A SYSTEMATIC LITERATURE REVIEW ON NETWORK INTRUSION DETECTION SYSTEMS: ATTACK TYPES, DATASETS, EVALUATION METRICS, AND OPEN CHALLENGES

Abstract

The rapid evolution of networked systems and the proliferation of cyber threats have made Intrusion Detection Systems (IDS) an essential component of modern cybersecurity frameworks. Among various attack categories, Denial of Service (DoS) and brute force attacks remain highly prevalent due to their disruptive impact and ease of execution. This study presents a Systematic Literature Review (SLR) on network intrusion detection systems, focusing on attack types, datasets, evaluation metrics, and open challenges. A PRISMA-based methodology was adopted to analyze fifteen recent peer-reviewed studies (2023–2026) from major academic databases, including IEEE Xplore, ScienceDirect, SpringerLink, and ACM Digital Library. The study by Abdulkareem et al. (2024) is used as the baseline reference. The review identifies key intrusion attack categories, with emphasis on DoS/DDoS and brute force attacks, alongside other threats such as botnet and web-based attacks. Widely used datasets, including CICIDS2017, CSE-CICIDS2018, and UNSW-NB15, are examined, revealing challenges such as class imbalance, redundancy, and limited real-world representation. Additionally, commonly used evaluation metric (accuracy, precision, recall, and F1-score) are analyzed, highlighting limitations of relying on single metrics. The study further identifies critical challenges, including high false positive rates, scalability issues, computational complexity, and the lack of lightweight IDS solutions. These findings provide a comprehensive understanding of the problem domain and a foundation for future research