Artificial Intelligence for Anomaly Detection in Cyber Defense: A Critical Review of Methodological Trends, Datasets, and Explainability

Abstract

The increase in the number and complexity of interconnected systems requires new methods to identify potential threats in today’s hyperconnected world. This trend affects systems ranging from smart homes and Internet of Things (IoT) devices to critical infrastructure which must be equipped with the corresponding cyber defense methods. Given the new landscape, it is more difficult for classical cybersecurity systems to stay up to date with novel threats, as well as to keep track of all interconnected devices defined by various protocols and behaviors. Artificial intelligence (AI) represents a strong candidate to complement traditional cyber defense methods due to its adaptability to variation and capability to identify complex data patterns, which has led researchers to develop state-of-the-art anomaly detection systems. The current critical review aims to analyze the scientific literature on three dimensions including used algorithms and datasets, domain challenges hindering AI deployment in productive environments, and the capability of explainable artificial intelligence (XAI) to support cyber security experts with insights into the model’s inner workings and decision rationale. Compared to existing scientific reviews, this paper moves beyond algorithmic comparison by providing a methodological interpretation of AI anomaly detection landscape, demonstrating how data availability, learning paradigms, and explainability collectively influence the evolution of cyber defense research towards operational deployment. This approach revealed that AI development for cyber defense is highly heterogenous, and that the available datasets strongly influence the algorithm of choice, rather than the models being chosen methodologically based on proven performance. The analysis further indicates that operational deployment remains challenging, as the literature continues to report substantial limitations related to data quality, computational requirements, and model interpretability.