# Survey of Network Intrusion Detection Methods from the Perspective of the Knowledge Discovery in Databases Process

arXiv: https://arxiv.org/abs/2001.09697 · HTML: https://mlsanity.com/paper/2001.09697/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 27 Jan 2020.

## Built on by (most cited first, 7 of 7)

- [Towards a Fair Comparison and Realistic Evaluation Framework of Android Malware Detectors based on Static Analysis and Machine Learning](https://mlsanity.com/paper/2205.12569/) (2022)
- [Efficient Concept Drift Handling for Batch Android Malware Detection Models](https://mlsanity.com/paper/2309.09807/) (2023)
- [A review of Federated Learning in Intrusion Detection Systems for IoT](https://mlsanity.com/paper/2204.12443/) (2022)
- [GowFed -- A novel Federated Network Intrusion Detection System](https://mlsanity.com/paper/2210.16441/) (2022)
- [Evaluating ML-Based Anomaly Detection Across Datasets of Varied Integrity: A Case Study](https://mlsanity.com/paper/2401.16843/) (2024)
- [Light up that Droid! On the Effectiveness of Static Analysis Features against App Obfuscation for Android Malware Detection](https://mlsanity.com/paper/2310.15645/) (2023)
- [Assessing the Impact of a Supervised Classification Filter on Flow-based Hybrid Network Anomaly Detection](https://mlsanity.com/paper/2310.06656/) (2023)

## Abstract (arXiv)

The identification of cyberattacks which target information and communication systems has been a focus of the research community for years. Network intrusion detection is a complex problem which presents a diverse number of challenges. Many attacks currently remain undetected, while newer ones emerge due to the proliferation of connected devices and the evolution of communication technology. In this survey, we review the methods that have been applied to network data with the purpose of developing an intrusion detector, but contrary to previous reviews in the area, we analyze them from the perspective of the Knowledge Discovery in Databases (KDD) process. As such, we discuss the techniques used for the capture, preparation and transformation of the data, as well as, the data mining and evaluation methods. In addition, we also present the characteristics and motivations behind the use of each of these techniques and propose more adequate and up-to-date taxonomies and definitions for intrusion detectors based on the terminology used in the area of data mining and KDD. Special importance is given to the evaluation procedures followed to assess the different detectors, discussing their applicability in current real networks. Finally, as a result of this literature review, we investigate some open issues which will need to be considered for further research in the area of network security.