An Investigation into the Performances of the State-of-the-art Machine Learning Approaches for Various Cyber-attack Detection - A Survey

Aug 5, 2026

Upload by Noah

This survey analyzes the suitability of leading state-of-the-art machine learning models for multiple categories of cyberattack detection over the past five years, prioritizing recent work for comparative insight. It evaluates the effectiveness, efficiency, and limitations of modern classifiers and new detection frameworks across different cyberattack types. The findings highlight research gaps, including further study for drive-by download attacks, opportunities to improve Naive Bayes mix performance, and limitations in detecting already-compromised SQLi scenarios.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages10

Reading Time25 min

AccessFree to download

Introduction

Background Study

An Investigation into the Performances of the State-of-the-art Machine Learning Approaches for Various Cyber-attack Detection: A Survey arXiv :2402 . 17045v2 [ cs .CR] 10 May 2024 1st Tosin Ige dept. of Computer Science The University of Texas at El Paso Texas, USA [toige@miners.utep.edu](toige@miners.utep.edu) 2nd Christophet Kiekintveld dept. of Computer Science The University of Texas at El Paso Texas, USA[cdkiekintveld@utep.edu](cdkiekintveld@utep.edu) 3rd Aritran Piplai dept. of Computer Science The University of Texas at El Paso Texas, USA [apiplai@utep.edu](apiplai@utep.edu) Abstract—In this research, we analyzed the suitability of each of the current state-of-the-art machine learning models for various cyberattack detection from the past 5 years with a major emphasis on the most recent works for comparative study to identify the knowledge gap where work is still needed to be done with regard to detection of each category of cyberattack. We also reviewed the suitability, effeciency and limitations of recent research on state-of-the-art classifiers and novel frameworks in the detection of differnet cyberattacks. Our result shows the need for; further research and exploration on machine learning approach for the detection of drive-by download attacks, an investigation into the mix performance of Naive Bayes to identify possible research direction on improvement to existing stateof-the-art Naive Bayes classifier, we also identify that current machine learning approach to the detection of SQLi attack cannot detect an already compromised database with SQLi attack signifying another possible future research direction. Index Terms—Cyberattack, SQL attack, Drive-By attack, Malware Attack, Phishing Attack, cyberattack detection, Machine Learning, Machine Learning Algorithms I. INTRODUCTION The fact that modern systems are not perfect guarantees that there will always be vulnerabilities no matter how small which could be exploited by an attacker to have unauthorized access which will enable him to violate security policy. Every modern system has vulnerabilities that could be exploited because exploitation could be developed for any system whose vulnerabilities could be described, hence, attacks are easily developed the moment such vulnerabilities are found. It is for this reason that finding vulnerabilities that are previously undiscovered as one of the proven ways to be a hacker elite is a strong cybersecurity culture. At the same time, an exploit isan attack through the vulnerability of a computer system with the purpose of causing either denial-of-service (DoS), install malware such as ransomware, Trojan horses, worms, spyware and so on. The result of a successful attack is what leads to security breach which is an unauthorized access to entity in the cyberspace, this often result in loss of confidentiality, integrity, or availability of data and information, as the attacker is able to remove or manipulate sensitive information. On the other hand, modern attacker have developed a sophisticated social engineering technique by the use of low level of technology attack such as impersonation, bribes, lies, tricks, threats, and blackmail in order to compromise computer system. Social engineering usually relies on trickery for information gathering and the aim is to manipulate people to perform action(s) which will lead to the attacker getting confidential information of the person or organization. Phishing attack falls into this category of attack because the attacker use trick that can eventually lead the victim into divulging sensitive and personal information which attacker can use to gain access to server, compromise organization system, or commit various cyber crime which includes but not limited to business email compromise (BEC), phishing, malware attack, denial of service (DDoS) attack, Eavesdropping Attacks, Ransomware attack and so on. In order to secure computer and information systems from attacker t

FAQs

What is the main goal of this survey?

To compare state-of-the-art machine learning models for different cyberattack detection categories and identify knowledge gaps that still need further research.

Which cyberattack detection research gaps does the survey highlight?

It calls for further work on drive-by download attack detection, investigates improvement directions for Naive Bayes, and notes that some existing approaches for SQLi cannot detect already compromised databases with SQLi signs.

Which machine learning approaches and classifiers are discussed in the study?

The survey discusses a range of models including Support Vector Machine (SVM), Logistic Regression (LR), Naive Bayes variants, deep learning methods, decision trees, random forests, and XGBoost, among others.

Aug 5, 2026

Upload by Noah