🤖 AI Summary
This paper addresses the limited generalization capability of deep learning–based intrusion detection systems (DL-IDS) in detecting zero-day attacks. To tackle this challenge, it presents the first holistic, full-stack analysis of DL-IDS technical evolution—spanning data acquisition, log parsing, behavioral graph modeling, attack detection, and forensic traceability. The authors propose a unified framework integrating convolutional neural networks (CNNs), recurrent neural networks (RNNs), graph neural networks (GNNs), and self-supervised representation learning, enhanced by structured log parsing and dynamic graph summarization techniques. The survey systematically categorizes 12 mainstream methodologies, benchmarks performance across 7 publicly available datasets, and identifies 5 fundamental challenges. As the first comprehensive panorama dedicated to zero-day attack generalization in DL-IDS, this work establishes both theoretical foundations and practical guidelines for intelligent, adaptive cybersecurity detection.
📝 Abstract
Intrusion Detection Systems (IDS) have long been a hot topic in the cybersecurity community. In recent years, with the introduction of deep learning (DL) techniques, IDS have made great progress due to their increasing generalizability. The rationale behind this is that by learning the underlying patterns of known system behaviors, IDS detection can be generalized to intrusions that exploit zero-day vulnerabilities. In this survey, we refer to this type of IDS as DL-based IDS (DL-IDS). From the perspective of DL, this survey systematically reviews all the stages of DL-IDS, including data collection, log storage, log parsing, graph summarization, attack detection, and attack investigation. To accommodate current researchers, a section describing the publicly available benchmark datasets is included. This survey further discusses current challenges and potential future research directions, aiming to help researchers understand the basic ideas and visions of DL-IDS research, as well as to motivate their research interests.