Enhancing university network security through ML-based detection of DDoS and ARP spoofing attacks: a systematic review
TL;DR
The evidence does not establish universal superiority of any particular learning paradigm and suggests that reported performance depends substantially on the evaluation context and methodological conditions.
Abstract
University networks are increasingly vulnerable to Distributed Denial-of-Service (DDoS) and Address Resolution Protocol (ARP) spoofing attacks due to open-access architectures, Bring Your Own Device (BYOD) practices, Internet of Things (IoT) integration, and dynamic traffic patterns. This study systematically reviews machine learning (ML)-based approaches for detecting these threats in university and related network environments. Following PRISMA 2020 guidelines, peer-reviewed studies published from January 2021 to January 2026 were identified through IEEE Xplore, SpringerLink, ScienceDirect, Taylor & Francis Online, and Web of Science, with the final database search completed on 31 January 2026. Of 400 identified records, 200 studies met the predefined eligibility and quality criteria and were included in the synthesis. The review examined supervised, unsupervised, semi-supervised, deep learning, hybrid, and ensemble approaches with respect to detection performance, validation strategies, deployment readiness, computational efficiency, adaptability, and explainability. The findings indicate that many reviewed studies reported strong detection performance across supervised, unsupervised, deep learning, hybrid, and ensemble approaches. Hybrid and ensemble models frequently demonstrated strong reported results; however, these findings were not directly comparable across studies because of differences in datasets, attack scenarios, feature sets, validation procedures, and experimental environments. Benchmark datasets were used in 48% of the reviewed studies, whereas only 12% evaluated real university networks. Real-time detection was assessed in 40% of studies, while continuous learning, concept-drift detection, and model adaptation received comparatively limited attention. The evidence does not establish universal superiority of any particular learning paradigm and suggests that reported performance depends substantially on the evaluation context and methodological conditions. These findings highlight the need for adaptive, context-aware, cross-layer, and explainable intrusion detection approaches capable of addressing the operational characteristics of university networks.