A review of Machine Learning-based zero-day attack detection: Challenges and future directions

• Published in: Computer communications Vol. 198; pp. 175 - 185
• Main Author: Guo, Yang
• Format: Journal Article
• Language: English
• Published: Elsevier B.V 15.01.2023
• Subjects: Attack detection; Machine Learning; Zero-day attacks; Attack detection; Machine Learning; Zero-day attacks
• ISSN: 0140-3664; 1873-703X
• DOI: 10.1016/j.comcom.2022.11.001

Zero-day attacks exploit unknown vulnerabilities so as to avoid being detected by cybersecurity detection tools. The studies (Bilge and Dumitraş, 2012, Google, 0000, Ponemon Sullivan Privacy Report, 2020) show that zero-day attacks are wide spread and are one of the major threats to computer security. The traditional signature-based detection method is not effective in detecting zero-day attacks as the signatures of zero-day attacks are typically not available beforehand. Machine Learning (ML)-based detection method is capable of capturing attacks’ statistical characteristics and is, hence, promising for zero-day attack detection. In this survey paper, a comprehensive review of ML-based zero-day attack detection approaches is conducted, and their ML models, training and testing data sets used, and evaluation results are compared. While significant efforts have been put forth to develop accurate and robust zero-attack detection tools, the existing methods fall short in accuracy, recall, and uniformity against different types of zero-day attacks. Major challenges toward the ML-based methods are identified and future research directions are recommended at last.