Artificial Intelligence for Intrusion Detection and Prevention: A Systematic Review of Methods, Challenges, and Future Directions

Abstract

This systematic review synthesizes AI-based techniques for detecting and preventing cyberattacks published between 2019 and 2025. Following PRISMA 2020, we searched IEEE Xplore, Scopus, and the ACM Digital Library (550 records) and included 74 studies after independent dual screening; study quality was appraised with a modified JBI checklist, the risk of bias of the review was assessed with ROBIS, and the review was not registered. We include a higher-level taxonomy of present methods divided into seven categories: (1) traditional machine learning algorithms; (2) deep learning models; (3) hybrid intelligence frameworks; (4) blockchain-based systems; (5) reinforcement learning approaches; (6) ensemble learning methods; and (7) explainable AI (XAI) techniques. Reported accuracies are high in all seven categories (category medians between 95.3% and 99.9%), but individual results range from 58.17% to 100% and were obtained with different datasets, data splits, and evaluation protocols, so they do not support a ranking of the categories. Latency and resource consumption are rarely reported and, when reported, were measured under non-comparable conditions. Automated prevention actions (blocking, rate limiting, or network reconfiguration) are evaluated far less often than detection, although false positives are more costly when they trigger blocking. Targeted machine learning methods report strong performance in phishing detection (96.83–98.3% accuracy in the tabulated studies). This study also identifies several major areas needing improvement, including a predominant reliance on legacy benchmark datasets (NSL-KDD, KDD99, UNSW-NB15), which were used by 25 of the 48 studies with identifiable datasets (52.1%) and a limited capability to interpret “black box” AI models. Accordingly, we suggest that future research use more realistic test environments and recent datasets, develop lightweight and adaptive AI models, and adopt a standardized minimum reporting protocol (accuracy, precision, recall, F1-score, false positive rate, latency, resource usage, and statistical validation), for which we provide a concrete proposal and a list of recent datasets. The intention of this study is to assist cybersecurity practitioners in identifying and implementing effective AI-based security solutions in relation to present-day threats.

1. Introduction

Cyber threats are continuously evolving, and global losses from cybercrime were projected to exceed $10.5 trillion annually by 2025. The number of distributed denial-of-service (DDoS) attacks and phishing scams has increased by over 300% since 2020, which represents an enormous increase in the volume of network traffic we see today [1]. Additionally, the patterns exhibited within that traffic are extraordinarily complex and, therefore, require advanced methods for analyzing them in order to effectively detect any abnormal behavior [2,3]. Historically, signature-based detection methods were commonly utilized within the field of information technology security and were typically very efficient at identifying known malicious software (malware or viruses) [3,4]. However, the emergence of new forms of cyber threats—like advanced persistent threats (APTs) and zero-day vulnerabilities—has rendered many traditional signature methods ineffective for identifying unknown attacks on the Internet [5]. Therefore, many organizations have begun exploring artificial intelligence (AI)-based security strategies that possess multi-dimensional adaptability and prediction characteristics [6]. Modern cyber-attack dynamics have now shifted away from simply gaining access to computer systems and instead seek to modify or disrupt systems, as well as inflict permanent damage on them. As a means of detecting, predicting, and implementing the automated response mechanisms needed to combat constantly evolving tactics, organizations are beginning to evaluate AI-related technologies (machine learning, deep learning, etc.) to assist them with the detection and mitigation of cyber threats [2,4]. The following questions will be addressed in order to evaluate the current state of artificial intelligence applications in the field of cybersecurity.

RQ1: How well do current AI models perform in terms of resilience, scalability, and detection accuracy across various attack types? Detection accuracy is operationalized as the accuracy, precision, recall, F1-score, and false positive rate reported for each attack type and dataset; resilience as reported robustness to class imbalance, unseen (zero-day) attacks, or adversarial perturbations; and scalability as reported behavior with larger traffic volumes or distributed deployments.

RQ2: What are the main challenges in practically implementing AI-powered cybersecurity systems? Practical deployment is operationalized along four dimensions: (i) computational cost (training and inference time, memory, and energy consumption); (ii) detection or decision latency; (iii) interpretability of the decisions for security operators; and (iv) validation on realistic or operational traffic rather than only on benchmark datasets.

RQ3: Do hybrid AI frameworks successfully balance the requirements of practical deployment with detection effectiveness? That is, do hybrid frameworks that report high detection effectiveness (RQ1) also report acceptable values on the four deployment dimensions defined for RQ2?

These questions address gaps left by earlier reviews (Section 2.2). Previous surveys either focus on a single application domain [7,8], organize the literature by algorithm family without appraising study quality [9,10], or treat blockchain, reinforcement learning, and XAI only as future work [9,11]. None of them jointly examines detection and prevention across more than 12 attack types, appraises study quality and risk of bias, and relates detection performance to deployment constraints such as latency, energy, and interpretability. RQ1 addresses the lack of a cross-category synthesis of reported performance, RQ2 the gap between benchmark results and deployment requirements, and RQ3 the frequently stated but rarely tested assumption that hybridization improves both. Section 2.2 details, topic by topic, how blockchain, reinforcement learning, and XAI are treated in the previous reviews and in the present one.

This paper has four significant contributions:

• An integrated taxonomy of AI techniques for IDS/IPS that places seven categories on the same level and analyzes them with the same data-extraction form and deployment dimensions: traditional machine learning, deep learning, hybrid intelligence frameworks, blockchain-based systems, reinforcement learning, ensemble learning, and explainable AI.
• A structured comparative synthesis of AI-based Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) across over 12 types of attacks, including attack-specific results where the data allow (Section 4.9) and a discussion of AI-driven prevention actions (Section 4.8), employing a comprehensive set of performance metrics including accuracy, precision, recall, F1-score, false positive rate, and latency (where reported).
• Identification of key issues and obstacles with common AI cybersecurity solutions, such as obsolete data, lack of explainability, etc.
• Recommendation for practical implementation and future research opportunities for the development of resilient, scalable, and deployable AI-centric cybersecurity solutions.

The individual categories of the proposed taxonomy are established in the literature; its novelty lies in their integration. Blockchain-based, reinforcement learning, ensemble, and XAI approaches are treated as first-class categories, analyzed with the same data-extraction form as ML and DL, and each category is annotated with the deployment dimensions of RQ2 (Section 4.1) rather than with accuracy alone. The review also provides descriptive quantitative evaluations based on multiple performance metrics (accuracy, precision, recall, F1-score, FPR, and latency, where reported) and derives practical recommendations for deployment. This research is different from previous studies, which have focused on individual use cases of AI cybersecurity solutions (e.g., electrical substations [7], phishing [8], general intrusion [12]) by providing a comprehensive comparative analysis of over 12 attack types along with relevant actionable recommendations for eventual deployment. Specifically, compared with the previous reviews analyzed in Section 2.2, this review (i) covers seven AI categories, including blockchain-based, reinforcement learning, ensemble, and XAI approaches that previous reviews either omit or mention only as future work; (ii) spans more than 12 attack types rather than a single domain; (iii) combines PRISMA 2020 reporting with JBI quality appraisal and ROBIS risk-of-bias assessment; (iv) analyzes accuracy together with latency and resource constraints; and (v) proposes a minimum reporting protocol and a list of recent datasets for future benchmarking.

2. Research Methodology

The study follows a standardized review methodology in accordance with the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) guidelines (2020) [13] to promote transparency and reproducibility throughout the study. A collection of 74 studies published from 2019 to 2025 (73 peer-reviewed papers and one preprint; Section 2.2) was evaluated critically. This timeframe was chosen because of the increasing number of researchers (academic and industry) who are interested in using artificial intelligence (AI) or machine learning (ML) as solutions for cybersecurity, and the ambiguity associated with using these terms in both academic and non-academic literature. The aim of the review is to extract and synthesize findings on AI-based threat detection and mitigation approaches. As a starting point, we introduce all important terminology and frameworks, along with definitions of AI as opposed to ML, and how AI and ML help protect against future cyber threats. The emphasis will also be on new trends (e.g., hybrid AI models) and concepts (e.g., neuro-symbolic reasoning) that contribute to advanced, intelligent forms of cybersecurity.

This systematic review was conducted in accordance with the PRISMA 2020 (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) guidelines. The review was not registered and no formal protocol was prepared; the implications of this limitation are discussed in the next paragraph. A completed PRISMA 2020 checklist is provided in the Supplementary Materials, and the study selection process is summarized in the PRISMA flow diagram (Figure 1).

Figure 1. PRISMA 2020 flow diagram of the study selection process, showing the number of records identified per database, screened, excluded (with reasons), assessed in full text, quality-appraised, and finally included. Excluded records that required an explicit decision are listed in Table 1.

Registration and protocol. We acknowledge upfront that the absence of registration and of an a priori protocol is a significant limitation for a systematic review. PROSPERO accepts only reviews with a health-related outcome, and no alternative registry (e.g., OSF Registries) was used. Without a registered protocol, readers cannot verify that the research questions, eligibility criteria, and synthesis methods were not modified after the search results were known, which increases the risk of selective inclusion and selective reporting and reduces reproducibility. To limit this risk, (i) the quality thresholds were fixed a priori and data were extracted with a predefined form (Section 2.2 and Section 2.3); (ii) screening, data extraction, and quality appraisal were performed independently by two reviewers; (iii) all excluded records that required an explicit eligibility decision are listed with their reasons (Table 1); and (iv) the Boolean search string, filters, and record counts per database are reported (Appendix B, Table A2). These measures do not replace a registered protocol; their effect on the overall risk of bias of the review is assessed with ROBIS in Section 2.4 and discussed in Section 5.

2.1. Research Strategy

An extensive literature search was performed at three well-established digital libraries, including IEEE Xplore, ACM Digital Library, and Scopus. The search covered records published from January 2019 to December 2025; the search string was applied to titles, abstracts, and keywords (Figure 1), and the exact date of the last search is not reported, a deviation from PRISMA 2020 (item 6) that we acknowledge in Section 5. The search combined three concept blocks (AI technique, security task, and threat type) in the following Boolean string, which was applied in the three databases with the same filters (Appendix B, Table A2):

(“artificial intelligence” OR “machine learning” OR “deep learning” OR “neural network” OR AI)

AND (“cybersecurity” OR “intrusion detection” OR “intrusion prevention” OR IDS OR IPS)

AND (“attack detection” OR “threat detection” OR “phishing” OR DDoS OR “malware”)

The searches included additional filters, including peer-reviewed articles and conference proceedings published in English and available in full text. In total, 550 results were returned: 180 from IEEE Xplore, 215 from Scopus, and 155 from the ACM Digital Library.

The search string may miss relevant studies that use alternative terminology, such as “anomaly detection”, “network intrusion detection system (NIDS)”, “botnet detection”, “zero-day”, “adversarial”, “federated learning”, “reinforcement learning”, “blockchain”, or “explainable”. Studies indexed only under such terms, and studies available only in sources other than the three databases (e.g., preprint servers), may therefore not have been retrieved. This limitation affects the comprehensiveness of the review in a non-uniform way. Because the third concept block requires an explicit threat term, studies that describe their task only as anomaly or intrusion detection on benchmark data, and studies whose main focus is the AI paradigm (federated, reinforcement, blockchain-based, or explainable learning) rather than the threat, are the most likely to be under-represented. Consequently, the number of studies per category (Section 3) reflects the retrieved corpus rather than the research activity in each area, and the dataset and category frequencies reported in Section 4 should be read as proportions within this corpus, not as estimates for the whole field. Conclusions that do not depend on study counts (e.g., the non-comparability of evaluation protocols, the reliance on legacy datasets, and the scarcity of latency and prevention metrics) are less sensitive to this limitation, because they are consistent across all categories and with previous reviews [9,10,11]. Future updates of this review should extend the search string with these synonyms and complement database searching with backward and forward citation searching (snowballing) [14]. This potential under-coverage is also considered in the ROBIS assessment (Section 2.4) and in Section 5.

2.2. Study Inclusion Process

The studies selected for this project were high-impact, peer-reviewed articles based on publicly available datasets, such as the CIC-IDS2017 and NSL-KDD databases, that assessed the effectiveness of AI-based approaches to cybersecurity solutions. Studies that performed benchmarking comparisons against publicly available baseline models were prioritized for inclusion in the analysis.

Excluded from selection were: replication studies; studies that did not include empirical data; studies whose evaluation data were neither publicly available nor described in sufficient detail (data source, collection procedure, attack classes, and size) to assess the validity of the results; studies published in low-quality journals (a criterion defined a priori that, in practice, led to no exclusion: none of the records that required an explicit eligibility decision was excluded on this ground, see Table 1, so it had no effect on the corpus); and domain-specific applications (e.g., power grid cybersecurity) unless they had direct relevance to broader threat modeling (e.g., wormhole attacks; blockchain vulnerabilities). The methods for identifying and screening studies conformed closely to the PRISMA 2020 protocol to promote methodological rigor and reproducibility. Studies evaluated on custom or self-collected datasets were therefore retained when the dataset was adequately described (JBI criterion 4); five such studies are included [15,16,17,18,19] and are analyzed separately in Section 4.3. Excluded records that required an explicit eligibility decision are listed in Table 1, together with the stage and reason for their exclusion. Systematic literature reviews and meta-analyses require consistent and transparent reporting, as defined by the PRISMA 27-item checklist. Figure 1 below shows how the selection process for the articles included in this review was carried out. One included study [20] was available only as an arXiv preprint at the time of the review. It was retained as an explicit exception to the peer-review criterion because it is the only study in the corpus that combines knowledge distillation with explainability, which is directly relevant to lightweight deployment (RQ2); its influence on the results is assessed in Section 4.1.

Screening and data extraction were performed by two reviewers (H.M. and M.E.G.) independently. Both reviewers screened the titles and abstracts of all 550 records and then assessed the full texts of the retained records against the eligibility criteria. Disagreements were resolved by discussion and, where consensus could not be reached, by a third reviewer (M.A.E.K.). Data were extracted into a predefined form (publication year, attack type, dataset, method, advantages, limitations, and reported metrics); the extracted data were cross-checked by both reviewers, and discrepancies were resolved in the same way.

• Identification involves identifying a large number of possible studies through database searching and other resource searching.
• Screening involves reviewing the article titles and abstracts to determine if the articles relate to the overall research question.
• Eligibility: The full text of the articles is reviewed against the eligibility criteria defined previously.
• Inclusion: The studies that meet all eligibility criteria will be included in the analysis.
• Exclusion: The articles that do not meet the eligibility criteria due to irrelevance, low-quality methodology, or insufficient data will be removed from the analysis of the review.

Table 1 lists the 8 excluded records that required an explicit eligibility decision, together with the stage at which they were excluded. Four were excluded at the full-text eligibility stage (Stage F); they correspond to the four full-text exclusions shown in Figure 1. Four were excluded during title/abstract screening (Stage S) because the abstract already showed that they did not meet the eligibility criteria; they are reported individually because they were borderline candidates. The remaining 468 records excluded at screening were clearly out of scope and are not listed individually. Four records [19,21,22,23] had initially been excluded partly on the basis of reported performance or lack of novelty, which are not eligibility criteria. During this revision, they were re-assessed against the eligibility criteria alone: ref. [21] remains excluded because it is a literature survey without an original empirical evaluation, whereas [19,22,23] met all criteria and were included, which increased the corpus from 71 to 74 studies (Figure 1).

Table 1. Excluded records that required an explicit eligibility decision, with exclusion stage (S = title/abstract screening; F = full-text eligibility) and reason.

Ref.	Year	Stage	Reason for Exclusion
[21]	2020	F	No original empirical evaluation (literature survey)
[24]	2024	F	Unspecified Dataset→ cannot be reproduced
[25]	2020	F	No dataset or empirical analysis (conceptual study)
[26]	2020	S	Blockchain with no real benchmarks (accuracy not reported)
[27]	2021	S	Lab evaluation (private Ethereum) → not generalizable
[28]	2021	S	Evaluation not on widely used intrusion detection datasets
[29]	2020	F	Focus on smart grids, irrelevant for general cyberattacks
[30]	2021	S	Specific application (microgrids) → out of scope

Table 1. Excluded records that required an explicit eligibility decision, with exclusion stage (S = title/abstract screening; F = full-text eligibility) and reason.

Ref.	Year	Stage	Reason for Exclusion
[21]	2020	F	No original empirical evaluation (literature survey)
[24]	2024	F	Unspecified Dataset→ cannot be reproduced
[25]	2020	F	No dataset or empirical analysis (conceptual study)
[26]	2020	S	Blockchain with no real benchmarks (accuracy not reported)
[27]	2021	S	Lab evaluation (private Ethereum) → not generalizable
[28]	2021	S	Evaluation not on widely used intrusion detection datasets
[29]	2020	F	Focus on smart grids, irrelevant for general cyberattacks
[30]	2021	S	Specific application (microgrids) → out of scope

Figure 2 shows the number of identified articles present per database source. An initial literature review yielded 550 potential studies; of those, 155 matched (28.2%) from the ACM Digital Library, 215 matched (39.1%) from Scopus, and 180 matched (32.7%) from IEEE Xplore by source type.

Figure 2. Number of records identified (n = 550) and studies finally included (n = 74) per database source; percentages are relative to the total of each stage.

After the strict selection process outlined by PRISMA, 74 studies were selected for review (between 2019 and 2025) based on peer-reviewed publications. Distribution of selected studies by database source was: 13 (17.6%) from the ACM Digital Library, 26 (35.1%) from Scopus, and 35 (47.3%) from IEEE Xplore (the two IEEE conference papers included during revision, refs. [19,23], are counted under IEEE Xplore and the journal article [22] under Scopus); thus, 74 papers from the literature review analyzed how AI is being utilized in cybersecurity.

Table 2 positions the present review against four recent systematic reviews of AI-based IDS/IPS, highlighting differences in scope, methodology, and coverage.

Table 2. Comparison of AI-based IDS/IPS systematic reviews. ✓ = addressed; ✗ = not addressed.

Ref.	Attack Scope	Detection & Prevention	PRISMA + Quality/Bias	Hybrid AI	Accuracy–Latency Trade-Off	Major Contribution
[7]	Substation-specific attacks	✗	✗	✗	✗	Survey of IDS/IPS in digital substations
[9]	General IDS; ML/DL taxonomy by dataset & attack type	Detection only	PRISMA ✗ Quality/Bias ✗	ML + DL only (Blockchain = future work only)	✗	ML/DL taxonomy & attack-type datasets
[10]	General IDS, by algorithm family (2018–2023; 696→393)	Detection only	PRISMA ✓ Quality/Bias ✗	ML+DL+Optimization (GA/PSO/ACO); no Blockchain/RL/XAI	✗	ML/DL/Optimization taxonomy + accuracy leaderboards
[11]	Networks + mobile/IoT, by IDS type (2011–2024; 1598→104)	Detection only	PRISMA ✓ Quality/Bias ✗	Supervised/Unsupervised/DL/Hybrid; Blockchain = future work only; no RL	✗	Dataset taxonomy, evaluation metrics & research gaps
[31]	Cybersecurity + CV, by threat model (2020–2026; 4447→207)	Attack & Defense (AML robustness, not network IDS)	PRISMA 2020 ✓ Quality/Bias ✗	RL ✓; XAI ✓; no Blockchain category	✗	AML × RL × XAI intersection; XAI as attack surface
This study	12+ attack types (DDoS, phishing, probing, etc.) (2019–2025; 550→74)	Detection & Prevention	PRISMA 2020 ✓ JBI ✓ (8 criteria) ROBIS ✓	ML + DL + Hybrid + Blockchain + RL + Ensemble + XAI (7 categories)	✓	Combines JBI quality appraisal, ROBIS bias assessment, and six performance metrics.

How the integrated topics differ from previous reviews. The difference from earlier reviews is not only the number of categories covered. (i) Blockchain: Momand et al. [9] and Rehman et al. [11] mention blockchain only as a future research direction, and Issa et al. [10] do not cover it; here, five blockchain-based IDS are tabulated (Section 3.6), their consistently high accuracies are related to the datasets on which they were evaluated, and their latency, energy, and synchronization overheads are analyzed together with concrete sustainable designs (Section 3.6 and Section 4.2). (ii) Reinforcement learning: RL is absent from [9,10,11], and Ouazza et al. [31] discuss it mainly in the context of adversarial machine learning rather than network intrusion detection; here, six RL-based IDS are analyzed, showing that RL has the widest dispersion of reported accuracy (58.17–99.81%) and that its high values are confined to binary or feature-selection tasks on NSL-KDD and CSE-CIC-IDS2018 (Section 3.7). (iii) Explainable AI: [9,10,11] do not treat XAI as a separate category, and [31] examines XAI primarily as a potential attack surface; here, six XAI-based IDS are compared, and the interpretability–accuracy trade-off is analyzed according to how explanations are integrated into the detection pipeline (Section 3.9 and Section 4.5). Finally, none of the previous reviews appraises the quality of the included primary studies or relates reported accuracy to deployment dimensions and prevention actions; the present review does both (Section 2.3, Section 2.4, Section 4.8, Section 4.9 and Section 4.10).

This research bridges academic work and the practical application of AI in cybersecurity. It evaluates accuracy–latency trade-offs, documents standardized evaluation methods, and provides guidance for edge deployment.

2.3. Quality Assessment and Risk of Bias

In order to assess the validity of the papers included in our analysis, a modified Joanna Briggs Institute (JBI) Critical Appraisal Checklist was employed to rate the studies based on 8 criteria relating to the quality and design of analytical cross-sectional studies. The original JBI checklist for analytical cross-sectional studies [32] was designed for studies of human participants; its items were therefore reworded for experimental AI/ML studies, as summarized in Appendix B (Table A3). In brief, the items on the sample and the setting were mapped to the research aims and the experimental design (criteria 1–2), the measurement of the exposure to the description of the AI/ML method (criterion 3), the objective criteria for measuring the condition to the use of public or adequately described labeled datasets (criterion 4), the valid measurement of outcomes to the reporting of key performance measures (criterion 5), and the appropriate statistical analysis to statistical validation (criterion 6). The two items on confounding factors, which have no direct equivalent in benchmark experiments, were replaced by the comparison with a baseline (criterion 7), which controls for dataset-specific difficulty, and by the discussion of limitations (criterion 8).

• Clear statement of research aims or objectives (Yes/No, Unclear);
• Use of an appropriate study design to answer the research question;
• Clear description of the AI/ML methodology;
• Use of publicly available or sufficiently described datasets;
• Reporting key performance measures, i.e., accuracy, precision, recall, and F1 score;
• Validation of analytic results via the application of statistical methodologies;
• Comparison of analytic results to a baseline;
• Discussion of limitations of the study.

AI-specific aspects. Three aspects that are specific to the evaluation of AI/ML models were considered within existing criteria rather than as separate items: the experimental setup and data split (criteria 2 and 4), the hyperparameter-tuning procedure (criterion 3), and robustness testing (criteria 6 and 8). Because they were not scored separately, the appraisal cannot distinguish, for example, a study that tuned hyperparameters on a separate validation set from one that tuned them on the test set. We acknowledge this as a limitation of the adapted checklist (Section 5); these aspects are included as explicit items of the reporting protocol proposed in Section 4.7 and should be scored separately in future appraisals of AI-based IDS studies.

Each of these criteria was then scored (1 = Yes, 0.5 = Unclear, 0 = No) for each study to assess quality based on the total score. Studies that received a score of 6 out of 8 or higher were assessed as “high quality”; studies that received a score between 4 and 5.5 were assessed as “moderate quality”; and those that received a score below 4 were assessed as “low quality”. These thresholds were fixed a priori (a score ≥ 6/8 corresponds to at least 75% of the criteria being fully met). The appraisal was performed independently by the same two reviewers using a common scoring sheet; the reviewers were not blinded to the authors, affiliations, or publication venues of the studies, and score disagreements were resolved by consensus. After the PRISMA screening and eligibility assessment, 78 full-text reports were assessed. Of these, 4 were excluded based on the predefined inclusion criteria, resulting in a final corpus of 74 studies included in the review. The 71 studies in the initial corpus were then subjected to a modified Joanna Briggs Institute (JBI) Critical Appraisal Checklist, yielding an average quality score of 6.2 (SD = 1.1) out of 8. No additional studies were excluded at this stage, as all 74 met the predefined inclusion threshold (score ≥4 out of 8). The mean score of the initial 71 studies (6.2, SD = 1.1) lies in the high-quality range; the three studies included during revision [19,22,23] were appraised with the same checklist and scored 4.5, 5, and 5.5, respectively (moderate quality). Per-study scores of the initial 71 studies are not reported individually, which we acknowledge in Section 5.

Choice of the quality threshold. The threshold of 4/8 was intended to exclude only studies with fundamental methodological flaws, not to restrict the synthesis to the best studies. We recognize that it is lenient: because all 74 studies passed it, the appraisal did not act as a filter, and a stricter threshold (e.g., ≥6/8) would have produced a smaller but more homogeneous corpus. We retained the lenient threshold because a stricter one, applied to a corpus in which statistical validation (criterion 6) is rarely reported, would have excluded studies mainly for a reporting deficiency that is common to the whole field rather than specific to individual studies, and would have further reduced the already small number of studies in some categories. Instead, the quality grade is considered in the interpretation, and the most frequent appraisal weaknesses (lack of statistical validation and of baseline comparisons under identical conditions) are discussed in Section 4.1.

2.4. Risk of Bias of the Primary Studies and of the Review

Primary studies. ROBIS is designed to assess the risk of bias of a systematic review, not of the primary studies it includes [33]. The risk of bias of the included primary studies was therefore assessed through the JBI criteria (Section 2.3), complemented by three study-level indicators extracted for the 49 studies tabulated in Section 3, whereas ROBIS was applied to the present review itself. (i) Evaluation data: 14 studies (28.6%) were evaluated exclusively on legacy benchmarks (NSL-KDD, KDD99, or UNSW-NB15), 11 (22.4%) combined a legacy benchmark with another dataset, 19 (38.8%) used only other public datasets, and 5 (10.2%) used custom datasets. (ii) Number of evaluation datasets: 30 studies (61.2%) reported results on a single dataset, so the generalizability of their results cannot be assessed. (iii) Ceiling effects: of the 46 studies that report an accuracy value, 23 (50.0%) report a highest accuracy of about 99% or more, a concentration near the ceiling that is consistent with dataset artifacts, optimistic evaluation protocols, or selective reporting. Together with the rarity of statistical validation (Section 4.1), these indicators suggest that the risk of bias of the primary evidence is generally moderate to high, mainly in the domains of evaluation data and analysis.

Risk of bias of the review (ROBIS). ROBIS [33] was applied to the present review; the concerns, mitigations, and judgments are reported in Appendix B (Table A4). The risk of bias was judged high in Domain 1 (study eligibility criteria), because no protocol was registered, some exclusion criteria required judgment, and four records had initially been excluded partly on the basis of performance or novelty (corrected during revision, Section 2.2); high in Domain 2 (identification and selection of studies), because only three databases were searched, the search string omitted several synonyms (Section 2.1), and neither grey literature nor citation searching was used; low in Domain 3 (data collection and study appraisal), because extraction and appraisal were performed independently by two reviewers with a predefined form; and unclear in Domain 4 (synthesis and findings), because heterogeneity precluded meta-analysis and reporting bias could not be assessed formally. Overall (ROBIS Phase 3), the review is at high risk of bias with respect to the completeness of its evidence base; the interpretation, however, addresses the concerns identified in all four domains, since the review does not rank categories, treats reported accuracies as upper bounds, and limits its conclusions to patterns that are consistent across categories.

Publication and reporting bias. A formal assessment of publication bias (e.g., funnel plots or Egger’s test) requires a common effect measure and its precision for each study, which the included studies do not provide: they report single accuracy values without variance estimates, on different datasets and tasks. Publication bias was therefore not assessed statistically, but its likely impact is considerable and its direction is predictable. In machine-learning research, studies that do not improve on the state of the art are less likely to be submitted or accepted, and authors tend to report the best configuration and the most favorable dataset [34]. Three observations in the present corpus are consistent with such bias: the concentration of reported accuracies near the ceiling (50.0% of studies report about 99% or more); the scarcity of low results (only two studies report a highest accuracy below 89% [18,35], and other low values appear only for multi-class tasks reported alongside high binary results [17,36]); and the fact that only one study reports failure under adversarial conditions [19]. In addition, four records had initially been excluded partly on the basis of performance or novelty; after re-assessment, the three eligible ones were included (Section 2.2), which reduces, but cannot eliminate, the over-representation of favorable results. The likely consequence is that the accuracies summarized in Section 4.1 overestimate the performance that can be expected in practice, and that the superiority claimed by individual studies over their baselines is uncertain. We therefore interpret all reported values as optimistic upper bounds and base our conclusions on qualitative patterns rather than on the magnitude of reported accuracies.

The performance metrics reported across the reviewed studies are formally defined as follows. Given TP (true positives), TN (true negatives), FP (false positives), and FN (false negatives):

Accuracy = (TP + TN)/(TP + TN + FP + FN)

Precision = TP/(TP + FP)

Recall = TP/(TP + FN)

F1-score = 2 × (Precision × Recall)/(Precision + Recall)

False Positive Rate (FPR) = FP/(FP + TN)

In this review, latency refers to the time reported by each study between the arrival of a traffic sample (or event) and the detection decision or the initiation of a response. Because studies define and measure latency differently (e.g., per-sample inference time, end-to-end detection time, or on-chain validation time) and on different hardware, latency values are reported as given by the original authors. The other definitions are used consistently throughout the review to ensure comparability across the surveyed studies.

3. Research Outcomes

In this study, we provide an overview of current research trends in AI-based intrusion detection systems (IDS). We will discuss IDS architectures, datasets used for training/validating IDS models, evaluation metrics for assessing IDS performance, and some current challenges associated with AI-based IDS technologies. Analysis of 74 papers led to a number of findings:

• Hybrid models that combine ML, DL, blockchain, and/or swarm intelligence report accuracies between 89% and 99.21% (Section 3.5); individual studies in other categories report comparable or higher values (e.g., 100% for a transfer-learning CNN [37]), so no category can be singled out as the most accurate (Section 4.1).
• Traditional ML methods report high accuracy for specific attack types, e.g., 96.83–98.3% for phishing detection [15,38].
• Blockchain technology appears to hold great promise as a means of improving security in IoT environments.
• Explainable AI (XAI) approaches are being explored; the tabulated XAI studies report a wider accuracy range (85–99.997%) than most black-box models, reflecting a possible trade-off between interpretability and accuracy (Section 4.5).

Reading Table 3, Table 4, Table 5, Table 6, Table 7, Table 8 and Table 9. Table 3, Table 4, Table 5, Table 6, Table 7, Table 8 and Table 9 include the 49 included studies for which the method, dataset, and results could be extracted unambiguously; the remaining 25 included studies described their data or results only generically and are therefore not tabulated individually (Section 5). The tables report, for each study, the attack type, dataset, method, advantages, disadvantages, and highest reported accuracy, because accuracy is the only metric reported by almost all included studies. Precision, recall, F1-score, false positive rate, and latency were extracted whenever they were reported; as summarized in Section 4.1, they were reported inconsistently, and they are therefore given in the text of Section 3.3, Section 3.4, Section 3.5, Section 3.6, Section 3.7, Section 3.8 and Section 3.9, and in Section 4.9 (attack-specific results and latency and resource indicators) rather than as table columns that would be mostly empty. This reporting gap is itself a finding of the review and motivates the minimum reporting protocol of Section 4.7.

3.1. Overview of Cyberattack Types

In Figure 3, cyberattacks related to the CIA (Confidentiality, Integrity, Availability) triad are sorted by category. These attack types include, but are not limited to, denial-of-service, distributed denial-of-service, phishing, spoofing, and zero-day attacks. It also demonstrates how the cybersecurity landscape has changed with respect to malware/ransomware and insider threats.

Figure 3. Taxonomy of cyberattack types organized by the CIA triad: confidentiality (data privacy attacks such as phishing, man-in-the-middle, and password attacks), integrity (data manipulation attacks such as SQL injection, XSS, and zero-day exploits), and availability (service disruption attacks such as DoS, DDoS, and spoofing).

3.2. Overview of AI Subfields

AI subfields are represented in Figure 4, with examples including ML, NLP, Speech Recognition, Expert Systems, Planning, Robotics, and Computer Vision. This taxonomy illustrates all the types of different uses and functions covered by AI technologies.

Figure 4. Overview of AI subfields and their relationships: machine learning (supervised, unsupervised, and reinforcement learning), deep learning, natural language processing, computer vision, robotics, and expert systems, with representative algorithms for each.

3.3. ML-Driven Techniques for IDS/IPS

ML, a core component of AI, uses statistical models to analyze data, detect patterns, and make predictions without explicit programming. Early ML-based phishing detection studies compared boosting algorithms [39], while foundational techniques such as decision trees on NSL-KDD [40] and Naïve Bayes for SQL injection detection [41] established the basis for modern AI approaches. Table 3 summarizes current ML-based IDS/IPS strategies.

Table 3. Comparing ML methods for detecting intrusion.

Ref	Year	Attack	Dataset	Method	Advantages	Disadvantages	Accuracy
[38]	2020	Phishing	UCI	PSO-based RF	High accuracy	Computationally intensive	96.83%
[42]	2023	Multi-type	NSL, UNSW, CICIDS	NB+Elliptic Envelope	Robust to imbalance	Weak in multiclass	97%
[43]	2020	IoT IDS	AWID	SVM, Semi-distributed	High accuracy, low FAR	Dataset limitations	99.97%
[44]	2020	MQTT DoS	MQTT	Support Vector Regression (SVR) + Complex Event Processing (CEP)	Scalable, real-time	MQTT-specific, limited scope	99.998%
[45]	2022	Normal, DoS, etc.	NSL-KDD	Firefly Algorithm (FA) + XGBoost	High accuracy, effective hyperparameter tuning	Computationally intensive, requires parameter tuning	89.68–91.42%
[46]	2021	General intrusions	Honeypot, NSL-KDD, Kyoto	Ensemble feature selection + classification (voting)	Reduced feature set, robust classifier via voting	Cloud-specific; no validation on recent datasets	96.06% (NSL-KDD); 99.93% (Kyoto); 99.89% (Honeypot)
[47]	2024	Multi-class intrusions	NSL-KDD	LSTM (Long Short-Term Memory) + Continuous Learning + Blockchain	Self-adaptive, near-perfect accuracy, secure via Trusted Execution Environment (TEE)	Requires Trusted Execution Environments (TEEs)	99.94%
[48]	2020	IoT Botnet (Mirai, Bashlite)	N-BaIoT	Fisher score + GXGBoost	High accuracy (99.96%) with only 3 features; low FPR; efficient for resource-constrained IoT	No guarantee of global optima for XGBoost parameters; GA sensitivity to initial population	99.96%
[49]	2020	Phishing detection	Multiple (email, URL, website)	PhishBench framework (30+ classifiers, 226 features)	Comprehensive benchmarking; feature taxonomy; diverse datasets	Not a detection system; computational overhead (AutoML)	Up to 99.95% F1-score
[15]	2020	Phishing	1705 emails (1291 ham, 404 phished)	SVM + NLP + PNN	High accuracy, hybrid approach	Small dataset; not publicly named	98.3%
[23]	2020	General intrusions (KDD attack classes)	KDD99	PCA + Random Forest	More accurate and faster than SVM, NB, and DT baselines	Legacy KDD dataset only; reported accuracy (96.78%) and error rate (0.21%) are inconsistent	96.78%
[19]	2020	DDoS saturation attacks in SDN (TCP-SYN, UDP, ICMP, TCP-SARFU)	Custom SDN traffic (simulated and physical environments)	K-NN, NB, SVM, Isolation Forest, and ANN, tested with an adversarial evasion tool	Systematic adversarial-robustness evaluation	Recall dropped from 96% to 8% (K-NN) under evasion attacks	Not reported (recall 96%, precision 95% for K-NN without attack)
[50]	2020	IoT attack traffic (Bot-IoT)	BoT-IoT (44 features)	Bijective soft set selection among five ML classifiers (NB, Bayes Net, C4.5, RF, Random Tree)	Systematic selection of the most effective classifier	Evaluated on a single dataset	99.99% (C4.5, RF, Random Tree); 99.79% (selected NB)

Table 3. Comparing ML methods for detecting intrusion.

Ref	Year	Attack	Dataset	Method	Advantages	Disadvantages	Accuracy
[38]	2020	Phishing	UCI	PSO-based RF	High accuracy	Computationally intensive	96.83%
[42]	2023	Multi-type	NSL, UNSW, CICIDS	NB+Elliptic Envelope	Robust to imbalance	Weak in multiclass	97%
[43]	2020	IoT IDS	AWID	SVM, Semi-distributed	High accuracy, low FAR	Dataset limitations	99.97%
[44]	2020	MQTT DoS	MQTT	Support Vector Regression (SVR) + Complex Event Processing (CEP)	Scalable, real-time	MQTT-specific, limited scope	99.998%
[45]	2022	Normal, DoS, etc.	NSL-KDD	Firefly Algorithm (FA) + XGBoost	High accuracy, effective hyperparameter tuning	Computationally intensive, requires parameter tuning	89.68–91.42%
[46]	2021	General intrusions	Honeypot, NSL-KDD, Kyoto	Ensemble feature selection + classification (voting)	Reduced feature set, robust classifier via voting	Cloud-specific; no validation on recent datasets	96.06% (NSL-KDD); 99.93% (Kyoto); 99.89% (Honeypot)
[47]	2024	Multi-class intrusions	NSL-KDD	LSTM (Long Short-Term Memory) + Continuous Learning + Blockchain	Self-adaptive, near-perfect accuracy, secure via Trusted Execution Environment (TEE)	Requires Trusted Execution Environments (TEEs)	99.94%
[48]	2020	IoT Botnet (Mirai, Bashlite)	N-BaIoT	Fisher score + GXGBoost	High accuracy (99.96%) with only 3 features; low FPR; efficient for resource-constrained IoT	No guarantee of global optima for XGBoost parameters; GA sensitivity to initial population	99.96%
[49]	2020	Phishing detection	Multiple (email, URL, website)	PhishBench framework (30+ classifiers, 226 features)	Comprehensive benchmarking; feature taxonomy; diverse datasets	Not a detection system; computational overhead (AutoML)	Up to 99.95% F1-score
[15]	2020	Phishing	1705 emails (1291 ham, 404 phished)	SVM + NLP + PNN	High accuracy, hybrid approach	Small dataset; not publicly named	98.3%
[23]	2020	General intrusions (KDD attack classes)	KDD99	PCA + Random Forest	More accurate and faster than SVM, NB, and DT baselines	Legacy KDD dataset only; reported accuracy (96.78%) and error rate (0.21%) are inconsistent	96.78%
[19]	2020	DDoS saturation attacks in SDN (TCP-SYN, UDP, ICMP, TCP-SARFU)	Custom SDN traffic (simulated and physical environments)	K-NN, NB, SVM, Isolation Forest, and ANN, tested with an adversarial evasion tool	Systematic adversarial-robustness evaluation	Recall dropped from 96% to 8% (K-NN) under evasion attacks	Not reported (recall 96%, precision 95% for K-NN without attack)
[50]	2020	IoT attack traffic (Bot-IoT)	BoT-IoT (44 features)	Bijective soft set selection among five ML classifiers (NB, Bayes Net, C4.5, RF, Random Tree)	Systematic selection of the most effective classifier	Evaluated on a single dataset	99.99% (C4.5, RF, Random Tree); 99.79% (selected NB)

Through the use of machine learning, research into IDS/IPS techniques has made remarkable progress regarding scalability, adaptability, and accuracy, largely due to the introduction of new optimization techniques, such as Particle Swarm Optimization (PSO), that improve feature selection used for the detection of human-generated phishing attacks. For example, a PSO-based Random Forest (RF) model reached 96.83% accuracy for phishing website detection [38]. Many researchers are now using ensemble methodologies (e.g., Naive Bayes + Elliptic Envelope [42]) and optimization-driven approaches such as firefly algorithm-optimized XGBoost [45] to provide improved robustness and lower false positive rates, but their effectiveness can vary greatly based on the dataset being analyzed.

Krishnaveni et al. [46] combined ensemble feature selection with a voting classifier for cloud environments, reporting 96.06% accuracy on NSL-KDD, 99.93% on Kyoto, and 99.89% on honeypot data. Combining blockchain technology with machine learning, Aliyu et al. [47] created a model based on continuous learning using Long Short-Term Memory (LSTM) networks within Trusted Execution Environments (TEEs), which achieved 99.94% accuracy when tested against data from the NSL-KDD dataset. Alqahtani et al. [48] proposed a lightweight IoT botnet detection approach using Fisher-score-based feature selection combined with a genetic-based extreme gradient boosting (GXGBoost) model, achieving 99.96% accuracy with only three out of 115 features on the N-BaIoT dataset. El Aassal et al. [49] conducted a comprehensive benchmarking study of phishing detection methods using PhishBench, a framework with 226 features and 30+ classifiers, achieving up to 99.95% F1-score on email datasets. Kumar et al. [15] proposed a hybrid SVM-NLP-PNN approach, achieving 98.3% accuracy on a dataset of 1705 emails. Shafiq et al. [50] used a bijective soft set approach to select the most effective classifier among five ML algorithms (Naïve Bayes, Bayes Net, C4.5, Random Forest, and Random Tree) for identifying attack traffic in the BoT-IoT dataset (44 features); all five exceeded 99.7% accuracy, and Naïve Bayes (99.79%) was selected because of its short model-building time. Waskle et al. [23] combined principal component analysis with a Random Forest classifier on the KDD dataset (96.78% accuracy), and Khamaiseh et al. [19] evaluated K-NN, Naïve Bayes, SVM, Isolation Forest, and ANN detectors of SDN saturation attacks against adversarial evasion attacks, showing that their recall dropped by more than 90% (e.g., from 96% to 8% for K-NN).

A review of related literature regarding machine learning-driven intrusion detection/prevention system design indicates a shift toward using hybrid, blockchain-enabled, or federated architectures as opposed to focusing solely on individual-model and dataset use cases. This shift is consistent with an emphasis on real-time detection, scalability, and resilience to zero-day attacks. There still exists a large number of challenges related to validating these approaches in real networks, as well as handling the computational demands of implementing some advanced architectures (i.e., Trusted Execution Environments and federated solutions).

Synthesis. Across the eleven ML studies that report accuracy (Table 3; [49] reports only an F1-score and [19] only recall and precision), the highest reported values range from 91.42% to 99.998% (median 99.9%). The studies share a reliance on feature selection or metaheuristic tuning (PSO, firefly algorithm, Fisher score, ensemble feature selection) to obtain compact models, which makes them attractive for resource-constrained settings. They differ mainly in their target environment (phishing, IoT, MQTT, cloud) and in their datasets, which are often domain-specific. Their common weakness is limited validation on recent, multi-class network traffic.

3.4. Deep Learning Techniques in Intrusion Detection and Prevention Systems

Deep Learning (DL) represents one area within the larger domain of ML that uses deep neural networks (DNN). Due to its ability to effectively perform in solving challenging classification problems, which include, but are not restricted to, intrusion detection (ID) and malware detection (MD), DL has demonstrated a performance advantage compared with other approaches to the problem. Ultimately, many examples show how DL-based solutions for detecting and responding to cyberattacks can be constructed and used (see Table 4).

Table 4. Overview of Deep Learning Approaches for IDS.

Ref	Year	Attack	Dataset	Method	Advantages	Disadvantages	Accuracy
[51]	2019	DoS, U2R, R2L	KDD Cup 99	LeNet-5 CNN (Convolutional Neural Network)	Fast detection	Computationally intensive	98.88%
[52]	2023	Fabrication, Unknown	HCRL, ORNL	DESC-IDS	Low latency	Hyperparameter-sensitive	96.44–98.80%
[53]	2022	DDoS, Malware	CIC-IDS2017, CIC-DDoS2019	Transformer-based	High Adaptability	Early-stage tech	98.45–98.58%
[37]	2023	Cloud-IoT	CIC-IDS2017	Transfer learning + CNN	Efficient, adaptive	Slight misclassification between Benign and Infiltration classes	100%
[54]	2021	General intrusions (known and innovative attacks)	CIC-IDS2017	CNN	High accuracy on 15 traffic classes; lowest FAR among ten compared classifiers	Poor detection of rare classes (Botnet, SQL injection)	99.78%
[55]	2021	Mirai Malware	Modbus	Federated learning (GRU models) + ensembler	Preserves data privacy	Latency issues	99.5%
[22]	2020	Phishing websites	UCI Phishing Websites	Deep neural network with discriminative layer training	Embedded in an ISP-level framework that blocks domains flagged as phishing	Only accuracy reported; framework not evaluated in deployment	97.51%

Table 4. Overview of Deep Learning Approaches for IDS.

Ref	Year	Attack	Dataset	Method	Advantages	Disadvantages	Accuracy
[51]	2019	DoS, U2R, R2L	KDD Cup 99	LeNet-5 CNN (Convolutional Neural Network)	Fast detection	Computationally intensive	98.88%
[52]	2023	Fabrication, Unknown	HCRL, ORNL	DESC-IDS	Low latency	Hyperparameter-sensitive	96.44–98.80%
[53]	2022	DDoS, Malware	CIC-IDS2017, CIC-DDoS2019	Transformer-based	High Adaptability	Early-stage tech	98.45–98.58%
[37]	2023	Cloud-IoT	CIC-IDS2017	Transfer learning + CNN	Efficient, adaptive	Slight misclassification between Benign and Infiltration classes	100%
[54]	2021	General intrusions (known and innovative attacks)	CIC-IDS2017	CNN	High accuracy on 15 traffic classes; lowest FAR among ten compared classifiers	Poor detection of rare classes (Botnet, SQL injection)	99.78%
[55]	2021	Mirai Malware	Modbus	Federated learning (GRU models) + ensembler	Preserves data privacy	Latency issues	99.5%
[22]	2020	Phishing websites	UCI Phishing Websites	Deep neural network with discriminative layer training	Embedded in an ISP-level framework that blocks domains flagged as phishing	Only accuracy reported; framework not evaluated in deployment	97.51%

Due to the ability of deep learning-based intrusion detection and prevention systems to deal with the complexity of high-dimensional data, they are emerging as the dominant form of intrusion detection. CNN-based models such as LeNet-5 [51] were able to provide quick detection of intrusions, with high accuracy rates (98.88%); however, they experienced issues related to scalability in addition to having considerable computational overhead. More contemporary models based on transformers [53] have been able to increase their adaptability regardless of dataset types, while achieving accuracies in excess of 98%, yet they have not yet reached a level of maturity considered to be acceptable within the industry. One of the main trends in intrusion detection is the incorporation of transfer learning into models so as to increase the model’s ability to generalize when used in different environments. For instance, CNN-based transfer learning models [37] were able to achieve perfect intrusion detection rates of 100% when utilized in Cloud-IoT environments.

Other frameworks that are designed to provide low latency, such as DESC-IDS [52], have achieved between 96.44% and 98.80% accuracy; therefore, they have demonstrated the capability to provide real-time intrusion detection services in critical infrastructure applications. Ho et al. [54] proposed a CNN-based IDS for known and innovative attacks, evaluated on CIC-IDS2017 (99.78% accuracy across 15 traffic classes, with a false alarm rate of about 1%), and Mothukuri et al. [55] trained GRU models with federated learning, keeping traffic data on local devices and combining the global models with an ensembler (99.5%). Maurya and Jain [22] used a deep neural network with discriminative layer training on the UCI phishing websites dataset (97.51% accuracy) and embedded it in an ISP-level framework that blocks domains flagged as phishing.

Overall, deep learning intrusion detection models continue to evolve, resulting in hybrid, transformer, and transfer learning solutions that have a superior level of adaptability and robustness in comparison to traditional CNN models. Nonetheless, there are still significant limitations associated with the current state of deep learning intrusion detection models, which include computational expense, deployment challenges in the real world, and instances of overfitting; however, there are numerous architectures available in the current state that demonstrate promise in addressing these challenges.

Synthesis. The seven DL studies in Table 4 report a narrow accuracy range (97.51–100%, median 98.9%), but they were evaluated on few datasets, mainly KDD Cup 99, CIC-IDS2017, and domain-specific data (CAN bus, Modbus, and phishing websites). They agree that deep architectures remove the need for manual feature engineering and capture complex temporal or spatial patterns; they differ in their trade-off between speed (LeNet-5, stream clustering) and adaptability (transformers, transfer learning). The 100% accuracy reported in [37] should be interpreted with caution, as such values on a single benchmark may reflect dataset-specific artifacts or overfitting rather than generalizable performance (Section 4.3).

3.5. Hybrid Intelligence Frameworks for Cyberattack Detection and Prevention

Hybrid models for AI combine ML, DL, symbolic reasoning, and blockchain technologies to create accurate and robust capabilities that enable real-time detection; thus, these hybridized methodologies of various data types (e.g., numerical and categorical) provide a strong defense against cybercrimes. In Table 5 below, several examples illustrate how these hybrid techniques are being adopted to enhance ML, DL, and blockchain capabilities as they relate to cyber defense. For example, Samunnisa et al. [56] combined K-Means clustering with a Random Forest classifier for distributed cloud environments and reported 99% accuracy on the NSL-KDD and KDDCup99 datasets, although with an elevated false alarm rate on test data. Nizamudeen [57] proposed a swarm-based framework that uses an opposition-based learning rat-inspired optimizer (OBL-RIO) for feature selection and a two-dimensional array-based CNN as the classifier, reporting 95.20% accuracy, a 2.5% false positive rate, and a 97.24% detection rate on the NetFlow-based NF-UQ-NIDS dataset. In both cases, feature selection and hyperparameter tuning are critical for achieving optimal performance.

Table 5. Hybrid AI Models for Cyberattack Detection and Prevention.

Ref	Year	Attack	Dataset	Method	Advantages	Disadvantages	Accuracy
[56]	2023	DoS, Probe	NSL-KDD, KDDCup99	K-Means, RF	Scalable for cloud environments	Elevated false alarm rate on test data	99%
[57]	2023	DDoS, Malware	NF-UQ-NIDS	Swarm-based DL	Flexible multi-cloud	Computational overhead	95.20%
[58]	2021	DoS	KDD’99	RNN+ Metaheuristics	Adaptive to evolving threats	Requires extensive validation	94.12%
[59]	2022	General	NSL-KDD	Autoencoder (AE) + LSTM (2-stage)	Risk mitigation	High FAR	89%
[60]	2024	Fuzzers, DoS, Exploits, etc.	UNSW-NB15, CIC-IDS2017, NSL-KDD	BERT large (Transformer) + SMOTE + CNN-LSTM	Explainable decisions (LIME/SHAP)	Resource intensive (340M parameters)	99.21%
[61]	2022	Smart grid attacks	OpenEI	XGBoost + SHA-512	Integrated cryptographic security	Detection only	99.12%
[62]	2025	General intrusions	KDD99, UNSW-NB15	CNN feature extraction + Random Forest	High precision (>98%)	Authors note reliance on the outdated KDD99 dataset	97%

Table 5. Hybrid AI Models for Cyberattack Detection and Prevention.

Ref	Year	Attack	Dataset	Method	Advantages	Disadvantages	Accuracy
[56]	2023	DoS, Probe	NSL-KDD, KDDCup99	K-Means, RF	Scalable for cloud environments	Elevated false alarm rate on test data	99%
[57]	2023	DDoS, Malware	NF-UQ-NIDS	Swarm-based DL	Flexible multi-cloud	Computational overhead	95.20%
[58]	2021	DoS	KDD’99	RNN+ Metaheuristics	Adaptive to evolving threats	Requires extensive validation	94.12%
[59]	2022	General	NSL-KDD	Autoencoder (AE) + LSTM (2-stage)	Risk mitigation	High FAR	89%
[60]	2024	Fuzzers, DoS, Exploits, etc.	UNSW-NB15, CIC-IDS2017, NSL-KDD	BERT large (Transformer) + SMOTE + CNN-LSTM	Explainable decisions (LIME/SHAP)	Resource intensive (340M parameters)	99.21%
[61]	2022	Smart grid attacks	OpenEI	XGBoost + SHA-512	Integrated cryptographic security	Detection only	99.12%
[62]	2025	General intrusions	KDD99, UNSW-NB15	CNN feature extraction + Random Forest	High precision (>98%)	Authors note reliance on the outdated KDD99 dataset	97%

Hybrid AI models that utilize multiple approaches, notably machine learning (ML), deep learning (DL), symbolic reasoning, and blockchain, are becoming popular as a way to minimize the limitations of each individual technique. To create a greater degree of flexibility and lower risk, earlier studies attempted to integrate RNNs with metaheuristic methods [58] and AEs with LSTMs [59]. However, these methods suffered from significant false positive rates and little verification capacity, exposing scalability issues. Similarly, hybrid models that leverage the capabilities of both transformer and transfer learning have been able to achieve 99.21% accuracy rates by addressing the issue of class imbalance [60]. More recently, hybrid clustering–classification schemes have reported accuracies of about 99% [56], and swarm-optimized feature selection combined with a CNN classifier has reported 95.2% accuracy [57]; both, however, require additional optimization steps that increase training time.

Much of the overhead related to computation and power consumption continues to create critical issues for hybrid AI model adoption, reinforcing the importance of using greener consensus mechanisms (e.g., PoS) and reducing environmental impact. Recent research has combined the Falcon optimization algorithm with an attention-based transformer and an explainable prevention module [63] (98.7% accuracy; Section 3.9), and transformer-based transfer learning has reached up to 99.21% accuracy [60] (Table 5). Other hybrid applications, including XGBoost combined with SHA-512 [61], may assist in merging cryptographic security with machine learning for use in mission-critical systems (e.g., Smart Grid applications).

The goal of these hybrid intelligence models is to develop IDS/IPS solutions that can be used in a more explainable, secure, and adaptable manner. Some areas for future improvements include integrating blockchain technology, using meta-heuristic optimization techniques, and developing transformer architectures. At this time, however, hybrid intelligence models are not yet able to be used practically due to limitations imposed by high computational demands, energy usage, and insufficient real-world testing outside of standard benchmarking data.

Synthesis. The seven hybrid studies in Table 5, including the CNN–RF approach of [62] (97% accuracy on KDD99 and UNSW-NB15), report accuracies from 89% to 99.21% (median 97.0%), i.e., a wider range than DL or blockchain-based studies. Hybridization therefore does not by itself guarantee higher reported accuracy; its main reported benefits are complementary capabilities (e.g., explainability in [60], cryptographic integrity in [61], scalability in cloud settings in [56]). The common cost is higher training time and resource consumption, which conflicts with the deployment dimensions of RQ2.

3.6. Blockchain-Enabled Intrusion Detection and Prevention

IDS based on blockchain provides security, data integrity, and transparency, particularly in distributed and collaborative environments. Table 6 shows a summary of the performance measures, advantages, disadvantages, and techniques of these varying approaches to blockchain IDS.

Table 6. Cyberattack Detection and Prevention Using Blockchain Techniques.

Ref	Year	Attack	Dataset	Method	Advantages	Disadvantages	Accuracy
[64]	2020	Anomalies	UNSW-NB15, BoT-IoT	Blockchain, DL	Transparent decision-making	Communication complexity; traffic overhead	99.41%
[65]	2024	General intrusions	KDD Cup 1999	Federated Learning (FL), Blockchain	Preserves data privacy	Latency issues; requires institutional coordination	98%
[66]	2021	DDoS	BoT-IoT	Blockchain + fog computing	Real-time, accurate	No FAR metric	99.998%
[67]	2023	DDoS, Probing, Malware	KDD99, UNSW-NB15	Hybrid Decision Tree + Blockchain	Real-time detection, privacy via blockchain, high throughput	Not validated in production environments	99.95%(KDD99), 99.72%(UNSW-NB15)
[16]	2023	SDN-based Attacks, DoS	Custom IIoT Dataset	CNN + Blockchain + SDN	Resilient SDN-rule protection, layered defense	Requires expensive SDN infrastructure; fine-tuning needed	≈99% (multi-class)

Table 6. Cyberattack Detection and Prevention Using Blockchain Techniques.

Ref	Year	Attack	Dataset	Method	Advantages	Disadvantages	Accuracy
[64]	2020	Anomalies	UNSW-NB15, BoT-IoT	Blockchain, DL	Transparent decision-making	Communication complexity; traffic overhead	99.41%
[65]	2024	General intrusions	KDD Cup 1999	Federated Learning (FL), Blockchain	Preserves data privacy	Latency issues; requires institutional coordination	98%
[66]	2021	DDoS	BoT-IoT	Blockchain + fog computing	Real-time, accurate	No FAR metric	99.998%
[67]	2023	DDoS, Probing, Malware	KDD99, UNSW-NB15	Hybrid Decision Tree + Blockchain	Real-time detection, privacy via blockchain, high throughput	Not validated in production environments	99.95%(KDD99), 99.72%(UNSW-NB15)
[16]	2023	SDN-based Attacks, DoS	Custom IIoT Dataset	CNN + Blockchain + SDN	Resilient SDN-rule protection, layered defense	Requires expensive SDN infrastructure; fine-tuning needed	≈99% (multi-class)

Implementing blockchain-based IDS provides a tamper-resistant audit trail and decentralized trust [64]. However, there are significant challenges in deploying blockchain-based IDS in the real world. Proof-of-Work (PoW) consensus is energy-intensive, which raises scalability issues in resource-constrained environments, and maintaining a synchronized ledger requires stable, high-bandwidth connectivity. On-chain validation also adds latency to each decision, because alerts or model updates must be confirmed by the consensus protocol before they take effect. Transitioning to Proof-of-Stake (PoS) consensus substantially reduces energy consumption, and layer-2 scaling solutions are available; nevertheless, the fundamental trade-off between performance, security, and decentralization remains unresolved for blockchain-based IDS.

Federated Learning methods face difficulties in handling non-IID (non-independent and identically distributed) data, which can substantially degrade accuracy [68]. These issues can be mitigated by aggregation protocols such as FedProx [69] (e.g., with a proximal parameter µ = 0.1 or µ = 1). Furthermore, practical implementations face resource constraints: swarm-based optimization increases training cost, and blockchain synchronization requires stable network connectivity. Balancing detection performance against this overhead is therefore essential for hybrid IDS solutions. Almaghthawi et al. [65] evaluated their FL-based IDS on the KDD Cup 1999 dataset, achieving 98% accuracy on the validation set. Notably, deep learning models such as CNNs have also demonstrated remarkable standalone performance in detecting cyberattacks, achieving detection rates as high as 99.78% on standard intrusion detection datasets such as CIC-IDS2017 [54].

Synthesis. Blockchain-based studies (Table 6) report consistently high accuracy (98–99.998%, median 99.4%; five studies), but this consistency must be read together with their datasets (mostly BoT-IoT, KDD99, and UNSW-NB15) and with the fact that the blockchain layer provides integrity, traceability, and collaboration rather than detection capability per se. They share common limitations: latency and energy overhead, synchronization requirements, and the absence of validation in production environments.

3.7. Applications of Reinforcement Learning in Intrusion Detection and Prevention

Reinforcement Learning (RL) is a form of ML where an agent learns from its interaction(s) with the environment (e.g., receiving rewards or punishments) in order to develop optimal decision-making strategies. RL can be used for dynamic decision-making under uncertain conditions, such as determining whether a cyber-attack is present. Table 7 shows an overview of several RL-based Intrusion Detection System (IDS) solutions, including details about their purpose/research focus, methods, main findings, advantages/disadvantages, and accuracy levels.

Table 7. Reinforcement Learning-Based IDS Solutions for Cyberattack Detection and Prevention.

Ref	Year	Attack	Dataset	Method	Advantages	Disadvantages	Accuracy
[70]	2025	Generic	NSL-KDD, CIC-IDS2018	Deep Q-Learning RL	High adaptability to evolving threats	High false positives	97.18%
[17]	2025	Complex	IoMT datasets	Actor-Critic RL	Combines NIDS & HIDS features	Needs careful reward design	99.58% (binary), 77.73% (multi-class)
[71]	2022	Generic	CSE-CIC-IDS2018	RFE feature selection + Deep Q-Learning (DRL)	Removes ~80% of redundant features; adaptive to evolving threats	Requires careful reward design; supervised dataset adaptation	96.2% (binary)
[72]	2023	Generic	CSE-CIC-IDS2018, NSL-KDD	RL with oversampling	Addresses imbalanced datasets	Fails on rare attacks (0% for ftp_write, loadmodule)	99.81% (NSL-KDD), 98.46% (CSE-CIC-IDS2018)
[73]	2023	Multi-class intrusions	CSE-CIC-IDS2018, NSL-KDD	Deep Q-Learning (DQL) + GCN + multi-agent feature selection	Adaptive, handles imbalanced data, reduces redundant features by ~80%	Feature selection requires additional training time	96.8% (CSE-CIC-IDS2018), 99.1% (NSL-KDD)
[18]	2024	MiTM, DDoS, ransomware, buffer overflow	5G MEC dataset	Hybrid DRL (DDPG actor-critic)	Combines NIDS & HIDS features	Low F1-score (25.42%)	58.17%

Table 7. Reinforcement Learning-Based IDS Solutions for Cyberattack Detection and Prevention.

Ref	Year	Attack	Dataset	Method	Advantages	Disadvantages	Accuracy
[70]	2025	Generic	NSL-KDD, CIC-IDS2018	Deep Q-Learning RL	High adaptability to evolving threats	High false positives	97.18%
[17]	2025	Complex	IoMT datasets	Actor-Critic RL	Combines NIDS & HIDS features	Needs careful reward design	99.58% (binary), 77.73% (multi-class)
[71]	2022	Generic	CSE-CIC-IDS2018	RFE feature selection + Deep Q-Learning (DRL)	Removes ~80% of redundant features; adaptive to evolving threats	Requires careful reward design; supervised dataset adaptation	96.2% (binary)
[72]	2023	Generic	CSE-CIC-IDS2018, NSL-KDD	RL with oversampling	Addresses imbalanced datasets	Fails on rare attacks (0% for ftp_write, loadmodule)	99.81% (NSL-KDD), 98.46% (CSE-CIC-IDS2018)
[73]	2023	Multi-class intrusions	CSE-CIC-IDS2018, NSL-KDD	Deep Q-Learning (DQL) + GCN + multi-agent feature selection	Adaptive, handles imbalanced data, reduces redundant features by ~80%	Feature selection requires additional training time	96.8% (CSE-CIC-IDS2018), 99.1% (NSL-KDD)
[18]	2024	MiTM, DDoS, ransomware, buffer overflow	5G MEC dataset	Hybrid DRL (DDPG actor-critic)	Combines NIDS & HIDS features	Low F1-score (25.42%)	58.17%

Studies show promising results with regard to combining Deep Q-Learning (DQL) and multi-agent framework elements [70,73], obtaining accuracy rates of 97.18% on NSL-KDD and CIC-IDS2018 [70] and up to 99.1% on NSL-KDD [73] without losing flexibility due to the changing nature of attacks. However, many of these newer methods created more complex models and higher false positive rates than traditional methods, making them difficult to deploy effectively. There has been a growing interest in hybrid Reinforcement Learning (RL) architectures. An excellent example of hybrid RL success can be seen with the use of Actor–Critic models on an Internet of Medical Things (IoMT) dataset [17] that integrated attributes derived from both Network Intrusion Detection Systems (NIDS) and Host Intrusion Detection Systems (HIDS) to yield a binary classification accuracy of 99.58% but only an accuracy of 77.7% for a multiclass classification, illustrating that hybrid architectural models struggle with generalization. Feature selection-driven RL approaches, such as the ID-RDRL model proposed by Ren et al. [71], combine Recursive Feature Elimination (RFE) with Deep Q-Learning to reduce redundant features by approximately 80% while achieving 96.2% binary classification accuracy on the CSE-CIC-IDS2018 dataset. Similarly, oversampling-enhanced RL methods [72] address class imbalance but may fail on rare attack types. These approaches demonstrate the potential of reinforcement learning for efficient feature selection, though most research remains in early phases of evaluation. Based on current research regarding RL-based intrusion detection and/or prevention systems, we see a trend toward highly adaptive, self-learning systems capable of proactively responding to new forms of threats. The major barriers preventing the successful implementation of RL-driven architecture are high computing costs, unstable training processes, and the absence of common evaluation criteria. Future research must connect the experimentation stage of RL-based IDS/IPSs with actual networks to demonstrate that RL can serve as a sound, effective cybersecurity methodology.

Synthesis. RL studies (Table 7) show the widest dispersion of all categories (58.17–99.81%, median 98.1%). High values are obtained for binary or feature-selection tasks on NSL-KDD and CSE-CIC-IDS2018, whereas multi-class detection on recent, domain-specific data (IoMT [17], 5G MEC [18]) yields much lower values. The common strength is adaptability to changing traffic; the common weaknesses are reward design, training instability, and poor performance on rare attack classes [72].

3.8. Ensemble Learning Approaches for Intrusion Detection and Prevention Systems

Multiple machine learning models combined together form Ensemble Learning, providing more accurate predictions by benefiting from each model’s strengths as well as their unique abilities. This approach is especially useful when used in the field of IDS, as it helps provide increased protection against adversarial attacks and improve the general robustness of the model. Table 8 presents examples of IDSs using ensemble learning methods, specifically used for detecting/preventing cyberattacks.

Table 8. An Overview of Intrusion Detection Systems Using Ensemble Learning.

Ref	Year	Attack	Dataset	Method	Advantages	Disadvantages	Accuracy
[74]	2020	General Intrusions	NSL-KDD, UNSW-NB15	Bayesian CNN + Ensemble	Low false alarms	Computationally expensive	99.12%
[36]	2025	General Intrusions (DoS, DDoS, PortScan, Web Attack, etc.)	UNSW-NB15, CIC-IDS2017	Stacking ensemble (XGBoost + Extra Trees + Logistic Regression) with attention-based BiLSTM meta-classifier	High accuracy, attention-based dynamic fusion, handles class imbalance	Computational overhead, complex meta-classifier	98.94% (UNSW-NB15 binary) 83.33% (UNSW-NB15 multiclass) 95.27% (CIC-IDS2017 binary), 97.26% (CIC-IDS2017 multiclass)
[75]	2024	General Intrusions	NSL-KDD, CIC-IDS2017	Stacking (RF, XGBoost, Extra Trees)	High accuracy and robustness	Requires feature selection	99.99%
[76]	2025	General Intrusions	NSL-KDD	AutoML-based Stacked	High accuracy (90%), F1-score 89%	NSL-KDD only, no XAI	90% (NSL-KDD)
[77]	2023	General Intrusions	CIC-IDS2017	Ensemble learning (Bagging + Random Forest, AdaBoost, LPBoost, RUSBoost)	High accuracy and robustness	Computationally intensive; training time varies by sub-dataset	99.821% (RUSBoost, avg.); 99.997% (Bagging, DS2)

Table 8. An Overview of Intrusion Detection Systems Using Ensemble Learning.

Ref	Year	Attack	Dataset	Method	Advantages	Disadvantages	Accuracy
[74]	2020	General Intrusions	NSL-KDD, UNSW-NB15	Bayesian CNN + Ensemble	Low false alarms	Computationally expensive	99.12%
[36]	2025	General Intrusions (DoS, DDoS, PortScan, Web Attack, etc.)	UNSW-NB15, CIC-IDS2017	Stacking ensemble (XGBoost + Extra Trees + Logistic Regression) with attention-based BiLSTM meta-classifier	High accuracy, attention-based dynamic fusion, handles class imbalance	Computational overhead, complex meta-classifier	98.94% (UNSW-NB15 binary) 83.33% (UNSW-NB15 multiclass) 95.27% (CIC-IDS2017 binary), 97.26% (CIC-IDS2017 multiclass)
[75]	2024	General Intrusions	NSL-KDD, CIC-IDS2017	Stacking (RF, XGBoost, Extra Trees)	High accuracy and robustness	Requires feature selection	99.99%
[76]	2025	General Intrusions	NSL-KDD	AutoML-based Stacked	High accuracy (90%), F1-score 89%	NSL-KDD only, no XAI	90% (NSL-KDD)
[77]	2023	General Intrusions	CIC-IDS2017	Ensemble learning (Bagging + Random Forest, AdaBoost, LPBoost, RUSBoost)	High accuracy and robustness	Computationally intensive; training time varies by sub-dataset	99.821% (RUSBoost, avg.); 99.997% (Bagging, DS2)

Ensemble learning is highlighted in several studies as an effective approach for IDS. In 2020, Zhang et al. [74] examined the NSL-KDD and UNSW-NB15 datasets utilizing a Bayesian method that incorporated a Convolutional Neural Network (CNN) with ensemble methods to achieve complete intrusion detection. Although it was resource-intensive, this approach resulted in very low false alarm rates and an accuracy of 99.12%. Recent ensemble learning approaches have demonstrated significant advances in intrusion detection performance. Antony Joseph Raj and Madiajagan [36] proposed HAMC-ID, a two-level stacking ensemble framework that combines three heterogeneous base classifiers—XGBoost, Extra Trees, and Logistic Regression—at Level-0 with an attention-enhanced Bidirectional Long Short-Term Memory (BiLSTM) network serving as the meta-classifier at Level-1. The attention mechanism dynamically reweights base classifier outputs based on meta-features including logits, prediction confidence, and entropy, enabling context-aware decision fusion. Evaluated on the UNSW-NB15 and CIC-IDS2017 benchmark datasets, HAMC-ID achieved accuracies of 98.94% (binary) and 83.33% (multiclass) on UNSW-NB15, and 95.27% (binary) and 97.26% (multiclass) on CIC-IDS2017. For minority attack classes on UNSW-NB15, the model reported F1-scores of 0.5086 (Shellcode) and 0.2781 (Worms), showing that rare classes remain difficult to detect. A stacking method using Random Forest, XGBoost, and Extra Trees achieved 99.99% accuracy with NSL-KDD and CIC-IDS2017 datasets in 2024 [75]; however, careful feature selection was needed. The RUSBoost ensemble method [77] reached an average accuracy of 99.82%, making it a strong class-balancing solution. Meanwhile, the combination of AutoML and stacked ensembles in 2025 provided an automated way to select and combine models, resulting in a high accuracy (90%) on NSL-KDD as well as an F1-score of 89% [76]. These results suggest that AutoML can simplify the development of ensemble-based IDS.

These studies prove that ensemble learning provides significant improvements to intrusion detection and prevention. Each of the methods presents trade-offs with regard to computational complexity, accuracy, or data quality; however, these results emphasize the ability of ensemble techniques to improve accuracy, stability, and reliability in identifying and blocking cyberattacks.

Synthesis. Ensemble studies (Table 8), including the bagging and boosting ensembles of [77], report 90–99.997% (median 99.1%). They agree that combining heterogeneous base learners improves robustness and minority-class detection; they differ in the cost of the combination step, from simple voting to attention-based meta-classifiers. Multi-class results remain markedly lower than binary results on the same dataset (e.g., 83.33% vs. 98.94% on UNSW-NB15 [36]).

3.9. Explainable AI (XAI) in Intrusion Detection and Prevention Systems

By clarifying and making transparent the decisions made by machine learning models, explainable artificial intelligence (XAI) improves IDS’ overall functionality; it provides a degree of trustworthiness as well as accountability to the users. Table 9 contains numerous examples of previous research about various methods of XAI, indicating that XAI is an important component of enhancing attack detection through increased explainability and transparency.

Table 9. Summary of XAI Methods Used in Intrusion Detection Systems.

Ref	Year	Attack	Dataset	Method	Advantages	Disadvantages	Accuracy
[78]	2023	Cloud & IoT	CIDDS-001, CIDDS-002, NF-ToN-IoT-v2	SHAP explainability	Transparent decision-making	Limited adoption in real-world scenarios	Not specified
[35]	2025	General Intrusions	UNSW-NB15	Local Interpretable Model-agnostic Explanations (LIME)-based XAI Framework	Local and global explanations	Moderate accuracy	85%
[79]	2021	General Intrusions	CICIDS2017 (subset)	Autoencoder with kernel-SHAP feature selection	Improved feature selection	Evaluated on a subset of CICIDS2017 only	94%
[80]	2023	General Intrusions	UNSW-NB15	DT-RFECV feature selection + tree-based classifiers (e.g., RF)	Transparent, tree-based selection of 15 of 42 features (~65% fewer)	Binary classification only; no post hoc explanations	95.30% (binary)
[20]	2025	IIoT Security	Edge-IIoTset, UKM-IDS20, CTU-13, NSL-KDD	LENS-XAI Framework	Lightweight and scalable	Preprint; evaluated on benchmark datasets only	95.34% to 99.92%
[63]	2025	Cloud intrusions	CICIDS2017, Honeypot, NSL-KDD	Attention transformer + Falcon optimization + NB, with an explainable prevention module	Interpretable alarms disseminated to neighbouring IDS modules and devices	Prevention limited to alarm dissemination; no latency measured	98.7%

Table 9. Summary of XAI Methods Used in Intrusion Detection Systems.

Ref	Year	Attack	Dataset	Method	Advantages	Disadvantages	Accuracy
[78]	2023	Cloud & IoT	CIDDS-001, CIDDS-002, NF-ToN-IoT-v2	SHAP explainability	Transparent decision-making	Limited adoption in real-world scenarios	Not specified
[35]	2025	General Intrusions	UNSW-NB15	Local Interpretable Model-agnostic Explanations (LIME)-based XAI Framework	Local and global explanations	Moderate accuracy	85%
[79]	2021	General Intrusions	CICIDS2017 (subset)	Autoencoder with kernel-SHAP feature selection	Improved feature selection	Evaluated on a subset of CICIDS2017 only	94%
[80]	2023	General Intrusions	UNSW-NB15	DT-RFECV feature selection + tree-based classifiers (e.g., RF)	Transparent, tree-based selection of 15 of 42 features (~65% fewer)	Binary classification only; no post hoc explanations	95.30% (binary)
[20]	2025	IIoT Security	Edge-IIoTset, UKM-IDS20, CTU-13, NSL-KDD	LENS-XAI Framework	Lightweight and scalable	Preprint; evaluated on benchmark datasets only	95.34% to 99.92%
[63]	2025	Cloud intrusions	CICIDS2017, Honeypot, NSL-KDD	Attention transformer + Falcon optimization + NB, with an explainable prevention module	Interpretable alarms disseminated to neighbouring IDS modules and devices	Prevention limited to alarm dissemination; no latency measured	98.7%

As described in recent studies, the prospects and utilization of XAI in IDS are becoming more prominent in today’s market. For example, in 2023, Gaitan-Cardenas et al. [78] applied the SHAP (SHapley Additive exPlanations) explainability technique to Decision Trees, Random Forest, Logistic Regression, and Feed Forward Neural Networks for intrusion detection in Cloud and IoT environments, using the CIDDS-001, CIDDS-002, and NF-ToN-IoT-v2 datasets. However, despite the emergence of this new technique, there is still a lack of mainstream acceptance for XAI-based IDS in real-world environments. In 2025, a LIME-based XAI framework was developed [35] to provide general intrusion detection on the UNSW-NB15 dataset. This framework provided a mix of local and global explanations, with an accuracy of 85%. Roshan and Zafar [79] used kernel SHAP as a feature-selection technique for an autoencoder-based anomaly detector on a subset of CICIDS2017, reaching 94% accuracy (AUC 0.969). Banu and Sangeetha [63] proposed Intrumer, which combines Falcon-optimization-based feature selection, a Naïve Bayes classifier, and a heterogeneous attention transformer with an explainable prevention module that disseminates interpretable emergency alarms to neighbouring IDS modules and devices, reporting 98.7% accuracy on benchmark datasets (CICIDS2017, honeypot data, and NSL-KDD). Awad and Fraihat [80] used recursive feature elimination with cross-validation and a decision-tree estimator (DT-RFECV) to retain 15 of the 42 UNSW-NB15 features, obtaining 95.30% binary accuracy (95.56% with the full feature set); the reduced, tree-based feature set improves transparency and lowers prediction cost. The LENS-XAI framework [20] applied to IIoT security datasets (e.g., Edge-IIoTset, UKM-IDS20, CTU-13, and NSL-KDD) provided an efficient yet scalable means of detecting potential security threats within the IIoT environment, with reported accuracy values between 95.34% and 99.92%.

Synthesis. The XAI studies (Table 9) report 85–99.92% (median 95.3%). Explanations added to strong detectors preserve high accuracy (e.g., 98.7% in [63] and 95.34–99.92% for the distilled LENS-XAI model [20]), and interpretable feature selection with a decision-tree estimator [80] retains 95.30% accuracy with about 65% fewer features, whereas frameworks in which explanation drives feature selection or model design [35,79] report lower values. This pattern indicates that the interpretability–accuracy trade-off depends on how explanations are integrated, which is discussed in Section 4.5.

4. Discussion

4.1. Performance Synthesis Across Categories

AI-based IDS/IPS solutions offer significant advantages, specifically through increased accuracy in detecting complex or new forms of threats. Many ML models, primarily those utilizing feature selection and optimization techniques, have been able to effectively detect numerous cyber threats [38,41,42]. Hybrid systems combining DL and ML benefit from both methods while minimizing each method’s shortcomings. Two examples of deep learning-type techniques able to detect complex attack patterns in real time are convolutional neural networks (CNNs) and long short-term memory (LSTM) networks. Although highly accurate and effective, these models suffer from hyperparameter sensitivity, have a requirement for large amounts of training data, and are very processor-intensive. Transformer-based models may mitigate some of these challenges: they adapt more flexibly to evolving attack methods and scale well to large volumes of raw data [53].

To quantify the variability in reported performance, we computed summary statistics of the highest accuracy reported by each study in Table 3, Table 4, Table 5, Table 6, Table 7, Table 8 and Table 9 (studies reporting only an F1-score [49], no accuracy [78], or only recall and precision [19] were excluded). For ML-based approaches (n = 11), accuracy ranged from 91.42% to 99.998% (median = 99.9%, mean = 98.2%, SD = 2.6%). For DL-based approaches (n = 7), it ranged from 97.51% to 100% (median = 98.9%, mean = 99.0%, SD = 0.8%). For hybrid models (n = 7), it ranged from 89% to 99.21% (median = 97.0%, mean = 96.1%, SD = 3.7%). Blockchain-based methods (n = 5) reported 98% to 99.998% (median = 99.4%, mean = 99.3%, SD = 0.8%). RL-based approaches (n = 6) exhibited the widest variation, from 58.17% to 99.81% (median = 98.1%, mean = 91.7%, SD = 16.5%). Ensemble methods (n = 5) reported 90% to 99.997% (median = 99.1%, mean = 97.6%, SD = 4.3%), and XAI-based approaches (n = 5) 85% to 99.92% (median = 95.3%, mean = 94.6%, SD = 5.9%). Excluding the preprint [20] (Section 2.2) changes the XAI range to 85–98.7% and its median to 94.7% (n = 4), and affects no other category or conclusion. These statistics are descriptive only: because the underlying studies used different datasets, train–test splits, class definitions (binary vs. multi-class), and evaluation protocols, differences between categories must not be interpreted as evidence that one category outperforms another (Section 5). Latency is discussed separately below, because it was reported by only a few studies and under non-comparable conditions.

Latency was reported by only a few of the reviewed studies, and the reported values cannot be compared across studies: they were obtained on different hardware platforms, traffic loads, and datasets, and with different definitions (per-sample inference time, end-to-end detection time, or decision/validation time). We are not aware of a standard or guideline that defines a universal real-time threshold for intrusion detection, and the acceptable latency depends on the deployment context: inline prevention on high-speed links requires decisions at line rate, whereas alert-based monitoring in a security operations center can tolerate longer delays. Meaningful latency comparisons therefore require a common experimental setup. For example, MAFSIDS [73] reports a testing time of about 34.2 ms per sample, compared with about 300 ms for a random forest and about 3 ms for naïve Bayes baselines evaluated under the same conditions, showing that latency can differ by two orders of magnitude between classifiers. We therefore recommend reporting latency together with the hardware, batch size, and traffic load (see the protocol proposed in Section 4.7).

Figure 5 complements these statistics by showing the distribution of reported accuracies for each category. Three patterns emerge. First, the medians of all categories lie between 95.3% and 99.9%; the central tendency is thus very similar across categories, which differ mainly in their dispersion. Second, the lowest values are associated with specific, harder evaluation settings rather than with a category as such: multi-class detection on a 5G MEC dataset for the hybrid DRL model [18] (58.17%), a LIME-based explainable framework [35] (85%), a two-stage AE–LSTM model [59] (89%), and an AutoML stacked ensemble evaluated on NSL-KDD only [76] (90%). Third, the same study often reports very different values for binary and multi-class tasks (e.g., 99.58% vs. 77.73% [17]; 98.94% vs. 83.33% [36]), which shows that the task definition affects reported accuracy as much as the choice of model.

Figure 5. Distribution of the highest accuracy reported by each study, by methodological category (Table 3, Table 4, Table 5, Table 6, Table 7, Table 8 and Table 9). Boxes show the interquartile range and median; each dot is one study; studies reporting only an F1-score [49], no accuracy [78], or only recall and precision [19] are omitted. Values were obtained on different datasets and protocols and are not directly comparable. Labeled studies: Zivkovic et al. 2022 [45], Mushtaq et al. 2022 [59], Gyimah et al. 2025 [76], Muhammad et al. 2025 [35], and Ghubaish et al. 2024 [18].

Figure 6 cross-tabulates the categories against the datasets they use. NSL-KDD is used in five of the seven categories, CSE-CIC-IDS2018 appears exclusively in RL studies, and BoT-IoT is used mainly in blockchain-based studies. Each category therefore tends to be evaluated on its own subset of benchmarks, which further limits cross-category comparison; for example, the high median of blockchain-based approaches partly reflects their evaluation on BoT-IoT and KDD99, whereas several RL studies were evaluated on more recent and more imbalanced traffic. Figure 7 shows that the tabulated studies cover all years from 2019 to 2025, with RL studies concentrated in 2022–2025 and XAI studies mainly in 2023–2025, consistent with the recent shift toward adaptive and interpretable IDS.

Figure 6. Number of studies in Table 3, Table 4, Table 5, Table 6, Table 7, Table 8 and Table 9 using each benchmark dataset, by methodological category. A study using several datasets is counted once per dataset; “Other/recent/custom” groups all remaining datasets (see Appendix A, Table A1).

Figure 7. Publication year of the 49 studies summarized in Table 3, Table 4, Table 5, Table 6, Table 7, Table 8 and Table 9, by methodological category.

Table 10 consolidates the key characteristics of the studies in Table 3, Table 4, Table 5, Table 6, Table 7, Table 8 and Table 9 by category (dominant datasets, attack types, typical models, reported metrics, accuracy range, and main limitations), and Table 11 contrasts the highest and lowest values reported in each category to illustrate the consistency or discrepancy of results. In several categories, NSL-KDD appears at both ends of the range, showing that the dataset alone does not explain the differences: the task (binary vs. multi-class), the preprocessing, and the evaluation protocol matter as much.

Statistical significance testing. JBI criterion 6 assessed whether results were validated with statistical methods. Among the studies summarized in Table 3, Table 4, Table 5, Table 6, Table 7, Table 8 and Table 9, results are almost always reported as single point estimates; confidence intervals, repeated runs with standard deviations, or formal significance tests (e.g., the Friedman test with post hoc analysis or the Wilcoxon signed-rank test, recommended for comparing classifiers over multiple datasets [81]) are rarely reported. Consequently, differences of a few tenths of a percentage point between models, which are typical in Table 3, Table 4, Table 5, Table 6, Table 7, Table 8 and Table 9, cannot be distinguished from random variation due to data splits or initialization. Future studies should report the mean and standard deviation over repeated runs or cross-validation folds and apply appropriate significance tests when claiming superiority over baselines [34,81].

4.2. Hybrid, Federated, and Blockchain-Based Systems: Deployment Trade-Offs

Hybrid solutions that integrate machine learning, deep learning, and newer technologies, including Federated Learning and Blockchain, have had considerable success. For example, while AI-Blockchain systems require large amounts of processing power, they also provide significantly more transparent decision-making and significantly reduce false positives [65]. By decentralizing the data, Federated Learning (FL)-based IDSs can maintain a high level of privacy for their users; however, they could experience latency and scalability problems during their operation [55]. These hybrid IDS approaches offer many great solutions to today’s problems with IDSs [56,57]. Better clarification and transparency of IDS models through explainable AI (XAI) is required in order for cybersecurity operators to trust the model [79].

Reducing latency. Several techniques can bring hybrid and DL-based IDS closer to deployment latency budgets. Model compression (pruning, quantization, and knowledge distillation [82]) reduces the size and inference time of deep models; LENS-XAI [20], for example, uses knowledge distillation to obtain a lightweight yet explainable detector. Edge computing moves inference close to the traffic source and avoids round trips to the cloud, as in fog-based blockchain IDS [66]. Lightweight architectures, such as ensembles of small autoencoders (Kitsune [83]) or compact gradient-boosted trees using few features (3 of 115 features in [48]), allow per-packet or per-flow decisions on commodity hardware. Finally, latency can be decoupled from heavy components by running a fast first-stage detector inline and delegating expensive steps (e.g., blockchain logging or explanation generation) to an asynchronous second stage.

Lightweight models. In this review, “lightweight models” denotes detectors whose memory footprint, inference time, and energy consumption are compatible with resource-constrained devices (IoT nodes, gateways, and edge servers) without a practically relevant loss of detection quality. Typical examples are (i) compressed DL models obtained by pruning, quantization, or distillation; (ii) shallow models (decision trees, gradient boosting) trained on a reduced feature set; and (iii) federated learning deployments in which only model updates, not raw traffic, are exchanged [84], so that each node trains and runs a small local model. Federated settings must, however, cope with non-IID data, which can be mitigated by proximal aggregation such as FedProx [69].

Sustainable blockchain designs. The energy and latency overhead of PoW-based blockchain IDS can be reduced by (i) switching to Proof-of-Stake or other low-energy consensus protocols (e.g., Proof-of-Authority or practical Byzantine fault tolerance in permissioned consortia), which removes the computational race of PoW; (ii) using sidechains or layer-2 channels, so that only periodic commitments of alert hashes are written to the main chain; (iii) recording hashes of models or alerts rather than raw traffic; and (iv) restricting the blockchain to model-update integrity in federated IDS, as in [65]. These options trade some decentralization for efficiency and should be chosen according to the trust model of the deployment.

Table 10. Consolidated characteristics of the reviewed studies by methodological category (Table 3, Table 4, Table 5, Table 6, Table 7, Table 8 and Table 9).

Category	Studies	Main Datasets	Main Attack Types	Typical Models	Metrics Typically Reported	Accuracy Range (Median)	Main Limitations
ML	13 [15,19,23,38,42,43,44,45,46,47,48,49,50]	NSL-KDD, KDD99, UCI, AWID, MQTT, N-BaIoT, BoT-IoT, email corpora, custom SDN traffic	Phishing, IoT/MQTT DoS, botnets, SDN saturation attacks, general intrusions	RF, SVM/SVR, XGBoost, NB, voting with PSO/firefly/Fisher feature selection	Accuracy; FAR/FPR or F1 in some studies	91.42–99.998% (99.9%)	Domain-specific data; little validation on recent multi-class traffic
DL	7 [22,37,51,52,53,54,55]	KDD Cup 99, CIC-IDS2017, CIC-DDoS2019, HCRL, ORNL, Modbus, UCI	DoS, DDoS, malware, in-vehicle (CAN) attacks, cloud-IoT, phishing	CNN, transformer, transfer learning, stream clustering, federated GRU, deep neural network	Accuracy; latency in [52]	97.51–100% (98.9%)	Computational cost; hyperparameter sensitivity; overfitting risk
Hybrid	7 [56,57,58,59,60,61,62]	NSL-KDD, KDD99, NF-UQ-NIDS, UNSW-NB15, CIC-IDS2017, OpenEI	DoS, probe, DDoS, malware, smart-grid attacks	Clustering + RF, swarm-based DL, RNN + metaheuristics, AE–LSTM, BERT + CNN-LSTM, XGBoost + SHA-512, CNN + RF	Accuracy; FAR	89–99.21% (97.0%)	Training time; resource intensity; high FAR in some designs
Blockchain	5 [16,64,65,66,67]	BoT-IoT, UNSW-NB15, KDD99, custom IIoT	DDoS, probing, malware, anomalies, SDN attacks	DL/CNN/DT with blockchain, FL, fog computing, or SDN	Accuracy; overhead discussed qualitatively	98–99.998% (99.4%)	Latency, energy, synchronization overhead; no production validation
RL	6 [17,18,70,71,72,73]	NSL-KDD, CSE-CIC-IDS2018, IoMT, 5G MEC	Generic intrusions, MiTM, DDoS, ransomware	DQL, multi-agent RL, actor–critic, DDPG	Accuracy, F1, per-class rates; latency in [73]	58.17–99.81% (98.1%)	Training instability; reward design; failure on rare classes
Ensemble	5 [36,74,75,76,77]	NSL-KDD, UNSW-NB15, CIC-IDS2017	General intrusions (DoS, DDoS, port scan, web attacks)	Bayesian CNN ensemble, stacking, AutoML stacking, bagging and boosting	Accuracy, F1, per-class F1	90–99.997% (99.1%)	Computational overhead; meta-classifier complexity
XAI	6 [20,35,63,78,79,80]	UNSW-NB15, CIC-IDS2017, CIDDS, NF-ToN-IoT-v2, Edge-IIoTset, NSL-KDD	General intrusions, cloud/IoT, IIoT	SHAP, LIME, SHAP-based feature selection, interpretable feature selection (DT-RFECV), knowledge distillation, explainable attention transformer	Accuracy, precision; qualitative explanation quality	85–99.92% (95.3%)	Lower accuracy for some explainers; explanation cost; limited field adoption

Table 10. Consolidated characteristics of the reviewed studies by methodological category (Table 3, Table 4, Table 5, Table 6, Table 7, Table 8 and Table 9).

Category	Studies	Main Datasets	Main Attack Types	Typical Models	Metrics Typically Reported	Accuracy Range (Median)	Main Limitations
ML	13 [15,19,23,38,42,43,44,45,46,47,48,49,50]	NSL-KDD, KDD99, UCI, AWID, MQTT, N-BaIoT, BoT-IoT, email corpora, custom SDN traffic	Phishing, IoT/MQTT DoS, botnets, SDN saturation attacks, general intrusions	RF, SVM/SVR, XGBoost, NB, voting with PSO/firefly/Fisher feature selection	Accuracy; FAR/FPR or F1 in some studies	91.42–99.998% (99.9%)	Domain-specific data; little validation on recent multi-class traffic
DL	7 [22,37,51,52,53,54,55]	KDD Cup 99, CIC-IDS2017, CIC-DDoS2019, HCRL, ORNL, Modbus, UCI	DoS, DDoS, malware, in-vehicle (CAN) attacks, cloud-IoT, phishing	CNN, transformer, transfer learning, stream clustering, federated GRU, deep neural network	Accuracy; latency in [52]	97.51–100% (98.9%)	Computational cost; hyperparameter sensitivity; overfitting risk
Hybrid	7 [56,57,58,59,60,61,62]	NSL-KDD, KDD99, NF-UQ-NIDS, UNSW-NB15, CIC-IDS2017, OpenEI	DoS, probe, DDoS, malware, smart-grid attacks	Clustering + RF, swarm-based DL, RNN + metaheuristics, AE–LSTM, BERT + CNN-LSTM, XGBoost + SHA-512, CNN + RF	Accuracy; FAR	89–99.21% (97.0%)	Training time; resource intensity; high FAR in some designs
Blockchain	5 [16,64,65,66,67]	BoT-IoT, UNSW-NB15, KDD99, custom IIoT	DDoS, probing, malware, anomalies, SDN attacks	DL/CNN/DT with blockchain, FL, fog computing, or SDN	Accuracy; overhead discussed qualitatively	98–99.998% (99.4%)	Latency, energy, synchronization overhead; no production validation
RL	6 [17,18,70,71,72,73]	NSL-KDD, CSE-CIC-IDS2018, IoMT, 5G MEC	Generic intrusions, MiTM, DDoS, ransomware	DQL, multi-agent RL, actor–critic, DDPG	Accuracy, F1, per-class rates; latency in [73]	58.17–99.81% (98.1%)	Training instability; reward design; failure on rare classes
Ensemble	5 [36,74,75,76,77]	NSL-KDD, UNSW-NB15, CIC-IDS2017	General intrusions (DoS, DDoS, port scan, web attacks)	Bayesian CNN ensemble, stacking, AutoML stacking, bagging and boosting	Accuracy, F1, per-class F1	90–99.997% (99.1%)	Computational overhead; meta-classifier complexity
XAI	6 [20,35,63,78,79,80]	UNSW-NB15, CIC-IDS2017, CIDDS, NF-ToN-IoT-v2, Edge-IIoTset, NSL-KDD	General intrusions, cloud/IoT, IIoT	SHAP, LIME, SHAP-based feature selection, interpretable feature selection (DT-RFECV), knowledge distillation, explainable attention transformer	Accuracy, precision; qualitative explanation quality	85–99.92% (95.3%)	Lower accuracy for some explainers; explanation cost; limited field adoption

Table 11. Highest and lowest accuracy reported within each category, with the corresponding datasets.

Category	Highest Reported (Ref.; Dataset; Accuracy)	Lowest Reported (Ref.; Dataset; Accuracy)	Spread (Percentage Points)
ML	[44]; MQTT; 99.998%	[45]; NSL-KDD; 91.42%	8.6
DL	[37]; CIC-IDS2017; 100%	[22]; UCI Phishing Websites; 97.51%	2.5
Hybrid	[60]; UNSW-NB15, CIC-IDS2017, NSL-KDD; 99.21%	[59]; NSL-KDD; 89%	10.2
Blockchain	[66]; BoT-IoT; 99.998%	[65]; KDD Cup 1999; 98%	2.0
RL	[72]; NSL-KDD; 99.81%	[18]; 5G MEC; 58.17%	41.6
Ensemble	[77]; CIC-IDS2017; 99.997%	[76]; NSL-KDD; 90%	10.0
XAI	[20]; UKM-IDS20; 99.92%	[35]; UNSW-NB15; 85%	14.9

Table 11. Highest and lowest accuracy reported within each category, with the corresponding datasets.

Category	Highest Reported (Ref.; Dataset; Accuracy)	Lowest Reported (Ref.; Dataset; Accuracy)	Spread (Percentage Points)
ML	[44]; MQTT; 99.998%	[45]; NSL-KDD; 91.42%	8.6
DL	[37]; CIC-IDS2017; 100%	[22]; UCI Phishing Websites; 97.51%	2.5
Hybrid	[60]; UNSW-NB15, CIC-IDS2017, NSL-KDD; 99.21%	[59]; NSL-KDD; 89%	10.2
Blockchain	[66]; BoT-IoT; 99.998%	[65]; KDD Cup 1999; 98%	2.0
RL	[72]; NSL-KDD; 99.81%	[18]; 5G MEC; 58.17%	41.6
Ensemble	[77]; CIC-IDS2017; 99.997%	[76]; NSL-KDD; 90%	10.0
XAI	[20]; UKM-IDS20; 99.92%	[35]; UNSW-NB15; 85%	14.9

4.3. Datasets, Generalization, and Overfitting

Although there have been significant improvements made to IDS models over the last 10 years, a number of issues still exist. As there has not been sufficient research done on testing newly created AI-based IDS models in real-world situations, this limits their ability to be used practically, as well as limits how well they can be scaled. In order to enhance both the resilience of IDS against adversarial attacks and scalable deployment issues, more research is needed moving forward. A further concern relates to the datasets employed in current research.

Table 12 presents the frequency of dataset usage across the 48 studies for which dataset information could be definitively extracted from the reviewed corpus. A total of 73 dataset mentions were recorded across these 48 studies, as several studies employed two or more datasets simultaneously (mean = 1.5 datasets per study). NSL-KDD was the single most frequently used benchmark, used by 31.3% of the studies with identifiable datasets (15/48). The broader family of legacy datasets—comprising NSL-KDD, KDD99, and UNSW-NB15—was used by 25 of the 48 studies (52.1%), which corresponds to 31 out of the 73 total dataset mentions. This finding underscores the ongoing need for standardized, up-to-date evaluation datasets that reflect modern cyber threat landscapes.

Table 12. Frequency of Dataset Usage Across the Analyzed Studies.

Dataset	References	Number of Studies	% (of 48)
NSL-KDD	[20,42,45,46,47,56,59,60,63,70,72,73,74,75,76]	15	31.3%
CIC-IDS2017	[36,37,42,53,54,60,63,75,77,79]	10	20.8%
UNSW-NB15	[35,36,42,60,62,64,67,74,80]	9	18.8%
KDD99/KDD Cup 99/KDD Cup 1999	[23,51,56,58,62,65,67]	7	14.6%
CIC-IDS2018/CSE-CIC-IDS2018	[70,71,72,73]	4	8.3%
BoT-IoT	[50,64,66]	3	6.3%
Kyoto	[46]	1	2.1%
Honeypot	[46,63]	2	4.2%
CIC-DDoS2019	[53]	1	2.1%
UCI	[22,38]	2	4.2%
AWID	[43]	1	2.1%
MQTT	[44]	1	2.1%
N-BaIoT	[48]	1	2.1%
Custom/unnamed (corpus of 1705 emails)	[15]	1	2.1%
HCRL	[52]	1	2.1%
ORNL	[52]	1	2.1%
NF-UQ-NIDS	[57]	1	2.1%
OpenEI	[61]	1	2.1%
Modbus	[55]	1	2.1%
Custom IIoT Dataset	[16]	1	2.1%
IoMT dataset (unspecified)	[17]	1	2.1%
5G MEC dataset	[18]	1	2.1%
CIDDS-001	[78]	1	2.1%
CIDDS-002	[78]	1	2.1%
NF-ToN-IoT-v2	[78]	1	2.1%
Edge-IIoTset	[20]	1	2.1%
UKM-IDS20	[20]	1	2.1%
CTU-13	[20]	1	2.1%
Custom SDN dataset	[19]	1	2.1%

In order to combat this issue, we propose a three-tier framework for generating datasets: (1) 50% of the dataset collected from true traffic (via distributed honeypots (e.g., MHN) and operational networks); (2) followed by a further 40% generated synthetic attack samples (via a Generative Adversarial Network (e.g., CTGAN)) that simulate IoT/cloud attacks; and (3) completed by 10% manually collected validated attack samples, i.e., for detection of zero-day characteristics. Collectively, these three tiers of datasets will allow for more accurate representations of the current cyber threat landscape, as well as improve the reproducibility of research. Additionally, mandating automatic labeling (powered mainly by semi-supervised labeling technology at 92% accuracy) and mandating a refresh of datasets at least every 3 years will enable researchers to develop IDS models that reflect the current/ever-changing cyber threat landscape.

Impact of legacy datasets on real-world applicability. KDD99 and NSL-KDD were derived from traffic simulated in 1998, and UNSW-NB15 was generated in 2015 in a synthetic testbed [85,86]. They contain neither modern protocols, encrypted traffic, nor IoT/cloud workloads and recent attack families, and they contain known artifacts (redundant records, unrealistic class distributions, and labeling errors) that models can exploit [87,88]. High accuracy on these datasets therefore shows that a model can separate the classes of that dataset, not that it will detect current attacks in operational networks, where traffic is far more heterogeneous, and attacks are rare [5]. Models trained on legacy data are also prone to overfitting to dataset-specific features, and their accuracy can drop substantially when they are tested on traffic from a different environment [34]. The accuracies near 100% reported in Table 3, Table 4, Table 5, Table 6, Table 7, Table 8 and Table 9 should therefore be interpreted as upper bounds that are unlikely to transfer unchanged to deployment.

Generalization across environments. The wide range of reported accuracies (58.17–100%) is partly explained by the datasets and tasks: the lowest values come from multi-class detection on recent or domain-specific data (5G MEC [18], IoMT [17]), whereas the highest come from binary detection on IoT-specific or legacy benchmarks (MQTT [44], BoT-IoT [66], AWID [43]). Only a minority of studies evaluate the same model on several datasets (e.g., [20,36,42,46,60,63,67,73]); in these studies, performance varies with the dataset (e.g., 96.06% on NSL-KDD vs. 99.93% on Kyoto [46]; 83.33% vs. 97.26% for multi-class detection on UNSW-NB15 and CIC-IDS2017 [36]). This evidence does not demonstrate that the reviewed models generalize across environments; rather, it suggests that performance is strongly dataset-dependent. Overfitting risks are further increased by random train–test splits of highly redundant flow records, by oversampling before splitting, and by hyperparameter tuning on the test set; temporal splits, cross-dataset tests, and hold-out data from different capture environments are therefore recommended [34].

Studies based on custom datasets. Five included studies used custom or self-collected datasets rather than public benchmarks: an email corpus of 1705 messages [15] (98.3%), a custom IIoT dataset [16] (≈99%), an IoMT dataset [17] (99.58% binary, 77.73% multi-class), a 5G MEC dataset [18] (58.17%), and SDN traffic collected in simulated and physical environments [19] (recall 96% without attack). Their results are more dispersed than those obtained on public benchmarks and include the lowest value of the corpus, which is consistent with the hypothesis that recent, environment-specific data are harder than legacy benchmarks. Studies relying exclusively on undisclosed data were excluded (Section 2.2); this choice favors reproducibility but may bias the review toward public benchmarks and under-represent industrial or operational evaluations. A separate analysis of such studies, for example through data-sharing agreements with industry partners, would provide complementary evidence on real-world performance.

Recent datasets. To support the transition away from legacy benchmarks, Table 13 lists more recent datasets that cover current environments (IoT, IIoT, 5G, and IoMT) and attack families. In addition, corrected versions of CIC-IDS2017 address labeling and feature-extraction errors of the original release [88], and NetFlow-based versions of several datasets with a standard feature set facilitate cross-dataset evaluation [89]. Practical mitigation strategies include (i) evaluating on at least one recent dataset in addition to any legacy benchmark; (ii) reporting cross-dataset results; (iii) publishing preprocessing code and data splits; and (iv) developing comprehensive, community-maintained, and regularly refreshed open datasets, such as the three-tier framework proposed above. The characteristics of all datasets used in the reviewed studies are listed in Appendix A (Table A1).

Table 13. Recent datasets better suited to current threat landscapes.

Dataset	Year	Environment	Attack Coverage	Ref.
TON_IoT	2021	IoT/IIoT telemetry, operating-system logs, and network traffic from a testbed	Scanning, DoS, DDoS, ransomware, backdoor, injection, XSS, password attacks, MITM	[90]
NetFlow v2 datasets (e.g., NF-UQ-NIDS-v2, NF-ToN-IoT-v2)	2022	NetFlow versions of several benchmarks with a common feature set	Attacks on the source datasets; enables cross-dataset evaluation	[89]
Edge-IIoTset	2022	IoT/IIoT testbed (edge, fog, and cloud layers); centralized and federated settings	14 attacks in 5 groups (DoS/DDoS, information gathering, MITM, injection, malware)	[91]
X-IIoTID	2022	Connectivity- and device-agnostic IIoT environment	Multi-stage IIoT attacks, from reconnaissance to impact	[92]
CICIoT2023	2023	Large IoT topology with real devices	DDoS, DoS, reconnaissance, web-based, brute force, spoofing, Mirai	[93]
CICIoMT2024	2024	Internet of Medical Things (multiple protocols)	DDoS, DoS, reconnaissance, MQTT-based, and spoofing attacks	[94]
5G-NIDD	2025	Real 5G wireless network	DoS/DDoS floods and port scans	[95]

4.4. Adversarial Robustness and Real-World Deployments

AI-based IDS and IPS have achieved increasingly high levels of precision and adaptability; however, they remain susceptible to being exploited by adversarial attacks. Adversarial attacks typically attempt to trick AI models into yielding erroneous output (e.g., classifying malicious traffic as benign) by making minor changes to the input data to which an AI model is applied. This situation is concerning in the context of cybersecurity, as adversaries will deliberately attempt to exploit the weaknesses in AI models. Methods like the Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) exploit the way neural networks react to small modifications to input data; both techniques can create adversarial examples that lead to either false negatives (permitting a malicious event through the system) or false positives (decreasing the utility of a system). Our review of the current literature indicates that few studies have comprehensively evaluated the adversarial robustness of associated AI models; within the reviewed corpus, only [19] evaluates it systematically, reporting a drop of more than 90% in the recall of several classifiers under evasion attacks.

We believe that implementing techniques such as adversarial training when developing models to enhance robustness to adversarial attacks has demonstrated positive results. The use of ensemble methods and robust feature selection may alleviate the impact of adversarial attacks by varying how models respond. Moreover, Explainable AI (XAI) can aid in the identification of abnormal behavior resulting from malicious actions, thereby increasing both confidence and transparency in models’ decision-making processes. As such, we recommend that researchers continue to systematically assess the adversarial robustness of AI models used in cybersecurity applications and develop more comprehensive benchmark datasets for evaluating the performance of models against a large variety of sophisticated evasion techniques. In the real world, several examples exist in which AI-based IDS/IPSs have demonstrated practical utility beyond just academic research studies. The Darktrace IDS is an enterprise-grade solution built on unsupervised machine learning, which, according to the vendor, is used by about 10,000 customer organizations worldwide, including in critical infrastructure and healthcare. Darktrace offers its users the ability to identify abnormal behaviors in real time without relying on the collection of labeled data to identify attack types. This allows Darktrace to identify zero-day threats and insider threats while maintaining a very low false-positive rate [96].

Another real-world example is IBM’s QRadar Advisor. This solution leverages machine learning and natural language processing technologies to conduct threat analysis and automate threat investigations. QRadar is widely successful in the banking and government sectors due to its ability to decrease both the mean time to detect (MTTD) and the mean time to respond (MTTR) to advanced persistent threats [97]. In industrial environments, Siemens offers SINEC Security Monitor, which passively and continuously monitors Industrial Control System (ICS) and Operational Technology (OT) networks during production to provide transparency over assets, potential threats, and network intrusions. Traditional signature-based IDS solutions cannot effectively detect such activities; therefore, AI has the potential to contribute significantly to identifying threats in the ICS space [98]. The provided examples confirm that AI-driven IDS/IPS are feasible and effective in multiple complex environments and help provide a clearer understanding of the benefits associated with hybrid AI approaches and the advantages of using strong, explainable, and scalable cybersecurity solutions.

Improving resilience. Several complementary methods can improve adversarial robustness: (i) adversarial training, i.e., augmenting the training set with adversarial examples generated by FGSM or PGD [99]; (ii) robust feature extraction, favoring features that an attacker cannot easily manipulate without breaking the attack (e.g., protocol-level or flow-timing features rather than payload-size statistics) and constraining perturbations to produce valid network traffic; (iii) ensembles and randomization, which force the attacker to evade several heterogeneous models simultaneously; (iv) input sanitization and out-of-distribution detection to reject anomalous samples; and (v) defenses against data poisoning, such as data provenance checks and robust aggregation in federated learning [100,101]. Robustness should be evaluated with realistic, domain-constrained attacks, because perturbations that are feasible in image classification may produce invalid packets in network traffic [6].

4.5. Interpretability–Accuracy Trade-Off

The XAI studies in Table 9 report accuracies from 85% (LIME-based framework [35]) to 99.92% (LENS-XAI [20]), with the lowest values reported by [35,79]. This trade-off between interpretability and accuracy matters operationally: an analyst who cannot understand why an alert was raised may ignore it or be unable to respond, whereas a slightly less accurate but explainable model can support faster triage, auditing, and compliance [79]. The trade-off is, however, not unavoidable. Three strategies can provide explanations without significantly sacrificing detection performance: (i) post hoc, model-agnostic explanations such as SHAP [102] and LIME [103], which leave the underlying high-accuracy model unchanged (e.g., SHAP applied to tree ensembles and neural networks [78]); (ii) inherently interpretable models, such as shallow decision trees, rule lists, or generalized additive models, which often reach accuracy close to that of black-box models on tabular, well-engineered feature spaces [104]; and (iii) knowledge distillation from a large model into a compact, more interpretable student, as in LENS-XAI [20], which reports 95.34–99.92% accuracy. Explanations should themselves be evaluated for fidelity and stability, and their computational cost should be included in latency measurements.

Why the trade-off differs between XAI techniques. The tabulated studies suggest that the size of the trade-off depends on where the explanation enters the detection pipeline. (i) Post hoc attribution (SHAP [102], LIME [103]) does not modify the trained model and therefore cannot reduce its accuracy; its costs are computational and concern fidelity. Model-agnostic KernelSHAP and LIME require many additional model evaluations for each explained sample, and LIMEs can vary between runs because they rely on random local sampling, whereas TreeSHAP computes exact attributions efficiently for tree ensembles [102]. This explains why explanation modules added to strong detectors, such as SHAP applied to tree ensembles and neural networks [78] or the explainable attention transformer of [63] (98.7%), do not lower accuracy. (ii) Explanation-driven feature selection removes features and therefore trades a small amount of accuracy for transparency and speed: DT-RFECV retains 15 of 42 UNSW-NB15 features at a cost of only 0.26 percentage points (95.30% vs. 95.56%) [80], while the autoencoder with kernel-SHAP feature selection [79] reports 94% accuracy. (iii) Inherently interpretable or distilled models constrain model capacity, and their cost depends on the dataset, as shown by the 95.34–99.92% range of the distilled LENS-XAI model across four datasets [20]. The lowest value, 85% for the LIME-based framework [35], should not be attributed to LIME itself: LIME does not change the underlying classifier, and the value was obtained on UNSW-NB15, on which other tabulated studies also report lower values for harder task definitions (e.g., 83.33% for multi-class detection [36]). Because only one XAI study [80] reports the accuracy of the same pipeline with and without the interpretability component under identical conditions, the magnitude of the trade-off cannot be estimated precisely. In practice, the evidence favors fast and accurate models for inline detection, complemented by post hoc explanations generated asynchronously for analysts, and interpretable feature selection where the feature space allows it.

4.6. Emerging Directions: LLMs, Data Poisoning, Continual Learning, and 2026 Developments

While this review covers the major AI paradigms for IDS/IPS, two emerging research directions warrant attention. First, the integration of Large Language Models (LLMs) into intrusion detection has recently gained momentum, with comprehensive surveys systematically analyzing the application of Transformers and LLMs—including BERT, GPT, and Vision Transformers—for intrusion detection across diverse environments, including IoT, cloud computing, and autonomous vehicles [105]. Recent work has also provided systematic comparisons of LLM techniques—including prompting, retrieval-augmented generation, and fine-tuning—against traditional ML baselines on proprietary commercial data, offering an unbiased assessment of LLM strengths and weaknesses for intrusion detection [106]. In the IoT domain, embedding similarity techniques with GPT models on the CICIoT2023 dataset have yielded comparable results to ensemble-based IDS solutions, while fine-tuning approaches showed limited effectiveness [107]. Second, the vulnerability of AI-based IDS to data poisoning attacks—where adversaries manipulate training data to degrade model performance—has become a critical concern. Recent work has proposed detection mechanisms using topological data analysis on the UNSW-NB15 and CIC-IDS2017 datasets [100] and evaluated the robustness of deep learning-based NIDS under such attacks on the CICIDS2019 dataset [101]. These areas represent promising avenues for future investigation, particularly as adversaries increasingly target the training pipelines of AI models themselves.

Advantages and challenges of LLMs. LLMs offer three potential advantages for IDS: (i) they can process heterogeneous, semi-structured inputs such as logs, alerts, and payloads without manual feature engineering; (ii) they can produce natural-language explanations and incident summaries that support analysts; and (iii) they can transfer knowledge to new attack types with few labeled examples through prompting or fine-tuning. Their challenges are equally significant. Their computational cost and latency are orders of magnitude higher than those of classical detectors, which conflicts with line-rate detection; a 2026 benchmark found that small LLMs used as standalone flow classifiers exceeded 95% F1-score on CICIoT2023 but did not outperform XGBoost, which reached 96.96% F1-score while using only 4% of the available CPU [108]. Data privacy is a concern when traffic or logs are sent to externally hosted models, which favors locally deployed open-source models or federated training. LLMs are also exposed to hallucinations and to prompt injection through attacker-controlled content in logs or payloads. Current evidence therefore points to LLMs as complements to, rather than replacements for, lightweight detectors, e.g., for alert enrichment, explanation, and data augmentation [109].

Adaptability through continual learning. Because attack vectors evolve rapidly, models trained once on a static dataset degrade over time (concept drift). Continual (lifelong) learning updates a model incrementally as new data and attack classes arrive while limiting catastrophic forgetting of previously learned attacks, for example through regularization of important weights (elastic weight consolidation [110]), replay of stored or generated samples, or dynamically expanding architectures [111]. Within the reviewed corpus, the continuous-learning LSTM framework of Aliyu et al. [47] and the RL-based approaches of Section 3.7 already move in this direction. Future IDS should combine continual learning with drift detection and with evaluation protocols that test models on traffic collected after the training period.

Recent developments (2026). Studies published in 2026, after the search window of this review, confirm several of the trends identified above. AlHayan and Al-Muhtadi [109] combined federated learning, an attention-based LSTM, LLM-guided GAN data augmentation, and LLM-generated explanations, reporting 99.40% accuracy on NSL-KDD, 99.65% on CIC-IDS2017, and 98.05% on UNSW-NB15. Mehavilla et al. [108] benchmarked small LLMs against ML and DL baselines and showed that LLMs do not yet outperform optimized gradient-boosting models for flow-based detection. Moussaoui et al. [68] showed that a federated CNN-LSTM IDS degrades strongly under extreme non-IID data (F1-score of 71.53% with FedAvg), partly recovered by FedProx (78.27%), and used SHAP and LIME to identify protocol-level features that remain stable across heterogeneous networks. Ilias et al. [112] integrated a sparsely gated mixture of experts into a federated IDS for 5G and IoT, evaluated on 5G-NIDD and BoT-IoT, and Pecherle et al. [113] reported that federated IDS in simulated IIoT networks achieve accuracy comparable to centralized models while reducing privacy risks and transmission overhead. Together, these works highlight federated learning, LLM integration, and robustness to heterogeneous data as active research directions. Because they fall outside the 2019–2025 search window, they were not included in the quantitative analysis.

4.7. Towards Standardized Benchmarking

According to the research reviewed, one of the main issues confronted by researchers is inconsistent evaluation metrics among different studies. Some studies report only the accuracy of their approach, while others report the evaluation metrics of F1-score, precision, recall, latency, or false positive rate. Because of this inconsistency, it is challenging for scientists to objectively compare the effectiveness of their approaches. To address this, we propose a standardized reporting set for future research: Overall accuracy, Precision (to minimize false alarms), Recall (for identifying true threats), F1-Score (to strike the right balance between precision and recall), False Positive Rate (to reduce benign misclassifications), Latency (for real-time detection), and Resource Efficiency (memory, energy, and processing time) with particular regard to IoT and other resource-limited devices. The use of standardized evaluation metrics will enable greater transparency in research, allow researchers to establish benchmarks, and ultimately facilitate the development of effective AI-implemented cybersecurity solutions. Overall, AI and hybrid IDS models demonstrate significant potential to improve detection and prevention of cyberattacks; however, more research is needed on the development of evaluation criteria, scalability, and applicability to real-world situations. Further explorations of XAI and neuro-symbolic AI in combination with privacy-preserving technologies (e.g., Blockchain and Federated Learning) will be critical to the development of IDS in the future.

Table 14 operationalizes this proposal as a minimum benchmarking protocol. Beyond the choice of metrics, it requires statistical validation, an explicit description of the latency measurement and hardware, and at least one evaluation on a recent dataset, so that future studies can be compared directly and their results can be aggregated in meta-analyses.

Table 14. Proposed minimum benchmarking and reporting protocol for AI-based IDS/IPS.

Item	Minimum Requirement	Rationale
Accuracy	Overall and per class	Comparability with prior work
Precision, recall, F1-score	Per class and macro-averaged	Meaningful under class imbalance; exposes failure on rare attacks
False positive rate	At the selected operating point (and ROC/PR curves where possible)	Determines alert fatigue in operation
Latency	Per-sample inference time and end-to-end detection time, with hardware, batch size, and traffic load stated	Makes latency values comparable across studies
Resource efficiency	Model size, memory, CPU/GPU utilization, and energy where relevant	Feasibility on edge and IoT devices
Statistical validity	Mean ± SD over ≥5 runs or k-fold cross-validation; significance tests against baselines [81]	Separates real improvements from random variation
Generalization	At least one recent dataset (Table 13); cross-dataset or temporal split	Reduces overfitting to legacy benchmarks [34]
Robustness	Performance under realistic adversarial perturbations and class imbalance	Operational resilience
Reproducibility	Public code, preprocessing steps, and data splits	Enables independent verification
Experimental setup	Data-split strategy, hyperparameter-tuning procedure on a separate validation set, and preprocessing order (e.g., oversampling applied to training data only)	Prevents optimistic bias and test-set leakage [34]
Prevention (IPS only)	Time to mitigate, proportion of legitimate traffic blocked, residual attack traffic, and rollback/recovery time	Quantifies the operational impact of automated responses (Section 4.8)

4.8. Detection Versus Prevention: AI-Driven Response Actions

Although intrusion prevention builds on intrusion detection, the two impose different requirements. An IDS raises alerts that are triaged by analysts, so a false positive costs analyst time; an IPS is placed inline and acts automatically (dropping packets, resetting connections, blocking or rate-limiting sources, quarantining hosts, or reconfiguring firewall or SDN rules), so a false positive directly interrupts legitimate service [114,115]. Most studies in the reviewed corpus evaluate only the classification step. Explicit prevention mechanisms are described in a minority of them, for example the ISP-level blocking of domains flagged as phishing in [22], the protection of SDN flow rules in an IIoT network [16], the explainable IDS/IPS for cloud environments in [63], whose prevention module disseminates interpretable emergency alarms to neighbouring IDS modules and devices rather than blocking traffic, blockchain-based sharing of detection results among collaborating nodes [64], fog-based detection of DDoS attacks in blockchain-IoT systems [66], and RL agents whose decisions can be mapped to response actions [17,18,70]. In the extracted data, however, no study reports metrics of the prevention action itself, such as the time needed to mitigate an attack or the proportion of legitimate traffic that is blocked.

Real-time blocking. Prevention requires decisions within the forwarding path, at line rate. On a 10 Gbit/s link, minimum-size Ethernet frames arrive roughly every 67 ns, so inline models must decide per flow rather than per packet or rely on very compact models; per-sample inference times in the order of tens of milliseconds, such as the 34.2 ms reported for MAFSIDS [73], are compatible with alert-based monitoring but not with inline per-packet blocking. A common design is therefore a two-stage architecture in which a lightweight model (e.g., compact gradient-boosted trees using few features [48]) acts inline, while heavier models, explanation generation, or blockchain logging operate asynchronously (Section 4.2).

Impact of false positives. Because attacks are rare in operational traffic, even a low false positive rate produces many false alarms (base-rate fallacy [116]). For example, if 1 in 10,000 flows is malicious, a detector with 99% recall and a 1% false positive rate generates about 100 false alarms for every true detection, i.e., about 99% of its alerts are false. In an IDS, this causes alert fatigue; in an IPS, every false alarm becomes a blocked legitimate flow, so that a network carrying one million flows per day would block about 10,000 legitimate flows daily. Attackers can also exploit automated blocking by spoofing traffic from legitimate sources to trigger a self-inflicted denial of service. Since most included studies report accuracy rather than the false positive rate (Table 10), their suitability for prevention cannot be assessed.

Design recommendations for AI-based prevention. Automated prevention should (i) use graded responses proportional to the detector’s confidence and to the criticality of the asset, from logging and alerting to rate limiting, temporary blocking, and full blocking [114]; (ii) keep a human in the loop for high-impact actions and provide an explanation for each automated decision (Section 4.5); (iii) support rapid rollback of erroneous actions; (iv) train RL-based response agents in simulators or digital twins rather than on production networks, because exploration in live networks can itself disrupt service; and (v) report prevention-specific metrics, which we have added to the reporting protocol of Table 14.

4.9. What Can Be Concluded from Non-Comparable Results

The non-comparability of reported accuracies (Section 4.1) prevents a ranking of the categories, but it does not prevent synthesis. We used three complementary strategies, each of which avoids comparing values obtained under different protocols: (i) within-study contrasts, which hold the dataset, preprocessing, and protocol constant and vary only one factor; (ii) consistency of qualitative patterns (direction of evidence) across categories and datasets; and (iii) descriptive distributions, used only to characterize ranges and dispersion, not differences between categories.

Within-study contrasts provide the most reliable evidence. Changing the task from binary to multi-class detection on the same data reduces accuracy by 21.85 percentage points for the actor–critic model of [17] (99.58% vs. 77.73%) and by 15.61 points for HAMC-ID on UNSW-NB15 [36] (98.94% vs. 83.33%), although not on CIC-IDS2017 (95.27% vs. 97.26%). Evaluating the same model on another dataset changes accuracy by 3.87 points in [46] (96.06% on NSL-KDD vs. 99.93% on Kyoto) and by 13.93 points for multi-class detection in [36] (83.33% on UNSW-NB15 vs. 97.26% on CIC-IDS2017). Conversely, reducing the feature set costs little: 0.26 points for 15 of 42 features in [80], and three of 115 features suffice for 99.96% accuracy in [48]. These within-study effects are as large as, or larger than, the 4.6-point spread between the category medians (95.3–99.9%).

From these contrasts and from the patterns that recur across all seven categories, five conclusions can be drawn despite non-comparability: (1) high benchmark accuracy is attainable with every AI paradigm, so the choice of paradigm should be driven by deployment requirements (latency, resources, interpretability, and privacy) rather than by reported accuracy; (2) the dataset and the task definition affect reported accuracy at least as much as the model, so results must always be interpreted together with them; (3) rare and minority attack classes, rather than overall accuracy, are the main weakness of current models (e.g., F1-scores of 0.51 and 0.28 for Shellcode and Worms [36], and 0% detection for some rare classes [72]); (4) compact models with few features can retain most of the accuracy, which supports lightweight deployment; and (5) the evidence on deployment dimensions and on prevention is too sparse to support quantitative conclusions. Conversely, the evidence does not support claims that any category, or hybridization as such, yields superior accuracy, nor that benchmark accuracies transfer to operational networks.

Attack-specific performance. Table 15 summarizes the results of the studies that target a specific attack type. In addition to general intrusions, ten attack families can be distinguished, but within each family the evidence rests on one to three studies, usually with a single dataset each, so these values describe what has been reported rather than what can be expected in operation. Two patterns stand out: narrowly scoped problems (MQTT DoS, Wi-Fi attacks, and IoT botnets on device-level traffic) yield near-perfect accuracy, whereas multi-attack detection on recent, environment-specific data (5G MEC and IoMT) yields the lowest values. Phishing detection is the attack type with the most consistent evidence across different data sources (websites, emails, and URLs).

Table 15. Reported accuracy by specific attack type (studies in Table 3, Table 4, Table 5, Table 6, Table 7, Table 8 and Table 9 that target a specific attack type). Values were obtained on different datasets and are not comparable across rows.

Attack Type	Studies (Dataset)	Reported Accuracy	Observation
Phishing	(UCI websites) [22,38]; (email corpus) [15]; (email, URL, website) [49]	96.83–98.3%; up to 99.95% F1-score [49]	Most consistent evidence across different data sources; datasets small or domain-specific
IoT botnets and IoT attack traffic	(N-BaIoT) [48]; (Modbus) [55]; (BoT-IoT) [50]	99.5–99.99%	Very compact models (3 of 115 features) suffice on device-level traffic
DDoS	(BoT-IoT) [66]; (CIC-IDS2017, CIC-DDoS2019) [53]; (NF-UQ-NIDS) [57]	95.20–99.998%	Highest values on IoT testbed data; lower values on merged NetFlow data
Protocol-specific DoS	(MQTT) [44]; (KDD99, cloud) [58]	94.12–99.998%	Narrow protocol scope (MQTT) yields near-perfect accuracy
In-vehicle (CAN bus) attacks	(HCRL, ORNL) [52]	96.44–98.80%	Includes unknown attacks; real-time stream clustering
Wi-Fi (IEEE 802.11) IoT attacks	(AWID) [43]	99.97%	Single study and dataset
Smart-grid attacks	(OpenEI) [61]	99.12%	Detection combined with SHA-512 integrity protection
SDN/IIoT attacks	(custom IIoT) [16]	≈99% (multi-class)	Custom dataset
SDN saturation (DoS) attacks under evasion	(custom SDN traffic) [19]	Recall 96% without attack; 8% under evasion attacks (K-NN)	Only adversarial-robustness evaluation in the corpus
Multi-attack detection in 5G MEC/IoMT (MiTM, DDoS, ransomware, buffer overflow)	(5G MEC) [18]; (IoMT) [17]	58.17%; 99.58% (binary) vs. 77.73% (multi-class)	Lowest values of the corpus; recent, domain-specific data
General (multi-class benchmark) intrusions	29 studies	85–100% (median 98.94%)	Mostly NSL-KDD, UNSW-NB15, CIC-IDS2017, and CSE-CIC-IDS2018

Latency and resource consumption alongside accuracy. Table 16 lists, for the studies in Table 3, Table 4, Table 5, Table 6, Table 7, Table 8 and Table 9 that report them, latency and resource indicators together with the reported accuracy. In the extracted data, a quantitative per-sample latency measured against baselines under the same conditions is available for only one study [73]; all other deployment information is qualitative (e.g., “real-time” or “lightweight”) or indirect (number of features or parameters). Read together with accuracy, the table nevertheless suggests two patterns: several of the highest accuracies are reported by designs whose resource requirements are high or unquantified (e.g., about 340M parameters in [60], and blockchain and fog infrastructure in [66,67]), whereas the studies that quantify a reduction in features or model size [48,71,73,80] retain accuracies between 95.30% and 99.96%. The implications for practical deployment are threefold. First, practitioners cannot currently select a model for a given latency or energy budget from the published evidence and must benchmark candidate models on their own hardware and traffic. Second, the absence of resource measurements biases the literature toward computationally expensive designs whose cost remains hidden. Third, accuracy and latency should be reported jointly, at a stated operating point and hardware configuration, as required by Table 14; without such reporting, RQ2 cannot be answered quantitatively.

Table 16. Reported accuracy alongside deployment-related indicators (latency, computational cost, and resource use) for the studies in Table 3, Table 4, Table 5, Table 6, Table 7, Table 8 and Table 9 that report them (– = not reported in the extracted data). Values were obtained under different conditions and are not directly comparable.

Ref.	Category	Accuracy	Latency/Time	Computational Cost/Resource Indicator
[73]	RL	96.8–99.1%	≈34.2 ms per sample (same setup: RF ≈ 300 ms, NB ≈ 3 ms)	~80% fewer features (multi-agent feature selection); additional training time
[52]	DL	96.44–98.80%	Designed for real-time, low-latency detection	Hyperparameter-sensitive
[48]	ML	99.96%	–	3 of 115 features; suited to resource-constrained IoT devices
[80]	XAI	95.30%	Lower prediction cost (qualitative)	15 of 42 features (~65% fewer); −0.26 points vs. full feature set
[71]	RL	96.2%	–	~80% of redundant features removed
[23]	ML	96.78%	Processing time ≈ 3.2–3.4 min vs. 12.36 min for a decision tree in the same setup	PCA dimensionality reduction before classification
[50]	ML	99.79–99.99%	Model-building time 4.03 s (NB) vs. 198.83 s (RF) in the same setup	Five classifiers compared on 44 features
[20]	XAI	95.34–99.92%	Lightweight design (qualitative)	Knowledge distillation into a compact student model
[44]	ML	99.998%	Real-time (complex event processing)	Scalable architecture; MQTT-specific
[66]	Blockchain	99.998%	Real-time detection at the fog layer	Fog infrastructure required; FAR not reported
[67]	Blockchain	99.72–99.95%	Real-time detection; high throughput	Not validated in production environments
[60]	Hybrid	99.21%	–	≈340 M parameters (BERT-large); resource intensive
[64]	Blockchain	99.41%	–	Communication complexity and traffic overhead
[55,65]	DL (FL); Blockchain (FL)	99.5%; 98%	Latency issues reported	Institutional coordination; synchronization overhead
[77]	Ensemble	99.821–99.997%	Training time varies by sub-dataset	Computationally intensive

4.10. Answers to the Research Questions

RQ1 (accuracy, resilience, and scalability). Detection accuracy is high in all categories on benchmark data (Section 4.1), but the evidence on resilience and scalability is sparse and uneven across categories (Table 17). Robustness to class imbalance is the most frequently addressed aspect of resilience (e.g., [36,42,60,72,75]), and it reveals persistent weaknesses on rare classes. The detection of unknown or zero-day attacks is evaluated in few studies (e.g., [52,54]), and only one tabulated study evaluates adversarial robustness [19], showing that evasion attacks crafted without knowledge of the classifier reduce its recall by more than 90% (e.g., from 96% to 8% for K-NN). Scalability is mostly claimed on architectural grounds (cloud, fog, or distributed designs [43,44,56,57,66]) rather than measured with increasing traffic volumes. The answer to RQ1 is therefore that current AI models report high accuracy across attack types on benchmarks, whereas their resilience and scalability remain largely unverified.

Table 17. Evidence on detection accuracy, resilience, and scalability by category (RQ1), based on the studies in Table 3, Table 4, Table 5, Table 6, Table 7, Table 8 and Table 9.

Category	Accuracy Range (Median)	Resilience Evidence (Class Imbalance, Unknown Attacks, Adversarial)	Scalability Evidence
ML	91.42–99.998% (99.9%)	Robustness to imbalance [42]; adversarial robustness evaluated only in [19] (recall 96% → 8% under evasion attacks)	Semi-distributed IoT IDS [43]; scalable real-time CEP [44]
DL	97.51–100% (98.9%)	Unknown attacks [52]; known and innovative attacks [54]; adaptability through transfer learning [37] and transformers [53]	Scalability concerns due to computational overhead [51]; federated training across devices [55]
Hybrid	89–99.21% (97.0%)	Class imbalance (SMOTE) and claimed zero-day resilience [60]	Cloud and multi-cloud deployments [56,57]
Blockchain	98–99.998% (99.4%)	Tamper resistance concerns integrity, not detection robustness [64]	Collaborative, distributed designs [64,65,66]; limited by latency and energy overhead
RL	58.17–99.81% (98.1%)	Imbalance handling [72,73], with failure on rare classes [72]; adaptation to evolving traffic [70,71]	Not evaluated
Ensemble	90–99.997% (99.1%)	Minority-class detection [36]; imbalanced big data [75]	Not evaluated; computational overhead [36]
XAI	85–99.92% (95.3%)	Not evaluated	Lightweight, scalable distilled model [20]

RQ2 (practical implementation challenges). Along the four deployment dimensions defined in Section 1, the evidence is as follows. (i) Computational cost is quantified in a few studies, mostly indirectly through the number of features or parameters (Table 16), while several studies explicitly report high computational overhead (e.g., [38,51,57,60,74,77]). (ii) Latency is quantified under comparable conditions in only one study [73]; other studies describe it qualitatively. (iii) Interpretability is addressed by the six XAI studies and by one hybrid study [60], i.e., by 7 of the 49 tabulated studies (14.3%). (iv) Validation on operational traffic is absent: all tabulated studies were evaluated on benchmark, testbed, or custom datasets; 25 of the 48 studies with identifiable datasets used at least one legacy benchmark (Table 12), and some explicitly note the lack of validation in production environments (e.g., [67]). The main challenges are therefore the lack of realistic validation, the dependence on legacy datasets, hidden computational costs, and limited interpretability, compounded by the absence of standardized reporting.

RQ3 (hybrid frameworks). Table 18 compares the detection effectiveness of the seven hybrid frameworks in Table 5 with the four deployment dimensions of RQ2. All seven report accuracies between 89% and 99.21%, but none reports values for all four dimensions: none reports latency, none was validated on operational traffic, computational cost is described only qualitatively (and is high in [57,58,60]), and only one framework provides explanations [60]. The same pattern holds for blockchain-based hybrids (Table 6 and Table 16), which add latency and synchronization overhead to the detection pipeline. Hybridization thus provides complementary capabilities (explainability [60], cryptographic integrity [61], and cloud scalability [56]), but the available evidence does not show that hybrid frameworks balance detection effectiveness with deployment requirements; the answer to RQ3 is, at best, undetermined.

Table 18. Hybrid frameworks of Table 5: detection effectiveness versus the four deployment dimensions of RQ2 (NR = not reported in the extracted data).

Ref.	Accuracy (Dataset)	Computational Cost	Latency	Interpretability	Validation on Realistic Traffic
[56]	99% (NSL-KDD, KDDCup99)	NR; additional clustering step	NR	No	Benchmark only; elevated FAR on test data
[57]	95.20% (NF-UQ-NIDS)	High (swarm-based optimization)	NR	No	Benchmark only
[58]	94.12% (KDD’99)	High (metaheuristic feature selection)	NR	No	Benchmark only; requires extensive validation
[59]	89% (NSL-KDD)	NR (two-stage AE + LSTM)	NR	No	Benchmark only; high FAR
[60]	99.21% (UNSW-NB15, CIC-IDS2017, NSL-KDD)	High (≈340M parameters)	NR	Yes (LIME/SHAP)	Benchmark only
[61]	99.12% (OpenEI)	NR (XGBoost + SHA-512 hashing)	NR	No	Smart-grid data; detection only
[62]	97% (KDD99, UNSW-NB15)	NR (CNN feature extraction + RF)	NR	No	Benchmark only; authors note reliance on outdated KDD99

5. Limitations

This review has several limitations. First, the heterogeneity of experimental protocols across the 74 reviewed studies (different datasets, train-test splits, and evaluation metrics) precludes direct quantitative comparison of reported accuracies. Second, the predominance of legacy datasets (NSL-KDD, KDD99) in the reviewed literature limits our ability to assess model performance against contemporary cyber threats. Third, publication bias may have led to an overrepresentation of positive results, as studies reporting lower accuracies are less likely to be published. Fourth, our analysis relies on reported metrics from primary studies; we did not re-implement any of the reviewed models to independently verify their reported performance. Fifth, while we identified 74 studies for review, dataset information could only be definitively extracted from 48 of these studies. For the remaining 26 studies, the dataset could not be identified unambiguously from the extracted information, because the data were described only generically (e.g., “email datasets” or “IoT traffic”) or were not named; in accordance with the inclusion criteria (Section 2.2), no included study relied on undisclosed data. Consequently, the dataset frequency analysis (Table 12) is based on the subset of studies with identifiable dataset information (n = 48), which represents the maximum verifiable sample available. This limitation should be considered when interpreting the dataset usage statistics reported in this review. Sixth, the search string and the three databases may have missed relevant studies indexed under alternative terminology or available in other sources (Section 2.1). Seventh, the quality appraisal was not blinded to study authors and venues, which may introduce assessor bias. Eighth, the review was not registered and no protocol was published (Section 2); the quality threshold of 4/8 did not act as a filter, and the adapted JBI checklist did not score AI-specific aspects such as the hyperparameter-tuning procedure and robustness testing separately (Section 2.3). In addition, the date of the last search and the per-study appraisal scores of the initial 71 studies are not reported; 25 included studies are not tabulated individually because their data or results were described only generically, and one included study [20] was available only as a preprint at the time of the review, which deviates from the peer-review criterion, so its results should be interpreted with caution. Ninth, publication bias could not be assessed formally; the concentration of reported accuracies near the ceiling and the initial exclusion of four records partly for performance or novelty (since corrected, Section 2.2) suggest that the evidence base over-represents favorable results (Section 2.4). Finally, the rapid evolution of both cyber threats and AI techniques means that some findings—particularly those from earlier studies (2019–2021)—may not fully reflect the current state of the art; Section 4.6 therefore summarizes selected 2026 studies qualitatively. To mitigate these limitations, future reviews should rely on standardized reporting (Table 14), favor studies evaluated on recent datasets (Table 13), and, where raw results are available, perform quantitative meta-analyses.

6. Conclusions

Returning to the research questions posed in the introduction (detailed answers are given in Section 4.10): Regarding RQ1, the reviewed studies report high detection accuracy in all seven categories (category medians between 95.3% and 99.9%), but individual results range from 58.17% to 100% depending on the attack type, dataset, and classification task. Because these values were obtained with heterogeneous datasets, train–test splits, and evaluation metrics, they do not establish that any category, including hybrid models, is the most accurate; robustness and scalability were rarely evaluated directly. Attack-specific results are strongest and most consistent for phishing detection (96.83–98.3% accuracy) and for narrowly scoped IoT attacks, and weakest for multi-attack detection on recent, domain-specific data (Table 15). Regarding RQ2, the main practical implementation challenges identified were reliance on legacy benchmark datasets (used by 25 of the 48 studies with identifiable datasets, 52.1%), limited model interpretability, high computational overhead, and the lack of standardized latency and resource measurements. Automated prevention actions were rarely evaluated, and no study reported metrics of the prevention action itself (Section 4.8). Regarding RQ3, hybrid AI frameworks report promising detection effectiveness, but the available evidence does not show that they balance this effectiveness with deployment requirements: they face significant barriers due to computational and energy overhead, the additional latency introduced by components such as on-chain validation, and the lack of real-world validation. These findings highlight the need for standardized evaluation protocols (Table 14), recent and realistic datasets (Table 13), and testing in operational environments.

The fields of IPS and IDS are evolving at a rapid pace; however, many pressing issues still have not been completely addressed. One major issue is developing lightweight models capable of providing acceptable levels of interpretability and efficiency while also producing good performance results. Balancing accuracy against interpretability is critical for operator trust. Standardized test frameworks for comparing IDS/IPSs are equally necessary to stimulate innovation. Another continuing concern is the high level of energy consumption that blockchain-based IDS/IPSs exhibit; this factor greatly limits their ability to be used in areas with resource limitations. Future research needs to concentrate on finding energy-efficient blockchain technologies; for example, sidechains to reduce power consumption, hardware optimization, proof-of-stake algorithms, etc. At the same time, deep learning models should be optimized utilizing techniques such as model distillation, quantization, and pruning. There are additional opportunities for saving energy through the use of specialized hardware such as TPUs and GPUs. Combining these strategies with edge computing and lightweight blockchain architectures compatible with IoT devices can increase the effectiveness of blockchain-based IDS/IPSs in limited-resource environments. Finally, through the application of these energy conservation strategies, the blockchain and deep learning paradigms will become more scalable, environmentally friendly, and practical.

This article is a comparison of current AI methods for IDS and IPS, including the advantages, disadvantages, and future research directions of each type of solution. The continued evolution of cyber threats means that cybersecurity solutions using AI for the purposes of detection and/or prevention will only become more important. Further studies need to focus on reducing the computational needs of AI models, while ensuring that the models are robust and real-time in nature. In addition, testing these models in a real-world environment will be essential for validating their efficiency and encouraging the implementation of the models in practice. Promising directions include continual learning to keep pace with evolving attacks, adversarially robust training, interpretable or distilled models, and the careful integration of LLMs as analyst-support components.