k IOL, facial images)	CNNs (ResNet, VGG, Inception, DenseNet, Faster R-CNN), RF, SVM, XGBoost, SVR	Myopia AUC 0.93–0.98; strabismus AUC 0.998, acc. 0.95; keratoconus acc. 0.95–0.99; IOL error ≈ 0.20D; amblyopia acc. ≈ 0.91	Small/single-center datasets, limited external validation, annotation quality issues, poor interpretability, legal/privacy risks.
[91]: DL, RL, and world models (perception, control, games, robotics)	Benchmarks (Atari, Go/Chess/Shogi, robotics sims, multimodal data)	Deep RL (AlphaGo, AlphaZero, MuZero, Dreamer V2), VAEs, self-supervised (BERT, SimCLR, MoCo)	Landmark milestones: AlphaGo > champions; AlphaZero mastering board games; MuZero SoTA Atari; Dreamer V2 efficient Atari	Sample inefficiency; heavy compute; poor real-world generalization/dexterity; sim-to-real gaps; interpretability/theory lacking.
[90]: Advances in DL and attention (NLP, CV, multimodal)	Standard large-scale corpora (ImageNet, NLP pretraining datasets)	CNNs, RNNs, transformers (ViT, MAE, Swin)	ViT > CNN on large-scale data; MAE efficient reconstruction; Swin strong CV performance	Interpretability debated; high data/compute demand; poor on small datasets; no standard metrics for explainability.
[92]: Review of ML/DL applications (vision, NLP, IDS, healthcare, education)	Case datasets (IDS, DDoS, breast cancer, text corpora, student performance, microscopy)	ML (NB, LR, kNN, DT, RF, SVM, AdaBoost, Bagging), DL (CNN, RNN, AE, DBN, GANs)	Reported acc., ROC, F1, precision/recall, AUC (domain-dependent)	Domain-specific, small datasets, overfitting risk, limited interpretability, scalability issues.
[93]: ML in Python (libraries, benchmarks, applications)	Standard benchmarks (Iris, MNIST, CIFAR, ImageNet)	ML (SVM, RF, kNN, GBM), DL (CNN, RNN, AE, GANs), RL (TF-Agents, PyTorch RL)	Illustrative: MNIST ≈ 99% acc.; ImageNet SoTA >80% top-1	Library/tool focused; limited novelty; reproducibility/scalability challenges; deployment integration bottlenecks.
[94]: AI/ML/DL in advanced robotics (navigation, control, surgery, drones, transport)	Task-level data (object recognition, speech/gesture, sensor/traffic)	CNNs, RNNs, Faster R-CNN, YOLO, SVM, RF, Deep RL (DDPG, PPO), ensembles	RF localization 98.8% acc.; Faster R-CNN/YOLO strong detection; DDPG smooth paths; PPO grasping success	Data/compute intensive; sim-to-real gap; safety/robustness concerns; ethical/societal risks.
[96]: ML/DL IDS in transportation (VANET, UAV)	IDS datasets: ISCX2012, SUMO, NSL-KDD, Car Hacking, Kyoto, KDD’99; limited CIC-IDS-2018	SVM, RF, kNN, DT, NB, CNN, RNN, DBN, DNN, DCNN, Q-learning/DQN, Deep RL	High reported accuracy, low FP; RF localization 98.8%; DBN-PSO effective UAV attack detection	Reliance on old/small datasets, simulator bias, UAV compute limits, poisoning risks, weak interpretability/fairness.
[97]: AI for melanoma detection (lesion segmentation/classification)	ISIC 2018 (920 dermatoscopic images)	U-Net (ResNet50, VGG16 backbones), CNN	U-Net acc. 92%, F1 0.87, mIoU 0.81, Recall 0.97; ResNet50 acc. 87%; VGG16 acc. 88%	Limited dataset size, variable image quality, no external validation, black-box CNN, clinical deployment barriers.
[100]: DL for drone racing (gate detection/navigation)	Custom drone dataset (1544 train imgs, 7380 test frames)	CNN-based SSD (VGG-16, AlexNet, ADRNet) + LOS guidance	VGG-16 SSD AP 0.824 @2.16 fps; ADRNet AP 0.755 @29 fps; 90% detection; <0.1 m error	Lower AP vs. heavy SSD; degraded >10 m; indoor-only validation; speed–accuracy tradeoff.

offers a comparative mini-synthesis of ML/DL-related studies, tabulating specific tasks, datasets, model families, headline metrics, and dataset limitations.

4.3. AI in Natural Language Processing

In recent years, AI-driven advances have revolutionized natural language processing (NLP), pushing the field beyond traditional rule-based approaches and statistical models. NLP, at its core, seeks to enable computers to understand, interpret, and generate human language in a way that is both meaningful and contextually relevant [114]. The early methods in NLP involved explicit programming, in which linguists crafted sets of rules that attempted to capture the structure and syntax of the language. Although these rule-based systems were pioneering at the time, they were inherently limited by their rigidity and dependence on human-defined rules, failing to capture the nuance and fluidity of human language [115]. The introduction of AI, particularly through machine learning and deep learning techniques, allowed NLP to evolve from these fixed approaches to a data-driven discipline capable of adapting to diverse language tasks [114].

The transformational shift in NLP began with the adoption of machine learning, where statistical methods allowed models to learn patterns from data without requiring explicit rules [115]. However, it was the emergence of deep learning, specifically neural networks with multiple layers, that provided the power necessary to recognize and generate complex language patterns [79]. This evolution led to the development of large-scale language models capable of understanding language context in ways previously unimaginable. AI models trained on vast datasets, comprising billions of words and sentences, started outperforming traditional approaches in tasks such as translation, summarization, and sentiment analysis [116,117,118].

Today, the capabilities of NLP are largely supported by these AI advances, which make them central to both foundational research and applied technologies in the field. A pivotal advancement in NLP came with the development of transformer architectures, which introduced a new way to process and understand language. Traditional models, such as recurrent neural networks (RNNs), struggled with long-term dependencies due to their sequential nature, which made them less effective in retaining context over longer text sequences [119]. Transformers addressed this limitation through a self-attention mechanism that allowed models to weigh the importance of each word in a sentence relative to every other word, regardless of their position. Introduced by [119], transformers replaced RNNs and quickly became the foundation for a new era of NLP models. This architecture laid the groundwork for the development of models such as bidirectional encoder representations from transformers (BERT), generative pre-trained transformer (GPT), and text-to-text transfer transformer (T5), which have become central to state-of-the-art NLP applications. As discussed in [119], through transformers, models can handle context more flexibly and accurately, allowing AI to process text at a scale and depth that mirror human comprehension. These transformer-based models are often referred to as large language models (LLMs), and they represent some of the most significant advancements in NLP. LLMs, such as BERT [120] and GPT [121], take advantage of vast datasets and billions of parameters to capture a wide range of linguistic features and patterns. In essence, LLMs operate by pre-training on extensive text corpora, where they learn underlying language structures, relationships, and contexts. During pre-training, models use objectives like masked language modeling, where certain words are hidden and the model learns to predict them, or autoregressive techniques, where models generate text one word at a time based on preceding context. This extensive training enables LLMs to generalize many NLP tasks, including translation, question answering, and summarization, as seen with the original GPT models [122,123].

BERT was among the first models to leverage the power of transformers in a bidirectional way, which means that it could consider both the preceding and following context for each word in a sentence. This bidirectional approach was a breakthrough, as it allowed a more nuanced understanding of context, critical for tasks such as question answering and sentiment analysis [120]. Similarly, models such as the GPT introduced by OpenAI showcased the potential of unidirectional transformers for text generation. GPT models, particularly GPT-3, demonstrated the capability of short-cut learning, where the model could perform tasks with minimal examples, showcasing an unprecedented level of adaptability [124,125]. Notably, recent iterations of GPT, such as GPT-4 and beyond, have further scaled up in both parameter size and training techniques, resulting in significant improvements in understanding complex queries, providing contextual responses, and even performing domain-specific tasks with higher accuracy [126]. These large language models have had a transformative impact on the field of NLP. Not only have they set new benchmarks in terms of performance on various tasks, but they have also redefined how AI can be applied to language. Refs. [126,127] mentioned that GPT-3, for example, with its 175 billion parameters, has shown impressive performance in tasks ranging from translation to creative writing, and it can generate coherent and contextually appropriate text with minimal supervision. Such capabilities underscore the power of LLMs and the way their AI-driven architecture has enabled them to handle a wide array of language tasks with high accuracy. The sheer scale and adaptability of LLMs have made them fundamental tools in NLP, where they serve as the basis for numerous downstream applications.

Transfer learning and fine-tuning have further amplified the utility of large language models by allowing them to quickly adapt to specific tasks with limited additional data [128]. Transfer learning allows a pre-trained model to be fine-tuned on a smaller, task-specific dataset, making it feasible to apply these models in various contexts without requiring vast amounts of labeled data. For example, BERT can be pre-trained on a large general corpus and then fine-tuned on a specialized dataset for tasks such as sentiment analysis [129]. This adaptability has made transfer learning a key method in NLP, as it significantly reduces the computational costs and time associated with training models from scratch. Fine-tuning, particularly with techniques such as masked language modeling and next-sentence prediction, allows these pre-trained models to excel in specific applications, such as classification, summarization, and information retrieval [128]. In addition to the general-purpose applications aforementioned, transfer learning has also opened doors to domain-specific adaptations. By fine-tuning domain-specific corpora, NLP models can be customized for specialized fields such as legal, medical, and scientific NLP. In medical NLP, for example, fine-tuning clinical notes or medical research papers allows models to interpret complex jargon and extract critical information relevant to healthcare professionals and patients [130,131]. Similarly, in the legal field, models tuned to case law and statutory language can assist in legal research by retrieving pertinent case precedents or summarizing lengthy legal documents [132,133]. These domain-specific adaptations highlight the versatility of AI-driven NLP models, which can be modified to meet the needs of different sectors without extensive re-engineering.

The role of AI in multilingual NLP is equally transformative, particularly as NLP applications expand to global audiences. Traditional NLP models often faced limitations in handling languages other than English due to a lack of labeled data in other languages [134]. However, advances in multilingual models, such as mBERT and XLM-R, have enabled models to perform cross-lingual tasks by training in multiple languages simultaneously [135,136]. These multilingual models can handle a wide range of languages, offering a level of inclusivity that supports linguistic diversity in NLP applications. For example, mBERT has been used effectively in translation tasks and zero-shot learning, where a model trained on one language can perform tasks in another language without explicit training data in that language [137].

Although earlier AI-driven NLP architectures raise their own challenges, today’s biggest challenges are centered on LLMs [138]. One of the most prominent limitations is the reliance on vast computational resources, which has made training and deploying LLMs financially and environmentally costly. Ref. [139] stated that models like GPT-3 and GPT-4 require extensive GPU or TPU resources, and their training processes consume substantial electricity, raising concerns about the sustainability of these methods. As a result, ref. [139] observed that there is an increasing focus on developing more efficient architectures and training practices, such as model pruning and quantization, to mitigate their environmental impact. These computational and sustainability concerns reflect the broader challenges discussed in Section 4.2 on machine learning and deep learning. In that context, different techniques were highlighted as strategies for reducing computational cost and improving energy efficiency, including distributed training, pruning, quantization, and knowledge distillation. Looking at LLMs, a pairing of those strategies and advancements in specialized hardware (GPUs, TPUs, and AI accelerators) can partially reduce the costs of scaling while enabling deployment in more resource-constrained environments.

Another critical issue as discussed by [140] is the interpretability of LLMs, as these models often operate as “black boxes”, making it challenging to understand how they arrive at particular conclusions. This lack of transparency can be problematic in domain applications that require accountability, such as healthcare and legal systems. Although researchers are exploring explainability techniques, achieving meaningful transparency without compromising performance remains an ongoing challenge [141,142]. Ethical concerns are also at the forefront of discussions surrounding AI-driven NLP. LLMs can inadvertently learn and perpetuate biases present in their training data, leading to output that may reinforce stereotypes or unfair representations. Ref. [143] illustrated that language models trained on Internet-based corpora can reflect and even amplify harmful biases related to gender, race, and nationality. Addressing these biases is complex, as it involves both improving the quality of the dataset and developing bias mitigation techniques during model training [144]. In addition, there are security and privacy concerns associated with NLP models, particularly those used in sensitive domains. LLMs trained on vast data repositories may unintentionally retain specific details from training data, posing risks of data leakage. Privacy-preserving methods, such as differential privacy, are being explored to protect against unintended data disclosure, although they add an additional layer of complexity to model development [145,146].

The transformative role of AI in NLP has opened new possibilities for processing, generating, and understanding human language with an unprecedented degree of accuracy and adaptability. Large language models, powered by transformers and enabled by techniques such as transfer learning, have redefined the boundaries of NLP, allowing for sophisticated applications across languages, domains, and industries. However, alongside these advances come significant challenges, particularly in areas of computational efficiency, ethical concerns, and the need for greater transparency in AI decision making. Future research will likely focus on addressing these limitations, with a push toward more sustainable, interpretable, and ethically robust models. As the field evolves, AI-driven NLP is positioned not only to broaden its applications but also to refine its approach to achieving responsible and inclusive language technology.

Table 4. Comparative synthesis of NLP advances.

Reference & Task	Dataset(s)	Model Family	Headline Metric	Limitations
[115]: POS tagging, chunking, NER, SRL	WSJ (POS), CoNLL-2000 (chunking), CoNLL-2003 (NER), CoNLL-2005 (SRL)	Unified NN (window + conv), pre-trained embeddings	POS: 97.3%; Chunking: 94.3 F1; NER: 89.6 F1; SRL: 75.5 F1	Training costly; below SOTA in supervised-only; still needs task-specific features.
[119]: Machine translation (EN–DE, EN–FR), parsing	WMT14 EN–DE (4.5M), EN–FR (36M), WSJ PTB (40K sents)	Transformer (encoder–decoder, self-attn, pos. enc.)	EN–DE: 28.4 BLEU; EN–FR: 41.8 BLEU; Parsing: 91.3–92.7 F1	$O\left(n^2\right)$ cost limits long seqs; large GPU needs (8 × P100).
[120]: Language understanding (GLUE, SQuAD, NER, SWAG)	Pretrain: BooksCorpus, Wikipedia; Downstream: GLUE, SQuAD v1/2, CoNLL-2003, SWAG	BERT (transformer encoder, MLM+NSP pretraining)	GLUE: 82.1 avg.; SQuAD1.1: 93.2 F1; SQuAD2.0: 83.1 F1; NER: 92.8 F1	110–340M params; TPU-scale cost; [MASK] pretrain mismatch; unstable on small data.
[121]: Few-shot NLP (QA, MT, reasoning, gen.)	Training: CommonCrawl, WebText2, Books, Wikipedia ( 570GB); Eval: LAMBADA, HellaSwag, TriviaQA, CoQA, SuperGLUE, WMT	GPT-3 (175B autoregressive Transformer, sparse attn)	LAMBADA: 86.4%; TriviaQA: 71.2%; CoQA: 85.0 F1; SuperGLUE: 71.8	Extremely costly (PF-days on V100); uneven perf.; biases; energy use; long-text incoherence.
[122]: Survey of LLM evolution (BERT, GPT, T5, BART, PaLM, LLaMA, BioGPT, BLOOMZ)	Pretraining corpora: CommonCrawl, Wikipedia, Books, Code, biomedical; Eval: GLUE, SuperGLUE, SQuAD, BLEU/ROUGE	Transformer LLMs (encoder-only, decoder-only, encoder–decoder, multimodal)	Summarizes SOTA across tasks (GLUE, SuperGLUE, MT, summarization, biomedical NER)	Bias/fairness; hallucinations; high compute/energy; limited real-time; context-length limits.
[123]: Text summarization (abstractive/extractive)	CNN/Daily Mail	BART, T5, PEGASUS (enc–dec); GPT-2 (dec-only); BERTsum (enc-only)	BART: ROUGE-1 44.2/L 40.9; PEGASUS: R-1 44.2/L 41.3; T5: R-1 43.5/L 40.7; GPT-2: R-1 29.3/L 26.6	GPT-2 weak; BART/T5/PEGASUS costly; BERTsum only extractive; tuning/domain sensitive.
[124]: Code summarization (few-shot, cross/same-project)	CodeXGLUE (CodeSearchNet, 6 langs; 1K test, 10-shot prompts)	Codex (GPT-based, 12B dec-only Transformer)	Cross-project: BLEU-4 21.2 (vs. CodeT5 19.6); Same-project: 24.4	Zero/one-shot poor (BLEU-4 ≤ 6.2); API limits; possible train-data leakage; costly; perf. varies by lang.
[125]: Few-shot text classification (prompting)	Yelp, AG News, Yahoo, MNLI, SuperGLUE (BoolQ, COPA, RTE, WiC)	PET, iPET, PETAL, ADAPET, GENPET on BERT, RoBERTa, ALBERT; vs. GPT-3	iPET (10 ex): Yahoo 70.7%; MNLI: iPET 78.6% vs. GPT-3 69.0; PETAL (50 ex): Yahoo 62.9%	Manual prompts; single-token focus; perf. sensitive to template quality; GPT-3 better in open-gen.
[128]: Sentiment analysis (Bangla, binary)	Bangla social media + reviews (8952 samples, 2-class)	Bangla-BERT fine-tuned + CNN-BiLSTM; vs. Word2Vec, GloVe, fastText baselines	Acc. 94.15%, F1 93.04; vs. FastText 88.4%, Word2Vec/GloVe 84–85%	Small, imbalanced; binary only; heavy preprocessing; limited generalization beyond Bangla.
[129]: Low-resource NLP: Hi-En sentiment + Hindi discourse	Hi-En Facebook (3879 sents), Twitter POS/NER (1489), HDRB (1865 sents) + PDTB2 (1M WSJ sents)	Char-trigram BiLSTM (curriculum: LangID → POS → LM → Sentiment); Cross-lingual LASER, MUSE, XLM	Hi-En Sentiment: Acc. 72.5% (vs. 69.2% prior); Hindi discourse implicit: XLM zero-shot 37.1 F1 (vs. 33.9 HDRB-only); explicit: up to 63.2 F1	Small/noisy data; imbalance; transfer depends on task align.; LASER/MUSE weak zero-shot; implicit discourse still hard.

offers a comparative mini-synthesis of NLP-related studies, tabulating specific tasks, datasets, model families, headline metrics, and dataset limitations.

4.4. AI in Software Development

The evolution of modern software systems has brought about increased complexity, which introduces challenges in maintaining quality, security, and reliability. Traditional software development practices often fail to meet the rigorous demands of modern systems, leading to the need for innovative solutions. AI has emerged as a transformative force in software development, bringing new dimensions of efficiency, accuracy, and scalability to the software development life cycle (SDLC). Through AI, organizations can optimize resources, automate repetitive tasks, improve quality assurance, and predict defects before they occur, ultimately improving the robustness and resilience of software applications [147,148,149]. The integration of AI into SDLC is not simply a technological upgrade, but a paradigm shift that redefines how software is designed, developed, and maintained. This section delves into the impact of AI on each phase of the SDLC—planning and requirement analysis, design, development, testing, deployment, and maintenance—illustrating the various ways AI enhances both productivity and reliability. From predictive analytics in project planning to real-time defect detection in maintenance, AI’s role across the SDLC stages represents a holistic transformation of the software development process. As AI continues to evolve, its applications in software engineering are expected to deepen, further bridging the gaps between complex system requirements and the capabilities of development teams.

In the initial stage of planning and requirement analysis, AI assists project managers and development teams by providing predictive analytics and optimizing resource allocation [148]. AI-driven project management tools analyze historical project data to forecast resource requirements, timelines, and potential risks. For example, machine learning models leverage past project information to predict resource constraints and optimize task allocation, ensuring efficient workflow. Studies show how machine learning algorithms accurately estimate project durations and detect bottlenecks, improving planning accuracy from the outset [148]. AI also supports early-stage defect prediction by identifying potential vulnerabilities in the proposed code or design structure based on historical data. By predicting areas where issues are likely to arise, AI enables teams to plan proactively and allocate resources to address these areas. For example, defect prediction models use logistic regression and neural networks to assess high-risk areas in code even before implementation begins [149]. This proactive approach helps streamline resource planning and prioritization, minimizing risks early in the development cycle. Beyond project forecasting and defect prediction, AI-driven NLP tools enhance requirement gathering by automating the extraction and analysis of requirements from unstructured data. NLP can analyze user feedback, survey responses, and documentation, identifying common themes and customer needs with minimal manual intervention. For example, AI models can categorize requirements by priority or importance using sentiment analysis and entity recognition, ensuring that critical features receive attention first [150]. AI-powered chatbots further support interactive requirement gathering by capturing detailed customer preferences in real time, allowing stakeholders to communicate needs directly to the development team [151]. These tools help to ensure comprehensive requirement coverage, reducing misunderstandings and misaligned expectations later in development. NLP tools also help with consistency and conflict resolution by automatically detecting ambiguities or contradictions within requirement documents, allowing teams to clarify issues early in the SDLC [152].

During the design stage, AI applications focus on improving architecture and code structure, providing suggestions for efficient and robust designs. AI-based code generation and program synthesis tools offer pre-built templates, code structures, and design patterns that align with industry standards. For example, platforms such as GitHub Copilot and Amazon CodeWhisperer leverage large language models (LLMs) to assist developers by recommending modular design patterns and architectural frameworks based on functional requirements [153,154]. This not only speeds up the design process, but also enhances consistency in code structure. In addition, AI tools improve the quality of the design by identifying potential structural flaws in the codebase. AI-powered bug detection and code quality enhancement tools provide insight into logical inconsistencies or security vulnerabilities in the design phase [155,156]. These tools analyze design artifacts and preliminary code structures, ensuring that design choices adhere to best practices and are less likely to introduce errors at later stages. This AI-driven approach to design validation improves the overall robustness of software systems.

In the development stage, AI significantly enhances the efficiency and quality of the coding. Automation in coding tasks reduces repetitive work, and machine learning models automate code generation, error detection, and refactoring. Genetic algorithms, neural networks, and transformer-based models such as GPT-3 assist developers by generating code snippets and suggesting fixes for code smells and inefficiencies [157,158,159]. This automation minimizes manual intervention, helping developers keep focus on high-value coding activities. AI-driven code generation and program synthesis tools continue to play a central role in implementation, offering code suggestions based on previous successful implementations. These models interpret user input and generate functionally complete code, enhancing productivity. Different test and metric-based methods assess AI-generated code to ensure quality and accuracy. New approaches like CodeScore are more concerned with functional accuracy than traditional metrics [160,161,162]. This allows developers to confidently incorporate AI-generated code into projects without compromising quality. Real-time defect prediction further assists during development by analyzing code in progress to identify areas prone to errors. AI-based defect prediction models detect potential issues in the codebase, allowing developers to resolve them early and avoid costly rework. For example, machine learning models continuously monitored code changes, accentuating high-risk segments that could require closer inspection, thus streamlining the debugging process and improving code reliability [163].

Testing is one of the most impactful areas for AI applications within the SDLC. Software testing benefits from AI through automated test case generation, prioritization, and regression testing. By analyzing historical test results, machine learning models generate targeted test cases that focus on high-risk areas, reducing time and resource expenditure [164,165]. Reinforcement learning algorithms have shown effectiveness in dynamically prioritizing test cases, adjusting execution based on previous failure patterns to ensure critical areas are rigorously tested. AI-driven automation also simplifies regression testing, particularly in continuous integration environments. By identifying code segments likely affected by recent changes, AI prioritizes testing efforts to focus on these segments, ensuring that software updates do not introduce new bugs [166]. This prioritization ensures efficient test coverage without redundant efforts, which is especially valuable in large, complex systems. Bug detection and code quality enhancement during testing is heavily relying on AI-driven static and dynamic code analysis tools. These tools identify code logic issues, performance bottlenecks, and security vulnerabilities before deployment. For example, the study of [167] shows that AI models analyze the structure, logic, and execution paths of the code to detect anomalies, which in turn helps developers achieve a higher standard of quality before the software reaches users.

In the deployment phase, AI plays a critical role in facilitating smooth transitions from development to production through automation in continuous integration and continuous deployment (CI/CD) pipelines. Ref. [168] mentioned that reinforcement learning models are used to prioritize test cases within CI/CD frameworks, dynamically adjusting the test execution order based on identified risks from previous tests. This targeted prioritization ensures that high-risk code segments are thoroughly evaluated prior to deployment, which helps reduce the chances of critical failures in production. As noted in the study conducted by [169], reinforcement learning-based CI/CD tools adapt to changing project needs, thus minimizing downtime and improving software reliability. This adaptability makes AI-driven CI/CD pipelines particularly valuable in agile development environments where frequent updates and rapid deployments are the norm. AI also improves the efficiency of deployment by continuously monitoring and analyzing system performance, detecting potential problems early in the deployment process [170]. For example, AI-based anomaly detection models in CI/CD environments analyze metrics such as response time, resource utilization, and error rates to identify unusual patterns that may signal underlying issues. This real-time feedback allows teams to proactively address issues before they impact end users, ensuring a stable deployment. As outlined by [171], such predictive capabilities are especially beneficial in native cloud applications, where scaling and resource allocation must be continuously optimized. AI-driven monitoring tools can dynamically adjust the infrastructure based on anticipated demand, thus reducing latency and maintaining performance even during peak loads.

In the maintenance phase, AI provides continuous monitoring and predictive capabilities to address issues proactively, helping to reduce downtime and maintain software performance over time. AI-driven bug detection and code quality enhancement tools monitor applications in real time, identifying code anomalies, security vulnerabilities, and performance issues as they arise [155,156]. These tools employ machine learning algorithms to analyze system metrics, such as response times, error rates, and resource usage patterns, enabling the detection of subtle emerging problems before they escalate. For instance, models trained on historical bug data and system usage patterns can detect recurring issues or new patterns indicative of potential defects, ensuring that maintenance efforts are prioritized for the most pressing concerns. Ref. [170] shows that continuous monitoring allows developers to act quickly on issues, minimize impact on end users, and support high availability. In addition to monitoring, defect prediction models provide critical insight during maintenance by forecasting which parts of the code are likely to experience degradation or require updates. These AI models use historical data, including past bug reports and system logs, to predict high-risk areas in the code that may require proactive maintenance. For instance, machine learning models in maintenance environments can prioritize code segments that exhibit patterns of instability, allowing teams to preemptively address issues [172]. Such predictive maintenance approaches help optimize resource allocation by focusing efforts on areas with the highest probability of failure, thus preventing sudden breakdowns and prolonging the useful life of the system. In addition, AI-powered self-healing systems are an emerging trend, where models can autonomously identify, isolate, and resolve minor issues, further reducing the need for human intervention [173]. This proactive approach not only reduces manual workload but also improves software reliability, setting the stage for increasingly autonomous and resilient software ecosystems.

Table 5. Examples of AI tasks across different SDLC stages.

SDLC Stage	AI Tasks	Description
Planning and requirement analysis	Sentiment analysis	Prioritizes requirements based on user sentiment [174].
	Entity recognition	Identifies critical requirements and themes [175].
	Requirements extraction	Extracts structured insights from unstructured data [176].
	Chatbots for interactive requirement gathering	Facilitates real-time user interaction for requirements gathering [151].
Design	Consistency and conflict resolution (NLP-based consistency checks)	Automatically detects ambiguities, contradictions, and redundancies in requirement documentation [177,178].
Development	Language models for code suggestion	Uses language models for code and structure suggestions [153,154].
Testing	Automated test case generation (using NLP for code analysis)	Generates relevant test cases from requirement descriptions or code comments, reducing manual testing efforts [166].
Deployment	Continuous feedback analysis	Collects and analyzes feedback on deployments to detect issues early [169,171].
	Chatbot Support for continuous deployment	Assists users and developers during deployment with real-time support [151].
Maintenance	Sentiment analysis on user feedback	Analyzes feedback sentiment for prioritizing maintenance [170].
	Defect prediction (using NLP on logs and reports)	Predicts defects by analyzing logs and reports for potential issues [172].

summarizes some AI methods and their contributions in the different stages of SDLC.

Despite AI’s advancements in software development, several challenges and limitations persist. One primary challenge is the test oracle problem in AI-driven testing, where determining correct outputs is difficult due to the black-box nature of AI [179]. In complex models, the expected outcomes are often unclear, complicating validation efforts and increasing reliance on human verification. Ref. [179] highlight this limitation, especially when AI models operate with minimal transparency, making it difficult for developers to establish robust testing criteria. Another significant issue is data quality and diversity, particularly in defect prediction and CI/CD pipeline models [155]. Predictive models are highly dependent on the quality and scope of their training data, and biases or limitations within these datasets can result in unreliable outcomes. This concern is noted in the study of [180], which underscores the need for high-quality representative datasets to avoid biased predictions that could negatively impact software quality. Addressing these limitations requires an emphasis on data governance and bias mitigation techniques to ensure that AI models are built on comprehensive, diverse data. Emerging research suggests that explainable AI (XAI) will play a pivotal role in addressing transparency issues, particularly for applications in high-stakes software systems where understanding AI-driven decisions is essential. For example, refs. [140,181,182] discuss how XAI can help bridge the interpretability gap, potentially mitigating the test oracle problem by making the model output more understandable. In addition to XAI, AI-driven DevOps is also expected to evolve with increasingly sophisticated real-time feedback and monitoring systems, enabling autonomous adjustments to deployment parameters. This trend aligns with the findings of [170], where feedback mechanisms allow real-time adjustments in CI/CD workflows, ensuring continuous stability and efficiency.

Hybrid AI approaches, which combine rule-based and machine learning methods, offer promising improvements to handle complex edge-case scenarios. The research of [172] points to the potential of hybrid approaches that improve the robustness of the model by integrating structured rules-based logic. In addition, self-healing systems represent an innovative direction, where AI autonomously identifies and corrects problems, reducing the reliance on manual interventions during the maintenance phase. Early studies suggest that self-healing capabilities can streamline operations, particularly in large-scale applications with critical uptime requirements [173,183]. Finally, as ethical considerations gain importance, regulatory frameworks and ethical AI practices will become essential in guiding AI deployment within software development [184,185,186]. The importance of transparency, fairness, and accountability in AI-driven systems should be highlighted, especially since AI assumes more autonomous roles in software engineering. This focus on ethical standards and regulatory compliance will ensure that AI applications not only enhance efficiency but also adhere to standards that prioritize user safety and ethical integrity.

Table 6. Comparative synthesis of AI in software development.

Reference & Task	Dataset(s)	Model Family	Headline Metric	Limitations
[149]: Defect prediction for Android apps	PROMISE, NASA MDP, Eclipse, AEEEM, UCI, GitHub	LR, NB, SVM, DT, RF, ANN, DNN, CNN, RNN, DBN, TL, K-means	Acc. 69.46–99.99%; metrics: Acc., Prec., Rec., AUC	Imbalanced/noisy data, cross-project shift, poor generalizability, defect-type specificity.
[150]: Feature request detection in app reviews	150k+ app reviews (Google Play, App Store; 137k processed, 14k labeled)	BiLSTM + Attention + LIME/SHAP (baselines: SVM, CNN, LSTM)	Acc. 89%, F1 = 0.82, Prec. 0.79, Rec. 0.86; +27% dev. trust, +73% interpretability	English-only, small developer study, limited deployment, LIME/SHAP scalability issues.
[153]: AI-powered code generation efficiency	Open-source repos, PROMISE-style; 3 industry case projects (A–C)	Rule-based, ML (Reg/Clf), RNN, LSTM, Seq2Seq, GNN, GANs, Transformers (BERT, GPT)	Dev. time reduced 20–38%; bug reduction 40–50%; +25–35% review efficiency; 70% efficiency, 60% quality gain (survey)	Repo bias, interpretability issues, domain adaptation, ethical concerns.
[155]: Defect-introducing defect prediction testing (DPTester)	Recoder dataset (594k labeled Java snippets)	Transformers: CodeBERT, CodeT5+	222k tests (99% valid); Acc. drop: 43% (CodeT5+), 30% (CodeBERT); 0.002 s/test, 0.025 s/issue	Limited to Java/Recoder, 2 models only, conditional logic focus, parser bias.
[156]: Bug detection in OSS with LLMs	Aegis Authenticator, Seafile (4 bugs identified)	LLMs: GPT-3.5, Gemini, Kimi, Llama, ERNIE Bot, Tongyi Qianwen	GPT-3.5/ERNIE Bot: 4/4 bugs; Kimi/Llama: 3; Gemini/Tongyi: 2	Tiny scale (2 apps, 4 bugs), manual bug selection, limited generalizability, API dependence.
[158]: Efficient code classification (EarlyBIRD)	Devign (C/C++ vulns), ReVeal (C/C++ vulns), BIFI (Python errors), Exception Type (Python exceptions)	CodeBERT (12-layer encoder, early-layer pruning)	+2.0 Acc. (Devign, 3.3 × faster); +0.8 Acc. (ReVeal, 3.7 × faster); BIFI 96.7 → 95.0% (2.1 × faster)	CodeBERT-specific, only C++/Python, weaker on multi-class, hardware-dependent.
[159]: Automated test data generation (GA)	2 synthetic SUTs (conditions/loops); no public benchmarks	Genetic Algorithm (enhanced fitness: path complexity + diversity)	100% stmt. coverage (SUT1, pop = 20); ≥98% (SUT2, pop ≥ 10); fastest conv. pop = 40; optimal k = 10	Only synthetic SUTs, statement coverage only, high comp. cost for large pops, empirical tuning.
[163]: Defect prediction in telecom projects	Telecom dataset (9 projects, 10 releases; static metrics + defect logs); PROMISE subset	Naïve Bayes (static metrics + version history flags)	Avg. PD = 87%, PF = 26%; 72.5% inspection reduction; 44% fewer post-release defects	High false alarm rate, requires defect history, domain-specific calibration, single-company case.
[167]: Auto inspection of static bug warnings (Llm4sa)	Juliet C/C++ suite; 3 embedded OSes; 11 OSS projects (gawk, tiff, binutils, bash, grep, etc.)	LLMs (ChatGPT-3.5, Llama-2-70B) + static analyzers (Cppcheck, CSA, Infer)	79.5% Acc., Prec. 88.4%, Rec. 95.1% (Juliet); warnings reduced 38–54%; <30 s/warning, $0.31 cost	Weak on ML/BOF bugs, struggles with long flows, LLM randomness, API cost scaling, data leakage risks.

offers a comparative mini-synthesis of software-development-related studies, tabulating specific tasks, datasets, model families, headline metrics, and dataset limitations.

5. Advances of AI in Cybersecurity

The importance of cybersecurity has increased greatly in recent years as organizations and individuals have become part of a digitally interconnected world [187]. The complexity and sophistication of modern cyber threats have outpaced traditional defense mechanisms. The need for new and fresh approaches capable of adapting and evolving to keep up with threats is more evident. The integration of AI into cybersecurity has spurred a paradigm shift, transitioning from static, rule-based defenses to dynamic, adaptive systems capable of detecting and mitigating sophisticated cyber threats in real time. AI techniques, particularly machine learning (ML), deep learning (DL), and reinforcement learning (RL), have been increasingly applied to domains such as intrusion detection, phishing prevention, malware classification, and behavioral analytics. In a diverse set of recently published studies, as illustrated in

Table 7. Representative AI-based results in cybersecurity with datasets, best-performing approaches, reported metrics, and dataset limitations.

Reference & Threat Class	Dataset(s)	Best Approach	Reported Metrics	Dataset Limitations
[188]—Intrusion detection	NSL-KDD	CNN	Acc = 84.21%	Outdated; redundant records; not representative
[188]—Intrusion detection	UNSW-NB15	CNN	Acc = 92.42%	testbed traffic; class imbalance.
[189]—Intrusion detection (Anomaly)	CCD-IDSv1	CART	Acc, Prec, Rec, F1 = 1.00	Undersampled; synthetic testbed
[189]—Intrusion detection (Multi-attack)	CCD-IDSv1	CNN-LSTM	Acc = 96.62%; F1 = 0.93	Rebalanced classes; limited transfer.
[190]—Intrusion detection (Multi-class)	CICIDS2017	Random forest	Acc = 99.88%; F1 = 97.46%	Synthetic; severe imbalance; SMOTE weak.
[191]—Intrusion detection (Binary)	NSL-KDD	CNN	Acc = 99.38%; F1 = 99.35%	Outdated; lacks modern threats.
[191]—Intrusion detection (Multi-class)	NSL-KDD	CNN	Acc = 99.43%; F1 = 99.43%	Outdated; lacks modern threats.
[191]—Intrusion detection (Binary)	UNSW-NB15	CNN	Acc = 99.30%; F1 = 97.66%	Controlled testbed; limited realism.
[191]—Intrusion detection (Multi-class)	UNSW-NB15	CNN	Acc = 98.00%; F1 = 97.74%	Controlled testbed; limited realism.
[192]—Threat detection (General)	Cybersecurity Attacks Dataset	Random forest	Acc = 99.7%; F1 = 99.6%	Proprietary; small; limited transparency.
[192]—Threat detection (WSN)	WSN-DS	Inception (GoogleNet)	Acc = 33%; F1 = 49%	Synthetic; extreme imbalance; low precision.
[193]—Intrusion detection (DDoS)	CICIDS2018	Random forest	Acc = 99.92%; F1 = 99.87%	Synthetic; imbalanced; RF less interpretable.
[194]—Threat detection (general)	Case studies (unspecified)	Neural networks	Acc = 98%; FPR = 1%	No standard dataset; reproducibility issues.
[195]—Phishing detection	Mixed (logs, simulations)	Predictive analytics	Det.Rate = 94.44%; FPR = 1.39%	Non-standard; lab conditions.
[195]—Ransomware detection	Mixed (logs, simulations)	Predictive analytics	Det.Rate = 92.31%; FPR = 3.23%	Non-standard; lab conditions.
[195]—DDoS detection	Mixed (logs, simulations)	Predictive analytics	Det.Rate = 90.00%; FPR = 4.26%	Non-standard; lab conditions.
[195]—APT detection	Mixed (logs, simulations)	Predictive analytics	Det.Rate = 85.71%; FPR = 11.76%	APTs underrepresented; high FP.
[195]—Malware detection	Mixed (logs, simulations)	Predictive analytics	Det.Rate = 86.67%; FPR = 4.41%	Non-standard; lab conditions.
[196]—Intrusion and DDoS detection	Multiple (NSL-KDD, UNSW-NB15, etc.)	Autoencoder	NSL-KDD: 99.2%; UNSW-NB15: 99.5%	Synthetic/testbeds; overfitting risk.

, AI-driven cybersecurity systems demonstrate significant improvements in detection accuracy, prediction capabilities, and operational efficiency compared to traditional methods.

To contextualize these advances within real-world performance, recent head-to-head evaluations have directly compared optimized classical machine learning models (such as random forest, XGBoost, and ExtraTrees) with leading deep learning architectures (CNNs, LSTMs, and CNN-LSTM hybrids) in modern cybersecurity datasets. In CIC-IDS2017 and custom CCD-IDSv1 datasets, for example, random forest and XGBoost achieved more than $95\%$ precision for intrusion detection [188,189]. This was on par with CNNs, the only difference being that they required fewer parameters and shorter training times. In contrast, deep models excel when dealing with high-dimensional, sequential, or unstructured data, routinely setting state-of-the-art benchmarks in raw packet streams and flow-sequence analyses, when labeled data are available [190,191]. Classical ML models retain clear advantages in computational efficiency, whereas DL approaches require more resources and can be prone to overfitting if rigorous feature engineering is not applied [192]. Hybrid and ensemble strategies seem to offer credible alternatives as they consistently boost overall detection robustness, particularly in various scenarios [188,193]. Ultimately, there is no universally recognized “ideal” model as it is clearly dependent on multiple requirements including dataset characteristics and deployment constraints.

Building on the aforementioned comparative benchmarks, several systematic and experimental studies provide more robust empirical evidence. The authors in [194] present a comprehensive review showing that neural networks used in threat detection can achieve up to $98\%$ precision, with additional case studies reporting high success rates in phishing detection. Critically, this paper contrasts AI results with legacy techniques such as firewalls and signature-based intrusion detection systems, revealing improvements not only in detection rates, but also in adaptability. These findings are further reinforced by the empirical results presented in [195] through statistical benchmarking: their predictive AI system reported a $94.44\%$ phishing detection rate and $90\%$ predictive accuracy in forecasting threats. These results were derived against multiple attack vectors, encompassing phishing, DDoS, and ransomware. Further comparative analyses in [196] highlight performance improvements in accuracy and recall across AI-powered detection mechanisms, validated through multiple case studies. In particular, ref. [197] documents widespread evidence for the ability of AI to detect new threats and reduce human error, although they also observe a persistent gap in model robustness, particularly in adversarial environments. Despite these advances, several challenges persist. Numerous studies point to the vulnerabilities of AI systems in adversarial examples, poor-quality training data, and system scalability issues [6,194,195]. For example, ref. [6] notes that while the accuracy of intrusion detection can reach $99\%$, the opacity of the model and the susceptibility to evasion remain key concerns. Several articles attempt to bridge these gaps by exploring future trends and mitigation strategies. These include federated learning for collaborative defense that preserves privacy [198,199], explainable AI for improving trust [200], and reinforcement learning models for autonomous threat mitigation systems [194,195,201]. However, while such studies often highlight the potential of these emerging techniques, many do not present statistically verified performance results or long-term deployment evaluations, indicating a need for more longitudinal and empirical research in the real world. In summary, the reviewed literature confirms that AI represents a significant advancement in cybersecurity, providing measurable performance improvements in threat detection and response optimization over traditional systems.

Even though much of the literature highlights AI’s defensive proficiency, it should not be understated that AI is also advancing offensive cyber capabilities, showcasing its dual-use nature. Recent studies show that AI techniques once designed for defense are now being weaponized by attackers for automated exploit generation and malware creation. IBM’s DeepLockerprototype is an example that showed how malicious payloads could be concealed with deep learning until triggered by a specific face or geolocation, while an algorithm named MalGAN is another example that showed how generative adversarial networks could be leveraged to produce malware variants capable of evading ML-based detection [12]. Similarly, generative models such as ChatGPT have shown the ability to produce malicious code (SQL injection payloads, and full ransomware strains resembling WannaCry, REvil, etc.) when jailbroken or manipulated by attackers via prompt injection [202]. Iterative prompting by those same attackers allowed the generation of malware capable of bypassing antivirus defenses through constant mutation; such malware is called polymorphic malware. Such misuse of LLMs could accelerate the implementation of a cyber offense arsenal for attackers. Dark web tools such as WormGPT and FraudGPT are even further proof of LLM’s misuse as they offer commercialized offensive chatbots trained on malicious datasets, produce scam webpages, and customize phishing emails on demand [203]. AI techniques also played a part in the increased potency of social engineering as the authors in [23] reported a 135% spike in novel phishing attacks, right after the release of ChatGPT in 2022, while [204] also documents how pig butchering scams are being used to deceive victims at scale by exploiting AI-driven messaging automation, real-time translation, and deepfake voice/video. In addition, generative AI itself has been central to these developments, and used as a tool for disinformation and impersonation campaigns. For example, deepfake voices and videos are being used to mimic CEOs or public officials, which adds credibility to scams and enables manipulation at scale [23,203,204]. Collectively, these examples exhibit the dual nature of AI as a defensive asset, but also a powerful enabler of offensive cyber operations.

Equipped with the empirical evidence presented above, we now structure our analysis around the continuous cybersecurity lifecycle illustrated in Figure 3, to explore how AI improves each phase. The cybersecurity lifecycle is a continuous process for protecting digital assets and managing risks. The five interconnected phases (prevention, monitoring and detection, initial response, attack analysis, and recovery response) represent a comprehensive approach to managing cyber threats, emphasizing proactive, adaptive, and holistic solutions [205]. By examining these phases, we illustrate how AI empowers organizations to prevent vulnerabilities, counter attacks, and continuously strengthen their defenses.

5.1. Prevention

The increasing complexity of cyber threats has driven the development of advanced predictive analytics and AI as critical tools for proactive defense. The prevention phase leverages these technologies to anticipate and mitigate risks before they become active threats. By enabling organizations to implement preemptive measures against sophisticated attacks, AI and machine learning (ML) have redefined the strategies employed to secure modern systems. ML techniques, particularly supervised models, enable organizations to proactively identify system vulnerabilities and implement targeted defenses before threats materialize, while unsupervised approaches aid in uncovering patterns that inform preventive strategies in dynamic environments [206,207,208]. For instance, intrusion detection systems (IDS) in critical infrastructure environments benefit significantly from supervised learning models, such as random forest, which reduce false positives and detect anomalies with high precision. Using scalable and adaptable ML approaches, these systems ensure robust real-time security for sensitive operations [187,206]. AI also plays a pivotal role in the protection of other high-stakes domains, such as robotics, autonomous systems, and intelligent networks. Predictive analytics, combined with anomaly detection techniques, allow organizations to identify irregularities in data traffic and system performance, preventing potential exploitation. For example, robotic networks operating on the Robot Operating System (ROS) employ advanced anomaly detection to secure communication channels and maintain operational integrity [9]. This proactive capability observed in robotic networks also extends to intelligent networks and industrial control systems. The combination of signature-based approaches that identify known threats and anomaly-based methods capable of detecting novel attack patterns ensures complete protection against vulnerabilities that could otherwise compromise operational safety and reliability [206]. These AI-driven applications are critical to maintaining the uninterrupted operation of interconnected systems that form the backbone of industries and essential public services. Building on these applications, AI enhances prevention strategies through broader approaches such as reinforcement learning and bio-inspired techniques, which optimize defenses for dynamic and evolving threats. Reinforcement learning models such as the DRL-NARPP framework enhance network awareness by continuously adapting to evolving threat landscapes and reconfiguring security measures such as firewalls to address vulnerabilities [208]. Meanwhile, bio-inspired algorithms, such as artificial immune systems (AIS) and swarm intelligence, emulate natural defense mechanisms to identify subtle anomalies in interconnected networks [209,210]. These techniques improve the resilience of cybersecurity systems by enabling cooperative and decentralized responses to threats, ensuring system integrity in highly complex environments. Some applications discussed are summarized in

Table 8. Examples of AI tasks, techniques, and tools in the prevention phase.

Task	Techniques and Tools	Description
Intrusion detection in critical systems	Supervised ML (random forest)	Reduces false positives and identifies anomalies to protect critical infrastructures [206].
Predictive analysis for robotics	Anomaly detection, neural networks	Secures robotic networks by identifying irregularities in communication protocols and sensor data [9].
Dynamic defense via RL models	Reinforcement learning (DRL-NARPP)	Enhances adaptability by reconfiguring firewalls and access controls based on evolving threats [208].
Bio-inspired anomaly detection	Artificial immune systems (AIS), swarm intelligence	Identifies subtle anomalies through decentralized and cooperative responses [209,210].
Hybrid detection systems	Combination of signature-based and anomaly-based methods	Addresses vulnerabilities in smart grids and industrial systems, ensuring safety and reliability [9].

, providing a concise overview of AI’s transformative role in proactive cyber defense.

These advancements demonstrate that AI is not merely a tool for identifying existing vulnerabilities, but a transformative force in redefining how organizations approach cybersecurity. By combining predictive analytics, adaptive models, and scalable solutions, AI establishes a solid foundation for proactive defense while addressing critical gaps. However, overcoming challenges like scalability, data quality, and regulatory compliance is essential to fully realizing AI’s potential in the prevention phase. As threats continue to grow in complexity, AI’s role in prevention will remain indispensable for ensuring resilience and adaptability in the digital age. Despite significant advancements, AI-powered prevention strategies face several challenges. Scalability remains a critical issue, particularly in IoT networks and global supply chains, where models often struggle to process large and diverse datasets effectively [211]. Furthermore, obtaining high-quality labeled data for training systems and the need for compliance with regulatory frameworks such as GDPR add complexity to the implementation of AI-driven prevention strategies [212]. Adversarial attacks targeting AI models, such as data poisoning and manipulated input, compromise the reliability of preventive measures [9]. Finally, reinforcement learning and bio-inspired systems, while effective, often lack transparency, making it difficult for security teams to trust and adopt these technologies [208].

5.2. Monitoring and Detection

The monitoring and detection phase represents a critical component of the cyber defense lifecycle, focusing on identifying threats as they emerge and mitigating their impact in real time. AI technologies have revolutionized this phase, enabling enhanced threat visibility, anomaly detection, and dynamic responses to malicious activities. Using ML algorithms, anomaly detection systems, and advanced behavioral analytics, organizations can detect and neutralize cyber threats before they escalate into significant incidents [198,213]. Modern AI-powered detection systems excel at identifying and mitigating threats in network environments. For instance, supervised learning methods, including random forest, gradient boosting, and related techniques, have been widely adopted to classify network traffic and flag malicious activities in real time [211,213]. On the CICFlowMeter dataset with Metasploit-injected attacks, random forest, SVM, CNN, and RNN achieved 92–98% accuracy, with GAN-based augmentation, further improving robustness against zero-day threats [198]. Similarly, in [213], LightGBM applied on the CyberLab Honeypot dataset demonstrated higher performance, reaching 99.2% accuracy and 99.8% recall. These models distinguish between normal and abnormal behaviors, using large datasets to provide accurate and efficient threat detection. Complementing these models, anomaly detection algorithms uncover deviations from established baselines, making them effective against novel threats such as zero-day exploits or insider attacks [26,207,213]. These algorithms not only detect but also adapt to emerging attack patterns, ensuring continuous protection in dynamic environments. Behavioral analytics further enrich this phase by addressing sophisticated social engineering threats such as phishing and pig butchering scams. For example, detecting manipulative language patterns in emails or unusual transaction behavior has been proven effective in preempting fraud and scams [207]. In high-risk sectors such as finance, these capabilities ensure critical resources remain safe from exploitation. Additionally, AI models have been deployed to analyze patterns in cryptocurrency transactions, identifying fraudulent behaviors and preventing significant financial losses [204].

With the rise of cyber-physical systems (CPS) and IoT, the scope of monitoring and detection has expanded. Adaptive deep learning models analyze sensor data and detect deviations indicative of tampering or unauthorized access [9,211]. For instance, on the NSL-KDD dataset, hybrid feature-selection approaches achieved 85.8% accuracy, 86.8% recall, and 88% precision. Meanwhile, a wavelet-based Hebbian neural network performed just as well, reaching a 95% true negative rate and a 73% true positive rate while applied on the UNSW-NB15 dataset. Similarly, a hybrid IDS applied on the MIT/Lincoln Lab dataset reached 60% detection with only 3% false positives, outperforming other IDS such as Snort and Bro [9]. Advanced ML models detect subtle deviations in user activity, such as privilege escalation or data exfiltration, providing organizations with early warnings and opportunities for intervention [213]. A comprehensive overview of some AI applications in this phase is provided in

Table 9. Examples of AI tasks, techniques, and tools in the monitoring and detection phase.

Task	Techniques and Tools	Description
Real-time traffic analysis	Supervised learning (random forest, gradient boosting)	Classifies network traffic to identify and mitigate malicious activities with high accuracy [211,213].
Zero-day threat detection	Unsupervised anomaly detection	Detects novel threats by identifying deviations from behavioral baselines, addressing zero-day exploits [26,213].
Behavioral analytics for social engineering	NLP, sentiment analysis	Analyzes communication patterns to preemptively identify phishing scams and fraud attempts [207].
Threat intelligence integration	Global threat databases (MITRE ATT&CK, CVE)	Maps indicators of compromise (IoCs) to predict attack vectors and enhance situational awareness [213].
IoT device monitoring	Federated learning, deep learning	Scales monitoring across distributed IoT environments while preserving data privacy [9,211].
Insider threat detection	Behavioral profiling, neural networks	Continuously monitors user activity to detect privilege escalation and unauthorized access [213].
DDoS attack mitigation	Traffic pattern analysis	Detects and neutralizes distributed denial-of-service (DDoS) attacks in real time [213].
Cryptocurrency fraud detection	Pattern recognition models	Identifies fraudulent activities in cryptocurrency transactions [204].

, which summarizes different tasks, AI techniques, and tools.

AI has transformed the monitoring and detection phase by integrating adaptive learning, real-time analytics, and comprehensive threat intelligence. These advances provide unparalleled capabilities for identifying and mitigating cyber threats in diverse environments. However, addressing challenges such as scalability, false positives, and adversarial risks is essential to maximize the effectiveness of these technologies. As cyber threats continue to evolve, innovations in monitoring and detection will remain key to ensuring resilient and adaptive cybersecurity defenses. Despite significant advancements, the monitoring and detection phase faces critical challenges. Scalability remains a pressing issue, particularly in IoT ecosystems with heterogeneous devices and large data volumes [9,211]. The high frequency of false positives in AI-powered detection systems requires continuous fine-tuning and the integration of explainability frameworks to improve trust and operational efficiency [26,213]. Adversarial attacks, such as evasion techniques, pose another challenge by altering malicious behaviors to bypass detection systems [213]. Furthermore, maintaining transparency and interpretability in AI systems is crucial, especially in high-stakes industries where errors can have significant consequences [213]. Finally, reliance on high-quality and diverse datasets to train detection models raises concerns about data availability, bias, and the risk of overfitting [207,211].

5.3. Initial Response

The integration of AI into cybersecurity has transformed the way organizations address the initial response to security incidents. This phase focuses on detecting, analyzing, and containing cyber threats before they escalate. Traditional methods, often reliant on manual workflows and static rules, struggle to cope with the rapid pace and complexity of modern cyberattacks. AI addresses these limitations by enabling real-time decision making, automating critical tasks, and improving response accuracy. AI-powered frameworks provide significant advances in initial response processes. Ref. [214] stated that in environments like smart grids, AI planning frameworks such as Plan2Defend orchestrate end-to-end workflows, from anomaly detection to executing response actions. This model prioritizes incidents according to the severity of the anomaly, ensuring timely mitigation of false data injection attacks (FDIA) and man-in-the-middle (MitM) attacks [214]. Using a digital twin of the power grid for validation, Plan2Defend simulates attack scenarios to assess potential impacts and refine its decision-making processes. This validation ensures timely and precise responses, maintaining operational continuity and improving the reliability of the framework. In multi-cloud environments, AI-driven orchestration platforms enhance threat intelligence by integrating advanced analytical methods with existing security information and event management (SIEM) systems. These platforms improve the detection of anomalies, such as DNS exfiltration attacks, by leveraging machine-learning-based classification models that refine SIEM threat correlation and event management [215]. AI-driven orchestration also supports semantic security monitoring in federated cloud environments, allowing the integration of virtual security sensors that improve situational awareness in heterogeneous infrastructures [216]. These AI-enhanced capabilities improve the efficiency of cybersecurity monitoring and event analysis, ensuring that security teams can identify high-priority threats more effectively. AI systems improve situational awareness by correlating data from disparate sources, such as network logs, user behaviors, and system activities, to build a comprehensive view of potential incidents. For example, real-time anomaly detection using recurrent neural networks (RNNs) provides actionable information, enabling the rapid containment of advanced persistent threats (APTs) [217]. Machine learning models such as neural networks further enhance the initial response by classifying threats and suggesting mitigation strategies. These models demonstrate improvements in false positive rates, significantly enhancing response efficiency.

Table 10. Examples of AI tasks, techniques, and tools in the initial response phase.

Task	Techniques and Tools	Description
Real-time anomaly detection	Neural networks (CNNs, RNNs)	Improves detection accuracy and reduces reaction time, enabling rapid containment of threats [217].
Automated incident triage	Supervised learning (SVM, RF)	Prioritizes incidents based on severity, reducing analyst workload and improving resource allocation [218].
Multi-layered response orchestration	AI planning, SOAR playbooks	Ensures consistent and coordinated actions across complex systems, streamlining response workflows [214].
Predictive threat analysis	Reinforcement learning (DRL)	Anticipates threats and dynamically optimizes defense strategies based on evolving attack patterns [219].
Cloud and multi-cloud security orchestration	AI-driven orchestration frameworks, virtual security sensors	Facilitates threat correlation and adaptive security responses across federated cloud infrastructures, ensuring seamless monitoring and integration with distributed environments [216].

lists some AI tasks, techniques, and tools employed in this phase.

AI-powered initial response frameworks represent a paradigm shift in cybersecurity, enabling faster and more effective responses to modern cyber threats. By automating critical tasks, improving situational awareness and facilitating real-time decision making, these systems significantly improve the speed and accuracy of incident handling. Addressing challenges such as adversarial attacks, false positives, and integration complexities is essential to maximize their effectiveness. As AI technology evolves, its role in proactive and adaptive incident response will become increasingly pivotal in safeguarding digital infrastructures. Despite its transformative potential, AI-driven initial response systems face notable challenges. The adversarial manipulation of AI models represents a significant threat, where attackers exploit vulnerabilities in machine learning systems to avoid detection or trigger false alarms. Addressing this challenge requires advanced adversarial training techniques and the integration of XAI to improve the transparency and robustness of the model [220]. False positives remain a persistent operational challenge. Although AI systems are designed to minimize these occurrences, errors can still occur, leading to unnecessary disruptions and alert fatigue among security analysts. Correlation analysis and contextual evaluation are critical to ensure that AI-driven alerts focus on real threats, reducing the risk of overlooking critical incidents. AI systems also heavily depend on high-quality training datasets. When faced with novel threats or incomplete data, their performance may degrade, requiring continuous updates and refinements [218]. In addition, integration of AI systems with existing cybersecurity infrastructure poses compatibility challenges. Many organizations rely on legacy systems that may not support seamless interoperability with modern AI-driven platforms. Ensuring real-time processing capabilities while maintaining compatibility requires significant investment in infrastructure and technical expertise.

5.4. Attack Analysis

The attack analysis phase focuses on uncovering the root causes, methodologies, and impact of cyber incidents, providing critical insights to refine defenses and mitigate future risks. Using AI techniques, organizations can systematically dissect attack patterns, identify vulnerabilities, and derive actionable intelligence to strengthen cybersecurity frameworks. AI excels at reconstructing attack sequences and identifying the operational tactics of malicious actors. For example, ML algorithms analyze extensive logs and network traffic data to correlate events and trace the origins of breaches. Ref. [213] documents that on the CyberLab Honeypot dataset, LightGBM performed very well in correlating malicious activities to their sources, outperforming random forest and KNN with a produced accuracy of 99.2% and recall of 99.8%. These capabilities are particularly valuable for detecting advanced persistent threats (APTs), which often span long durations and involve subtle coordinated actions. Similarly, ensemble approaches including random forest and XGBoost have been evaluated on benchmark datasets, including NSL-KDD for intrusion detection and NGSIM for cooperative traffic systems, showcasing their adaptability for reconstructing complex attack sequences [211].

XAI systems further enhance this process by providing transparency in decision-making steps, allowing security teams to pinpoint the exact mechanisms exploited by attackers [26]. NLP has become a cornerstone in the analysis of phishing schemes and social engineering scams. For example, in pig butchering scams, NLP-driven AI models analyze chat logs, emails, and transaction histories to uncover manipulation tactics employed by cybercriminals. Sentiment analysis tools identify emotional triggers and persuasion techniques, helping organizations understand how victims were coerced into compromising security protocols [204]. These insights not only illuminate individual attack instances, but also contribute to a broader understanding of social engineering strategies. Threat intelligence platforms integrated with AI improve the ability to correlate incidents with global threat databases. By mapping indicators of compromise (IoC) and leveraging frameworks like MITRE ATT&CK, AI systems identify recurring attack patterns and predict future attack vectors. For example, AI-enabled forensic tools analyze malware behavior, such as obfuscation techniques and payload delivery methods, to classify malicious files and determine their origins [26]. This proactive analysis informs updates to defense mechanisms, equipping organizations to address similar threats more effectively. AI-driven automation accelerates the identification of vulnerabilities and enables a rapid response to mitigate damage. Techniques such as graph-based analysis model complex attack scenarios, revealing interconnected pathways exploited by attackers. These insights allow organizations to prioritize remediation efforts and fortify systems against similar exploits in the future [211].

Table 11. Examples of AI tasks, techniques, and tools in the attack analysis phase.

Task	Techniques and Tools	Description
Forensic analysis	ML algorithms, log correlation tools	Analyzes logs and network data to trace attack origins, reconstruct attack sequences, and identify vulnerabilities [26,213].
Explainable forensics	Explainable AI (XAI) frameworks	Provides transparency into exploited mechanisms, enabling security teams to understand and address attack methodologies [26].
NLP for social engineering	NLP models, sentiment analysis tools	Analyzes chat logs, emails, and user interactions to uncover manipulation tactics in phishing and pig butchering scams [204].
Malware behavior analysis	Malware classifiers, behavioral models	Classifies malware based on obfuscation techniques and payload delivery methods, improving threat intelligence [26].
Graph-based attack modeling	Graph theory, visualization tools	Models complex attack scenarios to reveal interconnected pathways exploited by attackers, aiding in vulnerability prioritization [211].
Threat intelligence correlation	Threat intelligence platforms	Maps IoCs to global threat databases, identifying recurring attack patterns and predicting future vectors [26,213].
Sentiment and behavioral analysis	Sentiment analysis tools	Evaluates emotional triggers and behavioral patterns in social engineering cases to identify how security protocols were compromised [204].
Automated pattern correlation	Event correlation engines	Correlates events across disparate data sources to identify attack patterns and generate actionable insights for defense enhancements [211,213].

presents some AI tasks, techniques, and tools employed in the attack analysis phase.

AI-driven attack analysis has proven invaluable for identifying vulnerabilities, uncovering attack methodologies, and generating actionable insights. Using advanced tools such as NLP, graph-based analysis, and threat intelligence platforms, organizations can strengthen their defenses and anticipate future threats. Addressing challenges such as data quality, adversarial risks, and ethical concerns is critical for maximizing the potential of AI in this phase. With ongoing advancements, AI will continue to play a central role in refining cybersecurity strategies and enhancing resilience against sophisticated threats. Despite its significant contributions, the attack analysis phase faces several challenges. The increasing sophistication of attack techniques often outpaces the capabilities of existing AI tools, necessitating frequent updates and retraining of models to remain effective [26,213]. The quality and availability of data for forensic analysis are also critical bottlenecks. Incomplete or biased datasets can compromise the accuracy of findings and hinder the development of reliable AI models [211]. Adversarial attacks targeting AI forensic models, such as data poisoning or evasion techniques, pose significant risks to the reliability of automated analysis [26]. These tactics exploit weaknesses in AI systems, creating blind spots in their detection capabilities. Additionally, interpreting results from advanced techniques like graph-based modeling and malware classification often requires specialized expertise, which may not always be readily available [213]. Ethical concerns surrounding privacy in forensic investigations add another layer of complexity. Analyzing personal communications or sensitive data to uncover attack details must balance investigative needs with compliance with privacy regulations, such as GDPR [204]. These challenges underscore the need for continued innovation and collaboration in the attack analysis phase.

5.5. Recovery Response

The recovery response phase focuses on restoring systems to normal operations and strengthening defenses to prevent future attacks. AI plays a pivotal role in automating and accelerating this process, minimizing downtime, and ensuring robust return to functionality. By analyzing post-attack scenarios, recommending recovery actions, and strengthening system resilience, AI significantly contributes to the recovery lifecycle. One of AI’s primary contributions in this phase is assessing the extent of compromise and recommending prioritized recovery actions. AI-powered tools evaluate post-attack system states, identify critical systems that require immediate attention, and propose optimal recovery paths to restore affected infrastructure [26]. For example, AI models analyze log data to determine the most vulnerable entry points exploited during an attack, allowing organizations to patch these vulnerabilities promptly. Explainable AI frameworks improve this process by offering transparent recommendations, helping administrators understand the rationale behind suggested actions and implement them with confidence [26]. AI-driven automation is instrumental in performing recovery tasks, such as patching vulnerabilities, restoring backups, and reconfiguring affected systems. Reinforcement learning techniques provide adaptive capabilities that allow recovery workflows to be adjusted in real time based on the nature and scope of the attack. For example, adaptive AI models optimize backup restoration sequences to prioritize critical business services, ensuring minimal disruption [208]. Similarly, AI-powered recovery strategies dynamically reallocate resources to maintain operational continuity while affected systems are brought back online [26]. The integration of AI into recovery workflows extends to proactive measures to improve resilience against future threats. Post-attack analyses conducted by AI systems generate insights that inform the development of stronger defenses. For example, malware forensic tools analyze attack vectors and identify patterns that can be used to strengthen defenses against similar threats [9]. Using historical data, AI systems simulate potential attack scenarios and recommend adjustments to security configurations, creating a feedback loop that continuously improves system resilience. Recovery processes also benefit from collaborative AI systems that integrate insights from global threat intelligence networks. These systems correlate data from multiple sources to provide a comprehensive view of emerging threats, ensuring that recovery actions address immediate concerns and long-term vulnerabilities. For example, AI-enabled platforms predict secondary attacks or follow-up exploits based on the behavior of threat actors observed during the initial breach [211]. This foresight allows organizations to preemptively strengthen their defenses and avoid cascading failures.

Table 12. Examples of AI tasks, techniques, and tools in the recovery response phase.

Task	Techniques and Tools	Description
Vulnerability assessment	ML algorithms, post-attack analysis tools	Analyzes post-attack system states to identify vulnerabilities and recommend prioritized recovery actions [26].
Explainable AI (XAI) for recovery	XAI frameworks	Enhances transparency by explaining the rationale behind recovery recommendations, enabling informed decision making by administrators [26].
Adaptive recovery workflows	Reinforcement learning models	Optimizes recovery workflows in real time to ensure minimal disruption and faster restoration of critical services [208].
Malware forensics	Malware analysis tools	Analyzes attack vectors to develop stronger defenses against similar threats [9].
Collaborative threat intelligence	Global threat intelligence platforms	Correlates data from global threat networks to address immediate recovery needs and long-term vulnerabilities [211].
Resource optimization	Dynamic resource allocation systems	Reallocates resources during recovery to maintain operational continuity while affected systems are restored [26].
Scenario simulation for resilience	Attack scenario simulation engines	Simulates potential attack scenarios to recommend adjustments to security configurations and improve system resilience [26].

presents some AI tasks, techniques, and tools employed in the recovery response phase.

By combining automation, explainability, and collaborative intelligence, AI empowers organizations to recover quickly and build resilience in the face of an ever-evolving threat landscape. As cyber attacks grow in complexity, the integration of AI into recovery workflows will remain a cornerstone of modern cybersecurity practices. Addressing challenges proactively will ensure that AI-driven recovery strategies continue to deliver efficient and effective solutions to restore digital infrastructures. Despite its significant contributions, the recovery response phase presents unique challenges. First, the dynamic and unpredictable nature of cyber attacks often requires AI systems to process large and variable datasets, which can drain computational resources and hinder timely decision making [26]. Second, reliance on automation raises concerns about over-dependence. Misconfigurations or incorrect AI systems recommendations could exacerbate recovery efforts instead of facilitating them [208]. Third, adversarial tactics, such as false recovery triggers or data manipulation, pose risks to the reliability of AI-driven recovery systems [26]. Ensuring compliance with regulatory frameworks and data protection standards, such as GDPR, adds an additional layer of complexity [212]. Organizations must balance automation with human oversight and establish robust validation mechanisms for AI recommendations. In addition, investments in collaborative AI systems that integrate diverse data sources and perspectives can enhance the reliability and adaptability of recovery processes.

6. Cross-Domain Case Studies of AI Applications

To provide a snapshot of the applications of artificial intelligence in computer science and cybersecurity,

Table 13. Case studies or implementations of AI in computer science and cybersecurity.

Reference	Case Study/Implementation	AI Techniques/Tools
[221]	A comprehensive framework for healthcare system security using generative artificial intelligence to detect and eliminate data poisoning attacks.	Federated learning, homomorphic encryption, autoencoder-based anomaly detection.
[222]	ASTER—an AI-powered pipeline for generating unit tests in multiple programming languages.	Large language models, natural language processing.
[223]	Combines finite element method (FEM) with neural operators to enhance computational simulations in scientific and engineering applications.	Fourier neural operators (FNOs), domain decomposition algorithms.
[224]	Implements a deep learning pipeline for detecting anomalies and cyber threats in network systems, with a focus on explainable AI (XAI).	Convolutional neural networks, recurrent neural networks, LIME, SHAP.
[225]	Automatically classifies attacks in Internet of Things (IoT) environments.	Machine learning frameworks, random forest, naive Bayes, real-time stream processing, custom feature engineering.
[226]	AI systems to secure critical national infrastructure, such as energy grids and transportation.	Hybrid AI models combining rule-based systems and ML classifiers, threat intelligence fusion via anomaly scoring and log analytics.

outlines a selection of illustrative use cases. Each case is paired with the relevant AI tools and techniques employed, highlighting the practical implementations and methodological approaches observed in recent literature. Although not exhaustive, these examples offer insight into the diverse and evolving roles of AI within both domains.

7. Challenges and Future Trends

As AI continues to evolve and expand its impact in diverse domains, its transformative potential is matched by significant challenges. From ethical concerns and bias in decision making to the substantial computational demands and vulnerabilities of AI systems, these challenges highlight the complexities of deploying AI responsibly and effectively. At the same time, the field is witnessing exciting advances and trends that promise to address these obstacles while unlocking new possibilities. Future developments, such as quantum-enhanced AI for security, federated learning for privacy preservation, and explainable AI for transparent decision making, are poised to shape the trajectory of AI applications in computer science and cybersecurity. This section delves into these challenges and trends, exploring their implications for the responsible advancement of AI technologies.

7.1. Challenges

Bias in AI systems remains a significant challenge, rooted in the training datasets and algorithms used. For instance, in healthcare, diagnostic AI models that guide decisions for conditions such as heart disease and diabetes must consider patient diversity to avoid disparities in treatment recommendations. Studies have found that when training data disproportionately represents specific demographics, AI systems can perform poorly for underrepresented groups. For example, AI models trained on datasets that primarily feature urban populations may fail to identify disease markers prevalent in rural communities [78,227]. Explainable AI (XAI) addresses these concerns by improving the transparency and interpretability of AI-driven decisions. In criminal justice, predictive policing tools must provide justifications for why certain neighborhoods are flagged for increased patrols. Without transparency, such tools risk perpetuating racial profiling and historical biases. Recent studies have shown how XAI systems can audit these decisions to ensure they are fair and accountable [87,227]. Similarly, in finance, loan approval systems must avoid rejecting applicants based on biased criteria, such as zip codes linked to socioeconomic disparities. By auditing models and incorporating fairness-aware learning algorithms, institutions can ensure that their AI systems foster equity rather than exacerbate inequality [228,229]. These efforts show promise, but they also highlight the need for privacy and secure collaboration in bias mitigation. Federated learning and decentralized AI systems emerge as key strategies for balancing fairness with data privacy.

Federated learning offers a privacy-preserving approach by allowing AI models to be trained collaboratively across devices without sharing raw data. This method is crucial for industries like healthcare and finance, where privacy concerns are paramount. A prominent example is Google’s use of federated learning to improve predictive text models on mobile devices. Instead of collecting user data centrally, the model updates locally on devices and then aggregates improvements between users while preserving privacy [230,231]. In healthcare, federated learning enables global collaboration in disease detection. For example, hospitals in different regions can contribute to training a model for early cancer detection without exposing sensitive patient records. This ensures not only privacy but also fairness, as the model learns from diverse datasets representing various demographics [232,233]. However, these advantages come with challenges such as communication costs and device heterogeneity. To address this, researchers are exploring adaptive synchronization techniques and blockchain integration to ensure secure and efficient updates during federated learning [234,235]. Although federated learning tackles privacy and fairness, implementing these systems often requires substantial resources. This brings us to the pressing issue of the resource-intensive nature of AI development.

AI systems, particularly large-scale models like GPT-4 and BERT, require immense computational power and data resources. Training these models often incurs high costs, both financially and environmentally. For example, studies estimate that training GPT-3 required the equivalent energy of several hundred homes’ annual consumption [232,236]. This highlights the urgent need for sustainable AI practices. To address these concerns, researchers are developing lightweight models and techniques such as knowledge distillation, which compress large models into smaller, more efficient versions without significant loss in accuracy. For example, deploying AI-powered chatbots on mobile devices often relies on such techniques to ensure responsiveness and energy efficiency [237,238]. Another promising innovation is edge AI, where computations are performed on local devices rather than centralized servers. This approach is particularly useful for autonomous vehicles, where real-time decision making is essential, and latency from cloud processing could prove dangerous [238]. The resource-intensive nature of AI also raises ethical questions, particularly when organizations with limited resources struggle to compete with tech giants. This ties into broader ethical concerns surrounding AI deployment, especially in critical areas such as cybersecurity.

AI-driven cybersecurity systems promise improved threat detection and response capabilities, but also introduce ethical challenges. For example, AI-based autonomous intrusion detection systems might mistakenly flag legitimate user activity as malicious, leading to disruptions or breaches of privacy [239]. In 2021, a major cloud service provider faced scrutiny when its AI-driven monitoring system misidentified regular customer behavior as cyberattacks, resulting in unnecessary account suspensions. Such incidents underscore the importance of human oversight to balance automation and accountability. In addition, ethical concerns extend to the potential misuse of AI in cyber warfare. Autonomous systems designed for defense might inadvertently escalate conflicts if not properly governed. For example, an AI-powered threat neutralization tool could interpret harmless activities as hostile, triggering disproportionate responses [240]. Ensuring ethical deployment requires robust frameworks that prioritize transparency and fairness while aligning AI systems with societal values. As these examples show, ethical considerations are intertwined with other challenges such as bias and resource constraints. Addressing them will not only shape the responsible use of AI, but also set the stage for advancements explored in future trends.

In addition to the ethical concerns prompted by the use of AI, there were also social implications associated with it. First, the increased use of generative AI tools has facilitated the automation of various malicious tasks or activities that would have required advanced technical skills some years ago. Ref. [202] discusses how “non-experts” now have easier access to execute large-scale attacks by using tools such as ChatGPT to enable personalized phishing, hacking, and malware generation. The repeated exposure to these types of risk negatively affects the user’s trust towards digital communication and ultimately leads to the use of stricter verification protocols. Another social implication caused by the use of AI is reflected in the impact observed in cybersecurity professions. Routine tasks now, such as network log analysis and basic phishing defense, are increasingly automated, resulting in a decline in lower-tier cybersecurity jobs like network security analysts, for example [203]. This is a concern for a good part of the workforce that may be affected, so it calls for action from decision makers.

As the challenges and limitations of AI highlight the complexities in ensuring ethical, fair, and resource-efficient systems, they also underscore the need for forward-looking strategies and innovative solutions. These challenges serve not only as barriers, but also as catalysts for ongoing research and development, pushing the limits of what AI can achieve. Addressing these issues requires a forward-thinking perspective, paving the way for future trends that promise to redefine AI’s role in computer science and cybersecurity. We explore emerging advancements and transformative technologies poised to shape the future by focusing on their potential to mitigate existing challenges and unlock unprecedented opportunities.

Beyond identifying risks such as bias, interpretability, and adversarial vulnerability, we map each to practical mitigations—auditing, differential privacy, watermarking, and red-teaming—with concrete exemplars (

Table 14. Ethics and robustness: challenge ↔ mitigation.

Challenge	Risk/Concern	Mitigation & Exemplars
Bias	Disparate impact; skewed/underrepresented data	Dataset/model audits and disaggregated metrics; documentation (datasheets, model cards); standards guidance (IEEE 7003); fairness constraints and subgroup stress tests [241].
Interpretability	Opaque decisions; limited accountability	Post-hoc explainers (SHAP/LIME); inherently interpretable models; documentation for stakeholders; medical XAI practices [242,243].
Adversarial risk	Evasion/poisoning; brittle decisions	Red-teaming; adversarial training and evaluation against canonical attacks; certified robustness where feasible [244,245].
Privacy	Training/inference leakage; sensitive telemetry	Differential privacy in training/inference; federated learning for decentralized data with privacy/noise budgets; secure aggregation [246].
Model IP and provenance	Ownership disputes; synthetic misuse	Neural network watermarking/fingerprinting for model ownership; content provenance standards for outputs [247].

).

7.2. Future Trends

As the potential of quantum AI unfolds, the spotlight also turns to decentralized approaches, which promise to address data privacy concerns while enabling collaborative learning. This leads to the exploration of federated learning and decentralized AI systems, another transformative trend with far-reaching implications.

Federated learning represents a paradigm shift in the way AI systems are trained and deployed. This decentralized approach enables models to learn collaboratively across multiple devices without exposing sensitive data, addressing growing concerns around privacy and compliance. Refs. [74,248,249] highlight the transformative potential of federated learning, particularly in fields such as healthcare and cybersecurity. In healthcare, federated learning has been instrumental in training diagnostic models across hospital networks without compromising patient privacy. For example, models developed using this method have improved early detection of diseases such as Parkinson’s, combining insights from multiple sources to achieve higher precision [74]. Similarly, in cybersecurity, federated learning allows devices to collaboratively identify malware signatures without requiring centralized data storage, significantly improving threat detection capabilities while maintaining data sovereignty [249]. However, challenges such as communication overhead and securing model aggregation processes need further refinement to maximize its real-world applicability.

Although federated learning emphasizes collaboration and decentralization, automation presents a complementary and contrasting approach. Using AI to automate repetitive and time-sensitive tasks, organizations can enhance their ability to respond to evolving cyber threats. This brings us to the critical role of AI-driven automation in cybersecurity. AI-driven automation is emerging as the cornerstone of future cybersecurity solutions that allow systems to respond to threats with unprecedented speed and precision. By automating routine tasks such as vulnerability scanning, anomaly detection, and incident response, AI allows human analysts to focus on more complex challenges. Refs. [250,251] emphasize the role of autonomous tools in scaling defenses against large-scale cyberattacks. For example, the use of AI in phishing detection has significantly reduced response times by analyzing email metadata and identifying patterns indicative of fraud. Platforms like Microsoft Defender leverage AI to detect phishing attempts in real time, protecting millions of users daily [198]. Similarly, AI-powered security information and event management (SIEM) systems integrate machine learning algorithms to filter false positives and prioritize critical threats, enhancing the efficiency of security operations centers (SOCs). However, while automation brings scalability and speed, it also requires robust fail-safes to address potential model biases or adversarial inputs, which could lead to false negatives or overreliance on AI systems [250,251].

Although automation offers efficiency and scalability, the complexity of AI systems has prompted calls for greater transparency and accountability. This has driven significant interest in XAI, which addresses the “black box” nature of modern AI models and provides insights into their decision-making processes. As AI systems become integral to high-stakes domains, demand for XAI has increased. XAI aims to make AI decision-making processes more transparent, fostering trust, accountability, and regulatory compliance. Refs. [184,185,252] underscore the importance of explainability in mitigating the “black box” nature of complex AI models. For example, in healthcare, XAI tools such as Shapley additive explanations (SHAP) have been used to explain AI-driven predictions for conditions like heart disease. These tools identify key factors that influence predictions, such as patient age, genetic predispositions, or lifestyle habits, allowing physicians to understand and validate AI recommendations [186]. In cybersecurity, XAI is used to improve intrusion detection systems by providing insights into why specific activities are flagged as anomalous. This interpretability ensures that human analysts can verify and trust AI’s decisions, particularly in critical environments such as financial systems and government networks [184,253]. By addressing the challenges of transparency and accountability, XAI complements the other advances discussed in this section, illustrating how emerging trends collectively shape a robust and adaptive future for AI in cybersecurity.

FL and XAI are often discussed as separate trends, but their future impact should be closely connected. FL protects sensitive information by keeping data local, but this same FL’s distributed design complicates the understanding of how the global model reaches its conclusions. XAI can address this problem by providing transparency at both the client level, where updates are generated, and the global level, where models are aggregated [21,26]. In this regard, FL increasingly needs to rely on XAI to ensure trust, accountability, and resilience against threats such as poisoned updates [249]. At the same time, federated environments present new requirements for explainability, since explanation methods must preserve privacy and avoid leakage of sensitive local information [249]. Together, these perspectives suggest that the evolution of both XAI and FL will be more impactful when they advance side by side, creating systems that are not only privacy-preserving but also interpretable and secure [26,249].

If FL and XAI show how current methods can evolve together to ensure trust and privacy, quantum computing is the symbol of a more radical leap, which naturally introduces both new opportunities and unprecedented challenges for AI-driven security. On the defensive side, quantum key distribution (QKD) and quantum random number generation are new technologies showing promise of cryptographic protocols with stronger guarantees than those offered by classical methods. With the combination of AI, the tools based on these technologies can be further optimized for tasks such as real-time anomaly detection, adaptive key management, and the development of quantum-resistant encryption schemes (KeyShield as an example) [254,255]. On the offensive side, attackers may exploit quantum computing to exploit today’s defenses. Studies have shown that algorithms such as Shor and Grover place existing public-key cryptography and hash functions at long-term risk, putting broadly used schemes such as RSA and ECC in jeopardy once scalable quantum hardware becomes available [254,255]. Indirectly, the confidentiality and integrity of AI-driven applications that depend on these algorithms may suffer from these potential risks. Beyond cryptography, researchers warn that quantum adversarial machine learning could engineer the possibility of more powerful evasion techniques against defenses [254], while at the same time, defensive applications such as QKD may be difficult to deploy at scale due to practical barriers such as noise, channel loss, and latency [255]. Together, these dynamics show that quantum computing will be both a disruptive threat and a promising defensive tool. Therefore, it is imperative that AI, security, and quantum research advance together to anticipate and mitigate risks while capitalizing on new opportunities.

The future of AI in computer science and cybersecurity will be shaped by the convergence of multiple transformative and innovative trends. FL addresses privacy concerns through decentralized collaboration, while automation and explainability further enhance trust, transparency, and operational resilience. Quantum computing has the potential to completely reshape both encryption and threat detection, highlighting its role as a disruptor but also as a defensive opportunity. Together, these advancements illustrate a forward-looking trajectory in which the next era of AI-driven security will depend on the balancing act of innovation with ethical and practical considerations to ensure that AI continues to align with societal values and expectations.

8. Conclusions

This paper delivers a comprehensive, cross-disciplinary synthesis of the role that artificial intelligence (AI) plays in advancing computer science and cybersecurity. By critically analyzing AI-driven innovations, from natural language processing, reinforcement learning, and software automation to real-time anomaly detection, threat response, and behavioral analytics, the study underscores AI’s increasing influence in the design of intelligent systems in these two foundational domains.

What distinguishes this work is its unified perspective. While much of the existing literature treats computer science and cybersecurity in isolation, this review bridges both, drawing attention to shared opportunities and challenges. In doing so, it not only maps the current landscape, but also provides a platform for comparative inquiry, inviting researchers to reimagine AI integration as a continuum that spans infrastructure, automation, and ethics. This cross-domain lens is especially timely as AI continues to blur disciplinary boundaries, compelling the need for holistic strategies that align technological growth with ethical, secure, and sustainable design principles.

The paper identifies key technical and ethical challenges that still inhibit the full realization of AI’s potential, such as algorithmic bias, model interpretability, adversarial vulnerabilities, and the environmental costs of training large-scale models. These issues are not only barriers to implementation, but also crucial research directions that call for continued theoretical and methodological innovation. In particular, the increasing importance of explainable AI, federated learning, and privacy-preserving architectures points to a future in which responsible and trustworthy AI becomes a defining metric of success.

By articulating these unresolved issues alongside the state of the art, this paper directly contributes to shaping the research agenda for both fields. For computer science, it highlights the emerging demands for low-resource, transparent, and adaptive AI models that can operate efficiently in complex software systems. For cybersecurity, it surfaces the need for autonomous, resilient, and privacy-conscious defense mechanisms capable of mitigating evolving and sophisticated threats.

The broader implication of this work is its positioning as a reference point that spans the field, one that enables scholars, practitioners, and policymakers to align their efforts towards an AI-driven future that is not only more capable, but also more equitable and secure. It challenges the community to view AI not merely as a technical solution but as a socio-technical force that must be steered through interdisciplinary collaboration, ethical foresight, and continuous innovation.

Ultimately, this paper provides a foundational framework for future studies that aim to deepen the integration of AI into the core technological infrastructures. By charting current progress and framing forward-looking challenges, it serves as both a roadmap and a call to action, encouraging sustained engagement with the complex, evolving, and highly consequential interface between artificial intelligence, computer science, and cybersecurity.