AI_BASED DETECTION OF KNOWN AND UNKNOWN CYBER ATTACK

Detecting known and unknown cyber attacks sits at the intersection of machine learning, network security, and data engineering. This review organised twenty recent studies and supporting literature into eight themes, compared detection approaches and datasets, and illustrated their integration through a proposed web-based detection system. The analysis shows that supervised, one-class, deep, open-set, meta-learning, and reinforcement-learning methods each solve part of the problem, and that reported scores are highest in binary or in-distribution tests. Generalization across datasets, identification of truly unseen attacks, false-alarm control, concept drift, adversarial robustness, and lightweight real-time deployment remain unresolved. For the reference system, the next steps are to evaluate it on modern datasets with held-out attack families, to report precision, recall, F1-score, false-positive rate, and latency, to add explainable outputs, and to test continuous learning under controlled conditions. No single model can be expected to detect every future attack, but a layered, explainable, and continuously evaluated system can raise the chance that abnormal behaviour is noticed early and give analysts useful evidence.

[1]     K. Scarfone and P. Mell, "Guide to intrusion detection and prevention systems (IDPS)," Nat. Inst. Standards Technol., Gaithersburg, MD, USA, Spec. Publ. 800-94, Feb. 2007. [2]     L. Bilge and T. Dumitraş, "Before we knew it: An empirical study of zero-day attacks in the real world," in Proc. ACM Conf. Comput. Commun. Secur. (CCS), 2012, pp. 833–844. [3]     A. L. Buczak and E. Guven, "A survey of data mining and machine learning methods for cyber security intrusion detection," IEEE Commun. Surveys Tuts., vol. 18, no. 2, pp. 1153–1176, 2016. [4]     V. Chandola, A. Banerjee, and V. Kumar, "Anomaly detection: A survey," ACM Comput. Surv., vol. 41, no. 3, Art. no. 15, 2009. [5]     L. Y. Por, Z. Dai, S. J. Leem, Y. Chen, J. Yang, F. Binbeshr, K. Y. Phan, and C. S. Ku, "A systematic literature review on AI-based methods and challenges in detecting zero-day attacks," IEEE Access, vol. 12, pp. 144150–144163, 2024, doi: 10.1109/ACCESS.2024.3455410. [6]     S. G. E. Gökstorp, S. Katsikeas, and P. Johnson, "Machine learning for cybersecurity: A comprehensive literature review," ACM Comput. Surv., vol. 58, no. 9, 2026. [7]     R. Sommer and V. Paxson, "Outside the closed world: On using machine learning for network intrusion detection," in Proc. IEEE Symp. Secur. Privacy (S&P), 2010, pp. 305–316. [8]     A. Al Siam et al., "Securing the unseen: A comprehensive exploration review of AI-powered models for zero-day attack detection," Expert Syst., vol. 43, no. 3, 2026. [9]     B. Kitchenham, "Procedures for performing systematic reviews," Keele Univ., Keele, U.K., Tech. Rep. TR/SE-0401, 2004. [10]   W. J. Scheirer, A. de Rezende Rocha, A. Sapkota, and T. E. Boult, "Toward open set recognition," IEEE Trans. Pattern Anal. Mach. Intell., vol. 35, no. 7, pp. 1757–1772, 2013.