Data Mining Techniques in Intrusion Detection Systems: A Systematic Literature Review

The continued ability to detect malicious network intrusions has become an exercise in scalability, in which data mining techniques are playing an increasingly important role. We survey and categorize the fields of data mining and intrusion detection systems, providing a systematic treatment of methodologies and techniques. We apply a criterion-based approach to select 95 relevant articles from 2007 to 2017. We identified 19 separate data mining techniques used for intrusion detection, and our analysis encompasses rich information for future research based on the strengths and weaknesses of these techniques. Furthermore, we observed a research gap in establishing the effectiveness of classifiers to identify intrusions in modern network traffic when trained with aging data sets. Our review points to the need for more empirical experiments addressing real-time solutions for big data against contemporary attacks.