THE EVOLUTION OF INTRUSION DETECTION SYSTEMS: A COMPREHENSIVE REVIEW OF MODERN DATASETS, DEEP LEARNING APPROACHES, AND ARCHITECTURAL CHALLENGES

Abstract

Intrusion Detection Systems (IDS) remain a critical component of cybersecurity. They are rapidly evolving to counter increasingly complex threats across various environments, such as the Internet of Things (IoT), the Industrial Internet of Things (IIoT), vehicular networks, and critical infrastructure. The objective of this work is a comprehensive analysis of the evolution of Intrusion Detection Systems (IDS) from 2020 to 2025. Grounded in contemporary research, it examines the integration of Machine Learning (ML), Deep Learning (DL), Federated Learning (FL), and novel hybrid techniques into IDS, summarizing advancements in their operational capabilities. Key trends include a significant shift toward deep learning architectures-specifically Transformers and Vision Transformers (ViT)-for enhanced pattern recognition. Additionally, the adoption of Federated Learning and fog computing-based systems is observed, aiming to preserve privacy and address challenges related to data decentralization and non-independent and identically distributed (Non-IID) data. Furthermore, there is growing emphasis on Explainable AI (XAI), attack lifecycle-based datasets, and model robustness against adversarial attacks. The results obtained. The review proposes a comprehensive multi-criteria classification of systems, enabling a thorough description and comparison of various solutions. The paper critically evaluates contemporary input datasets and conducts a comparative efficiency analysis of different intrusion detection methodologies. Analysis indicates that although algorithms achieve accuracy exceeding 98% on benchmark datasets, several critical challenges remain unresolved. These include class imbalance, the capability to detect novel and unknown threats, scalability in real-world operational environments, and ethical privacy concerns. Conclusions. This study addresses gaps in previous reviews by highlighting the lack of unified datasets, the need for model validation in real-world environments, and adaptive protection against zero-day attacks and encrypted traffic. It proposes a roadmap for the development of more robust, decentralized, and interpretable IDS.