Abstract

A large number of devices connected to the Internet, cloud technology, and digital communication methods have contributed to a greater incidence of risk events in the field of digital security. Existing detection methods using fingerprints, signatures, and rules cannot always necessarily identify so-called zero-day attacks and the new methods of penetration of businesses. Therefore, the need for ML-based detection emerges because of the new possibilities for detection of hidden deviations in the behavior of networks. The aim of this article is to provide a comprehensive overview of the existing ML-based intrusion detection systems (IDS). In the course of the work the analysis of standard chains of operations, assessment of the theory behind most widely used IDS, classification of various environments of evaluation using NSL-KDD, CICIDS2017, and UNSW-NB15 benchmarks, and development of current indexes of efficiency are performed. In addition, the most important problems such as the problem of imbalance of data, the problem of attacks against static models, and the problem of interpretability of models have been discussed.

Keywords