INTRUSION AND ANOMALY DETECTION IN CYBER SECURITY USING NATURAL LANGUAGE PROCESSING

Abstract

The swift acceptance of cloud computing, Internet of Things (IoT), and hyper-connected digital services has tremendously increased the cyber-attack surface thus making the classic perimeter security ineffective against modern threats like zero-day exploits, polymorphic malware, large scale DDoS, and advanced persistent threats (APTs). The currently presented review integrates the fundamentals and progress of intrusion detection systems (IDS) and anomaly detection in cybersecurity, where the spotlight is on the shift from signature- and rule-based methods to ML (Machine Learning) and DL (Deep Learning) based detection. The authors classify intrusions and anomalies, give an overview of typical attack types and their identifiers, and also correlate host-based IDS (HIDS) and network-based IDS (NIDS) on the bases of installation, observability, scalability, and operational trade-offs. Apart from that, the paper also discusses supervised, unsupervised, and representation-learning model (e.g., SVMs, clustering, isolation methods, autoencoders, sequence models, and graph-based learning) approaches in their ML/DL methodologies review and addresses how these models help deal with high dimensional and evolving security telemetry. Benchmark datasets (e.g., KDDCup’99, NSL  KDD,  CICIDS2017/2018,  UNSW-NB15)  and  standard evaluation metrics (accuracy, precision, recall, F1, ROC-AUC) are highlighted as means to support reproducible assessment. The conclusions at the end of the paper point out the main hurdles in the real-deployment such as encrypted traffic, high-speed processing constraints, alert fatigue, class imbalance, concept drift, and integration challenges, plus they suggest the future research directions including drift aware online learning, encrypted-traffic compatible features, explainable AI, federated learning, and robust detection for edge/IoT environments.