Enhancing Intrusion Detection: A Comprehensive Review of Hybrid Machine Learning and Deep Learning Approaches

Abstract

: The growing frequency of attacks and increasing sophistication have brought forth the shortcomings of traditional IDSs, which are incapable of zero-day threat detection and carrying out comparative studies on imbalanced datasets. Challenged with such constraints, the researchers have ended up encouraging the hybridization of ML and DL techniques. ML approaches, which include Decision Trees, Random Forests, and Support Vector Machines, offer interpretability and efficiency, while DL systems, which consist of CNNs, RNNs, and Autoencoders, exhibit superior feature extraction and pattern recognition capabilities. Unlike typical ML systems which heavily rely on manual feature engineering, DL systems require vast amounts of labeled data, the deployment of which is still a challenge due to its computational complexity. Hybrid approaches combine the advantages of representation learning in DL with efficient and interpretable classification by ML. Therefore, this review integrates the state-of-the-art advances in hybrid-based IDS concerning the enhancement of Detection Accuracy, decrease of FP rate, and adaptive behavior to the dynamics of the attack landscapes. Benchmark evaluations on datasets such as NSL-KDD, UNSW-NB15, and CICIDS2017 have shown the hybrid models to be notably successful in balancing between precision, scalability, and real-time considerations. However, challenges in speed traffic handling, explaining, and privacy concerns in distributed environments remain. The future directions encompass researching federated learning, transfer learning, and lightweight architectures toward optimized IDSs for cloud, IoT, and critical infrastructures.