Aug 2026· Discover Artificial Intelligence· 0 citations
TL;DR
An in-depth comprehensive Systematic Mapping Study (SMS) of 110 relevant articles published between 2015 and 2025 related to AI/GenAI-based IDS, offering a novel and integrated, comprehensive mapping of both defensive and offensive dimensions of AI/GenAI-enabled cybersecurity.
Abstract
Conventional Intrusion Detection Systems (IDS) mechanisms based on signatures and anomalies struggle and have shown their limitations with novel and dynamic attack patterns, and it has become essential to discover the emerging potential offered by AI and GenAI. These models open new perspectives but also present significant risks that must be properly managed. This paper presents an in-depth comprehensive Systematic Mapping Study (SMS) of 110 relevant articles published between 2015 and 2025 related to AI/GenAI-based IDS. The proposed work offers a novel and integrated, comprehensive mapping of both defensive and offensive dimensions of AI/GenAI-enabled cybersecurity, a classification of AI models and Large Language Models (LLMs), a deep dive analysis of traditional and next generation cyber-attacks, synthesis datasets and methodologies utilized for evaluating AI-based Intrusion Detection System approaches. The findings highlight a substantial intensification in research efforts beginning in 2022. Regarding traditional Cyber Attacks (CA), malicious actors are taking advantage of AI/GenAI techniques to enhance existing conventional CA. In the meantime, academic research continues to focus on traditional attack types while leveraging the new capabilities offered by AI and GenAI. About studies on AI models that deal with IDS, we have noted that most articles are based on a hybrid approach combining different models. They are based on ensemble learning and AI boosting techniques, coupled with metaheuristic optimization algorithms for the implementation of the IDS pipelines. While supervised learning is still the dominant approach, semi-supervised, unsupervised, graph-based, and reinforcement learning also hold promise in detecting unknown and zero-day threats. In addition, we presented the evolution of LLMs timeline through several waves, from Transformer Architectures Based LLMs era to Hybrid multimodal models. We presented also the classification of the most used LLMs in cybersecurity field. Regarding the datasets for training and evaluating AI models related to IDS: NSL-KDD and UNSW-NB15 datasets have emerged as the primary benchmarks favoured by the scientific community.
As the number and sophistication of cyberattacks increase, including those like ransomware, advanced persistent threats (APTs), and zero-day exploits, the structural weaknesses of signature-based and static intrusion detection systems (IDS) become evident as they fail to generalize to novel or adversarially crafted attack patterns Agbroko (2024), Hakke et al. (2025). The paper provides a systematic review of the application of modern security operations in threat detection and automated incident response using classical machine learning (ML), deep learning (DL), reinforcement learning (RL), and metaheuristic optimization. A review of some of the benchmark sets shows that the ensemble and hybrid AI models consistently yield detection accuracy rates of 97–99% on curated datasets like NSL-KDD, CICIDS2017, and UNSW-NB15, which is significantly higher than the detection accuracy rates of legacy rule-based tools Waghmode and Kanumuri (2025), Sah et al. (2023), Jairu (2021). The paper also reviews Security Orchestration, Automation and Response (SOAR) integration, reinforcement-learning-driven adaptive defense policies, and threat-intelligence feedback loops that will allow for continuous retraining of the model. Some persistent challenges include adversarial evasion and data-poisoning attacks, false positives causing alert fatigue, interpretability problems in deep models, and autopilot restrictions on autonomous response actions Jha (2025), Dong et al. (2018). The most significant frontiers for making this leap from high laboratory accuracy to robust, audit- and legally sound operational deployments are explainable AI (XAI), federated and privacy-preserving learning, and standardized benchmarking Hermosilla et al. (2025), Bi et al. (2024). A conceptual framework is proposed that combines detection, explanation, and orchestrated response in a continuous feedback loop that is suitable for zero trust and IoT-enabled critical-infrastructure environments Silva (2026).
Jayesh Dalmet· Journal of Digital Security...· 0 citations
The rapid advancement of digital communication and networking technologies has resulted in a significant increase in the frequency and sophistication of cyber threats, creating new challenges for securing modern computer networks. Traditional intrusion detection approaches mainly depend on signature-based techniques and predefined security rules, making them less effective against newly emerging and continuously evolving cyber attacks. To address these limitations, this study presents an Explainable Artificial Intelligence (XAI)-based cyber threat detection framework that combines Long Short-Term Memory (LSTM) and Autoencoder models for accurate and transparent threat detection. The LSTM model captures sequential network traffic patterns to identify temporal attack behaviours, whereas the Autoencoder detects anomalous activities by learning the characteristics of normal network traffic. The integration of Explainable AI enables users to understand prediction outcomes by highlighting the factors influencing each detection decision. Furthermore, the framework performs quantitative risk assessment, categorizes threats into multiple severity levels, and generates suitable mitigation recommendations through an interactive web-based dashboard. Experimental results demonstrate that the proposed framework provides reliable, interpretable, and effective cyber threat detection, thereby supporting security professionals in making timely and well-informed decisions.
Indu Asitha, M. N.· International Journal of Com...· 0 citations
The sophistication of cyber threats is growing, and there is a growing need for timely detection and response to security threats, which is now possible with the help of artificial intelligence (AI) based Intrusion Detection System (IDS). While the accuracy of detection has increased with the implementation of more sophisticated machine learning and deep learning models, those models tend to be opaque and complicated, making it difficult for cybersecurity professionals to understand, verify and believe automated predictions. The study explores how XAI can enhance the understanding and accuracy of artificial intelligence (AI) intrusion detection systems (IDSs). The study is carried out using the qualitative method which examines the application of the existing techniques of XAI such as feature attribution, local or global explanation models, visualization techniques and rule based interpretations for explaining the techniques and gaining enhanced confidence of the analyst and informed security decisions. The secondary data used in this research was obtained from scholarly articles, cybersecurity frameworks, industry reports, and case studies to identify real-world applications, problems in implementation, as well as the current trends of the explainable AI for cyber defense. The results showed that embedding explainability in an IDS enhances the human-AI partnership, allowing security analysts to confirm the results of their IDS, mitigate false-positive ambiguity, optimize incident response, and meet regulatory and ethical obligations. Other challenges remain such as: maintaining the explainability attribute while obtaining the predictive performance, handling large traffic density, avoiding adversarial manipulation on the explanation mechanisms, and scalability. The study finds explainable AI to be an important milestone on the path towards trustworthy and responsible cybersecurity systems. By enabling organizations to make their security operations more resilient, boost the trust in automated cyber defense, and enhance transparency without compromising detection, XAI can help organizations achieve these goals. The study provides valuable insights for practitioners in the cybersecurity industry, AI developers, decision makers and organizations developing intrusion detection systems that are transparent, reliable and ethically responsible in the dynamic digital landscape.
Christian Manna Guimma· Scriptora International Jour...· 0 citations
This research presents an in-depth threat analysis of HexStrike-AI, examining its architecture, attack capabilities, and potential implications for critical infrastructures, and proposes defensive countermeasures to mitigate the risks posed by such tools.
Dr. D. Bhuvaneswari, Dr. V. Shoba· International Journal of Eng...· 0 citations
This review provides a novel synthesis of recent Large Language Model applications in threat hunting and identifies critical research gaps, and presents a refined perspective on the practical implementation and future trajectory of these technologies.
The rapid expansion of Internet of Things (IoT) devices has introduced significant security challenges, creating a growing need for advanced Intrusion Detection Systems (IDS) capable of identifying cyber threats in real time. Traditional IDS solutions often struggle to cope with the dynamic and heterogeneous nature of modern IoT environments. As a result, Artificial Intelligence (AI)-based approaches have emerged as promising alternatives due to their ability to learn complex patterns and adapt to evolving threats. This study investigates the integration of Machine Learning (ML) and Deep Learning (DL) techniques to enhance the accuracy, efficiency, and adaptability of IDS in IoT networks. A Next Generation AI-based IDS is proposed to detect and classify various types of cyberattacks. The framework combines anomaly detection, behavioral analysis, and malicious pattern recognition to identify and mitigate security threats with minimal latency. To improve attack detection, a pre-trained Adaptive Recurrent Neural Network (A-RNN) is employed to effectively extract attack patterns from network traffic data. These extracted patterns are then processed using a hybrid Stacked Long Short-Term Memory (S-LSTM) and Convolutional Neural Network (CNN) architecture for accurate attack classification. The effectiveness of the proposed model is evaluated using two real-world datasets, namely the BETH Dataset and the IoT-23 Dataset. Experimental results demonstrate that the proposed AI-driven IDS achieves superior performance compared to existing approaches, highlighting its potential as a robust and efficient solution for securing IoT environments against emerging cyber threats.
D. G, D. R, Sushmitha J et al.· Genetics and Molecular Resea...· 0 citations
