Adversarial Robustness of Deep Learning-Based Intrusion Detection Systems: A Systematic Literature Review of Attacks, Defenses, Datasets, and Open Challenges

Abstract

Deep learning has become the default approach for modern intrusion detection. However, the same models that classify benign and malicious traffic with very high accuracy can be fooled by small, deliberately crafted perturbations. We report a systematic literature review of how this vulnerability has been studied in deep-learning-based intrusion detection systems (IDS) over the period from January 2020 to March 2026. The review follows the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) 2020 protocol. After screening 5,890 records retrieved from Scopus, IEEE Xplore, Web of Science, and ScienceDirect (single-reviewer screening calibrated against a second reviewer on a 50-record sample with Cohen’s $\kappa = 0.81$ ), and after retrieving 252 full texts, 216 primary studies were included. We organize the body of work along four axes: the attacks that have been applied to deep-learning IDS, the defenses that have been proposed, the datasets and metrics used to evaluate them, and the challenges that remain open. Across the 216 studies, attention was heavily skewed toward white-box gradient attacks (the Fast Gradient Sign Method [FGSM] in 76.9% of studies, Carlini–Wagner [C&W] in 60.2%, and Projected Gradient Descent [PGD] in 50.9%) and adversarial training as the defense (61.6%). In contrast, query-based black-box attacks such as Square Attack (2.8%) and AutoAttack (2.3%) are rare, certified defenses are reported in only 6.0% of studies, and the newer Internet of Things (IoT) benchmarks, CICIoT2023, CICIoMT2024, and CICIoV2024, appear in less than five percent of the corpus combined. We close with 12 concrete research gaps and 12 practitioner recommendations intended to guide the next iteration of robust IDS design.