Jul 2026· International journal of computer information systems and industrial management applications· Vol 18, pp. 407-427· 0 citations
TL;DR
The study analyzes the most recent progress in ML and DL methods used to develop IDS that operate in WSNs through analysis of their primary algorithms and algorithmic combinations and concludes that the DL and hybrid approaches are superior to conventional ML algorithms in handling complicated and imbalanced datasets.
Abstract
The safety and reliability of Wireless Sensor Networks (WSNs) depend on the crucial function that Intrusion Detection Systems (IDS) perform in their operations. The current security systems face major obstacles because attackers continuously launch cyber operations against increasingly complex networks. Through the development of Artificial Intelligence (AI) technologies, which include Machine Learning (ML) and Deep Learning (DL) methods, IDS systems could now identify both standard and novel cyber threats. The study analyzes the most recent progress in ML and DL methods used to develop IDS that operate in WSNs through analysis of their primary algorithms and algorithmic combinations. The study conducted an extensive literature review by accessing the SCOPUS database to identify relevant studies published between 2021 and 2026. The systematic review follows the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) guidelines. As revealed by the results, the DL and hybrid approaches are superior to conventional ML algorithms in handling complicated and imbalanced datasets. Some of the accuracy rates observed are 99.94% when using KMeans-SMOTE, and 99.76% when using K-nearest neighbor (KNN). However, Deep Neural Networks (DNN) and Convolutional Neural Network–Long Short-Term Memory (CNN-LSTM) networks demonstrate relatively low accuracy levels of 96.23% and 97%, respectively. Most approaches use specific datasets, including WSN-DS and NSL-KDD, which makes the results environment-specific. Besides, issues such as high computational power, data imbalance, absence of standardized datasets, and implementation constraints underscore the need for a scalable and adaptable IDS for WSN.
The use of Artificial Intelligence (AI) and Machine Learning (ML) in cybersecurity, especially for creating Intrusion Detection Systems (IDSs), has become increasingly important. These systems are essential for detecting malicious behaviour, identifying network issues, and stopping cyberattacks in real time. Despite extensive research on various ML and Deep Learning (DL) models for IDS, the current literature remains incomplete. It has many different datasets, methods, and evaluation standards. As cyber threats become more advanced, it is crucial to conduct a thorough analysis of ML techniques for intrusion detection. The goal of this Systematic Literature Review (SLR) is to provide a full picture of the most recent academic articles on ML-based IDS. The study addresses important research questions about the most widely used algorithms, the types of attacks and network environments covered, the methodological problems that remain unsolved, and the new trends that should shape future research. Following the PRISMA framework, we conducted a systematic review of peer-reviewed articles published between January 2022 and May 2025. We searched IEEE Xplore, ACM Digital Library, and SpringerLink, yielding 22,558 initial records. After carefully applying strict inclusion criteria, 125 papers were selected for the final analysis. We created a standardised data extraction form (i.e., using MS Excel) to gather bibliographic details, research emphasis, methodological strategies, datasets, evaluation criteria, and recognised constraints. We employed thematic analysis to develop a clear taxonomy. We identified five main research themes in our analysis: (1) ensemble and hybrid learning pipelines focused on performance optimisation (30 papers), (2) context-specific IDS designs for Internet of Things (IoT), cloud, and Software-Defined Networking (SDN) environments (34 papers), (3) data-centric engineering that deals with class imbalance and feature selection (20 papers), (4) deep neural architectures for representation learning (31 papers), and (5) trustworthiness concerns like adversarial robustness, zero-day detection, and Explainable AI (XAI) (10 papers). Convolutional Neural Networks (CNNs), Long Short-Term Memory (LSTM), and Random Forests are the most commonly used algorithms, often combined. Nonetheless, significant deficiencies remain: about 2% of papers incorporate XAI, only 4% focus on adversarial robustness, and none validate their models in real-world production settings. Denial-of-Service (DoS) and Distributed DoS (DDoS) attacks are the most common types in the literature, whereas Web attacks, ransomware, and advanced persistent threats remain poorly studied. The number of publications grows at an average of 30.2% annually, but the field still relies on legacy benchmark datasets rather than operational validation.
Ali Ahmed, Ramy Mostafa, Mahmoud H. Qutqut et al.· Future Internet· 0 citations
The review reveals that the most used algorithm for DRL-based IDS is Deep Q-Network (DQN), appearing in 8 studies (30.8%), and the most frequently targeted attacks are DoS, DDoS, Backdoors, Mirai, Reconnaissance, Scan, and Torii.
Maryam Omar Abdullah Sawad, S. Abdulkadir, H. Alhussian et al.· Computer Modeling in Enginee...· 0 citations
The majority of assaults in heterogeneous networks are detected by intrusion detection systems (IDS). Cyberattack kinds that seriously harm networks are difficult for conventional IDSs to detect. The majority of existing solutions rely on deep learning models, which have a significant computational and energy overhead that limits their use in IoT environments with limited resources. A lightweight IDS based on ML is proposed in this research as a solution to this difficulty. Predicting the behavior of network traffic is achieved using ToN-IoT data and a tailored preprocessing pipeline. The voting-based ensemble classifier is built through the combination of models of RF and LightGBM to enhance the stability of the classification. The standard performance measures that are utilized to evaluate the proposed approach include accuracy, precision, recall, F1score, false alarm rates, and ROC analysis. The experimental findings indicate that RF achieve 99.81% accuracy, LGBM achieve 99.83%, and the ensemble model has a high accuracy of 99.99% with very low false alarms. Comparative evaluation with traditional ML and DL models demonstrates improved detection reliability with reduced computational overhead. These results prove that the suggested architecture is both computationally efficient and practically applicable to IoT settings with limited resources. However, direct hardware-level energy measurements are required to fully quantify the energy-saving characteristics of the proposed IDS.
Abhinay Kumar Reddy Seella, Rupesh Shirke, Vijay Kumar Kasuba et al.· International Conference on...· 0 citations
Wireless sensor networks (WSNs) play a vital role in modern applications such as environmental monitoring, industrial automation, and smart infrastructure, where reliable data transmission, robustness, and energy efficiency are essential. However, their distributed architecture and constrained computational resources make them highly vulnerable to a wide range of security threats, including Blackhole, Grayhole, Flooding, and Scheduling attacks. These attacks can severely disrupt network functionality, degrade data integrity, and compromise the overall reliability of mission-critical operations. To address these challenges, we present an intrusion detection system (IDS) framework that leverages a diverse set of machine learning (ML) models, incorporating both boosting and non-boosting techniques, as well as deep learning (DL) architectures, including sequential and non-sequential designs. This diversity enables the framework to capture varied learning behaviors and decision boundaries. To further enhance detection accuracy and adaptability, Ant colony optimization (ACO) is employed as a metaheuristic tuning layer, refining hyperparameters to improve performance under the strict resource limitations typical of WSN environments. Each model is evaluated in both its baseline and ACO-optimized form, enabling a detailed comparative analysis that highlights the influence of optimization on intrusion detection effectiveness. Experimental results demonstrate that ACO significantly strengthens model resilience against diverse threats, offering an adaptive and efficient approach to securing modern WSN infrastructures.
Mortada Falah Badri, Mina Malekzadeh· Journal of Electronic &...· 0 citations
Security researchers rely heavily on Network Intrusion Detection Systems (NIDS) to keep an eye on network traffic and notify administrators of any suspicious activities. The purpose of this paper is to offer a comprehensive overview of intrusion detection systems (IDS), including the following topics: fundamentals, kinds of IDS, methods for detecting intrusions in NIDS, the architecture of IDS, data pre-processing, and examples of ML techniques used in NIDS. This covers several detection methods, including signature-based, anomaly-based, specification-based, and behavior-based approaches, as well as their advantages and disadvantages in recognizing both existing and new cyber threats. The review also covers the architecture of NIDS which consists of network sensors, preprocessors, network traffic analysis, alert generation and security analysis. A variety of ML techniques, including supervised, unsupervised, semi-supervised, ensemble, and deep learning (DL) approaches, are being explored to improve the accuracy and adaptability of intrusion detection systems (IDS). Other applications such as DoS/DDoS attack detection, Malware detection, Botnets, Brute force attacks, Insider compromise, IoT compromise and Critical infrastructure threats are also shown. Despite all the challenges in terms of false positives, scalability, computational complexity, data quality, and novel attack styles, the features that ML can provide for intelligent, adaptive, and accurate intrusion detection systems are appealing.
Madhav Sharma· International Journal of Cyb...· 0 citations
LSTM had good detection for frequent attacks and slow-changing patterns, which shows its capacity in learning long-lasting dependencies, which shows its capacity in learning long-lasting dependencies.
Jawad Hussain Awan, Misbah Safdar, Muhammad Ayaz Shirazi et al.· Italian National Conference...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
