{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,31]],"date-time":"2026-01-31T06:33:28Z","timestamp":1769841208423,"version":"3.49.0"},"reference-count":61,"publisher":"Emerald","issue":"2","license":[{"start":{"date-parts":[[2017,4,10]],"date-time":"2017-04-10T00:00:00Z","timestamp":1491782400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.emerald.com\/insight\/site-policies"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["OIR"],"published-print":{"date-parts":[[2017,4,10]]},"abstract":"<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Purpose<\/jats:title>\n<jats:p>The paper addresses various cyber threats and their effects on the internet. A review of the literature on intrusion detection systems (IDSs) as a means of mitigating internet attacks is presented, and gaps in the research are identified. The purpose of this paper is to identify the limitations of the current research and presents future directions for intrusion\/malware detection research.<\/jats:p>\n<\/jats:sec>\n<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Design\/methodology\/approach<\/jats:title>\n<jats:p>The paper presents a review of the research literature on IDSs, prior to identifying research gaps and limitations and suggesting future directions.<\/jats:p>\n<\/jats:sec>\n<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Findings<\/jats:title>\n<jats:p>The popularity of the internet makes it vulnerable against various cyber-attacks. Ongoing research on intrusion detection methods aims to overcome the limitations of earlier approaches to internet security. However, findings from the literature review indicate a number of different limitations of existing techniques: poor accuracy, high detection time, and low flexibility in detecting zero-day attacks.<\/jats:p>\n<\/jats:sec>\n<jats:sec>\n<jats:title content-type=\"abstract-subheading\">Originality\/value<\/jats:title>\n<jats:p>This paper provides a review of major issues in intrusion detection approaches. On the basis of a systematic and detailed review of the literature, various research limitations are discovered. Clear and concise directions for future research are provided.<\/jats:p>\n<\/jats:sec>","DOI":"10.1108\/oir-12-2015-0394","type":"journal-article","created":{"date-parts":[[2017,4,7]],"date-time":"2017-04-07T06:26:00Z","timestamp":1491546360000},"page":"171-184","source":"Crossref","is-referenced-by-count":74,"title":["Internet attacks and intrusion detection system"],"prefix":"10.1108","volume":"41","author":[{"given":"Raman","family":"Singh","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Harish","family":"Kumar","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ravinder Kumar","family":"Singla","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ramachandran Ramkumar","family":"Ketti","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"140","reference":[{"issue":"3","key":"key2020120808591006200_ref001","doi-asserted-by":"crossref","first-page":"183","DOI":"10.1016\/j.techsoc.2010.07.001","article-title":"An overview of social engineering malware: trends, tactics, and implications","volume":"32","year":"2010","journal-title":"Technology in Society"},{"issue":"9","key":"key2020120808591006200_ref002","doi-asserted-by":"crossref","first-page":"2221","DOI":"10.1016\/j.comnet.2011.03.005","article-title":"A hybrid model for correlating alerts of known and unknown attack scenarios and updating attack graphs","volume":"55","year":"2011","journal-title":"Computer Networks"},{"issue":"5","key":"key2020120808591006200_ref003","doi-asserted-by":"crossref","first-page":"431","DOI":"10.1108\/IMCS-02-2013-0007","article-title":"Using response action with intelligent intrusion detection and prevention system against web application malware","volume":"22","year":"2014","journal-title":"Information Management & Computer Security"},{"key":"key2020120808591006200_ref004","first-page":"1","article-title":"Extreme learning machines for intrusion detection","year":"2012"},{"key":"key2020120808591006200_ref005","doi-asserted-by":"crossref","first-page":"95","DOI":"10.1016\/j.ins.2014.09.025","article-title":"A nature-inspired approach to speed up optimum-path forest clustering and its application to intrusion detection in computer networks","volume":"294","year":"2015","journal-title":"Information Sciences"},{"key":"key2020120808591006200_ref006","first-page":"1414","article-title":"Research and implementation on snort-based hybrid intrusion detection system","year":"2009"},{"issue":"5","key":"key2020120808591006200_ref007","doi-asserted-by":"crossref","first-page":"2670","DOI":"10.1016\/j.eswa.2014.11.009","article-title":"A novel feature-selection approach based on the cuttlefish optimization algorithm for intrusion detection systems","volume":"42","year":"2015","journal-title":"Expert Systems with Applications"},{"issue":"7","key":"key2020120808591006200_ref008","doi-asserted-by":"crossref","first-page":"4349","DOI":"10.1016\/j.asoc.2010.12.004","article-title":"Alert correlation in collaborative intelligent intrusion detection systems \u2013 a survey","volume":"11","year":"2011","journal-title":"Applied Soft Computing"},{"issue":"15","key":"key2020120808591006200_ref009","doi-asserted-by":"crossref","first-page":"5895","DOI":"10.1016\/j.eswa.2013.05.001","article-title":"An adaptive ensemble classifier for mining concept drifting data streams","volume":"40","year":"2013","journal-title":"Expert Systems with Applications"},{"key":"key2020120808591006200_ref010","doi-asserted-by":"crossref","first-page":"159","DOI":"10.1016\/j.cose.2015.09.007","article-title":"Automatic generation of HTTP intrusion signatures by selective identification of anomalies","volume":"55","year":"2015","journal-title":"Computers & Security"},{"issue":"4","key":"key2020120808591006200_ref011","doi-asserted-by":"crossref","first-page":"609","DOI":"10.1016\/j.jare.2014.02.009","article-title":"A hybrid approach for efficient anomaly detection using metaheuristic methods","volume":"6","year":"2015","journal-title":"Journal of Advanced Research"},{"key":"key2020120808591006200_ref012","doi-asserted-by":"crossref","first-page":"391","DOI":"10.1016\/j.neucom.2016.06.021","article-title":"A two-level hybrid approach for intrusion detection","volume":"214","year":"2016","journal-title":"Neurocomputing"},{"key":"key2020120808591006200_ref013","first-page":"75","article-title":"Anomaly detection in data mining. Hybrid approach between filtering-and-refinement and DBSCAN","year":"2011"},{"key":"key2020120808591006200_ref014","first-page":"1","article-title":"Use of Wiki systems in archaeology: privacy, security and data protection as key problems","year":"2010"},{"issue":"7","key":"key2020120808591006200_ref015","doi-asserted-by":"crossref","first-page":"1461","DOI":"10.1109\/JSAC.2011.110811","article-title":"BrowserGuard: a behavior-based solution to drive-by-download attacks","volume":"29","year":"2011","journal-title":"IEEE Journal on Selected Areas in Communications"},{"issue":"2","key":"key2020120808591006200_ref016","doi-asserted-by":"crossref","first-page":"577","DOI":"10.1109\/TSMCB.2007.914695","article-title":"AdaBoost-based algorithm for network intrusion detection","volume":"38","year":"2008","journal-title":"IEEE Transactions on Systems, Man, and Cybernetics, Part B: Cybernetics"},{"issue":"1","key":"key2020120808591006200_ref017","doi-asserted-by":"crossref","first-page":"135","DOI":"10.1007\/s11859-006-0245-4","article-title":"An intrusion detection method based on hierarchical hidden Markov models","volume":"12","year":"2007","journal-title":"Wuhan University Journal of Natural Sciences"},{"issue":"4","key":"key2020120808591006200_ref018","doi-asserted-by":"crossref","first-page":"3899","DOI":"10.1016\/j.eswa.2011.06.033","article-title":"A differentiated one-class classification method with applications to intrusion detection","volume":"39","year":"2012","journal-title":"Expert Systems with Applications"},{"key":"key2020120808591006200_ref019","unstructured":"Kaspersky (2013), \u201cGlobal corporate IT security risks: 2013\u201d, available at: https:\/\/media.kaspersky.com\/en\/business-security\/Kaspersky_Global_IT_Security_Risks_Survey_report_Eng_final.pdf (accessed November 3, 2015)."},{"issue":"1","key":"key2020120808591006200_ref020","doi-asserted-by":"crossref","first-page":"208","DOI":"10.1016\/j.patcog.2011.06.014","article-title":"Adaptive ROC-based ensembles of HMMs applied to anomaly detection","volume":"45","year":"2012","journal-title":"Pattern Recognition"},{"key":"key2020120808591006200_ref021","doi-asserted-by":"crossref","unstructured":"Kieseberg, P., Hobel, H., Schrittwieser, S., Weippl, E. and Holzinger, A. (2014), \u201cProtecting anonymity in data-driven biomedical science\u201d, in Holzinger, A. and Jurisica, I. (Eds), Interactive Knowledge Discovery and Data Mining in Biomedical Informatics, Lecture Notes in Computer Science (LNCS), Springer, Berlin and Heidelberg, pp. 301-316.","DOI":"10.1007\/978-3-662-43968-5_17"},{"issue":"4","key":"key2020120808591006200_ref022","doi-asserted-by":"crossref","first-page":"1690","DOI":"10.1016\/j.eswa.2013.08.066","article-title":"A novel hybrid intrusion detection method integrating anomaly detection with misuse detection","volume":"41","year":"2014","journal-title":"Expert Systems with Applications"},{"issue":"2","key":"key2020120808591006200_ref023","doi-asserted-by":"crossref","first-page":"110","DOI":"10.1109\/TNSM.2009.090604","article-title":"Histogram-based traffic anomaly detection","volume":"6","year":"2009","journal-title":"IEEE Transactions on Network and Service Management"},{"issue":"5","key":"key2020120808591006200_ref024","doi-asserted-by":"crossref","first-page":"269","DOI":"10.1007\/s10207-011-0132-7","article-title":"SAS: semantics aware signature generation for polymorphic worm detection","volume":"10","year":"2011","journal-title":"International Journal of Information Security"},{"issue":"6","key":"key2020120808591006200_ref025","doi-asserted-by":"crossref","first-page":"60","DOI":"10.1109\/MCOM.2016.7497768","article-title":"Hive oversight for network intrusion early warning using DIAMoND: a bee-inspired method for fully distributed cyber defense","volume":"54","year":"2016","journal-title":"IEEE Communications Magazine"},{"issue":"99","key":"key2020120808591006200_ref026","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2016.2609907","article-title":"LARGen: automatic signature generation for Malwares using latent Dirichlet allocation","volume":"PP","year":"2016","journal-title":"IEEE Transactions on Dependable and Secure Computing"},{"issue":"1","key":"key2020120808591006200_ref027","doi-asserted-by":"crossref","first-page":"16","DOI":"10.1016\/j.jnca.2012.09.004","article-title":"Intrusion detection system: a comprehensive review","volume":"36","year":"2013","journal-title":"Journal of Network and Computer Applications"},{"issue":"5","key":"key2020120808591006200_ref028","doi-asserted-by":"crossref","first-page":"927","DOI":"10.1016\/j.patcog.2003.09.011","article-title":"A genetic clustering method for intrusion detection","volume":"37","year":"2004","journal-title":"Pattern Recognition"},{"issue":"1","key":"key2020120808591006200_ref029","doi-asserted-by":"crossref","first-page":"130","DOI":"10.1109\/TSMCC.2010.2050685","article-title":"An intrusion-detection model based on fuzzy class-association-rule mining using genetic network programming","volume":"41","year":"2011","journal-title":"IEEE Transactions on Systems, Man, and Cybernetics, Part C: Applications and Reviews"},{"issue":"4","key":"key2020120808591006200_ref030","doi-asserted-by":"crossref","first-page":"300","DOI":"10.1016\/j.inffus.2009.01.004","article-title":"Reducing false positives in anomaly detectors through fuzzy alert aggregation","volume":"10","year":"2009","journal-title":"Information Fusion"},{"key":"key2020120808591006200_ref031","first-page":"102","article-title":"Specification-based testing of intrusion detection engines using logical expression testing criteria","year":"2010"},{"issue":"4","key":"key2020120808591006200_ref032","doi-asserted-by":"crossref","first-page":"1483","DOI":"10.1016\/j.csda.2008.10.015","article-title":"Improving malware detection by applying multi-inducer ensemble","volume":"53","year":"2009","journal-title":"Computational Statistics & Data Analysis"},{"key":"key2020120808591006200_ref033","doi-asserted-by":"crossref","first-page":"50","DOI":"10.1016\/j.comcom.2013.11.001","article-title":"Adaptive non-critical alarm reduction using hash-based contextual signatures in intrusion detection","volume":"38","year":"2014","journal-title":"Computer Communications"},{"issue":"17","key":"key2020120808591006200_ref034","doi-asserted-by":"crossref","first-page":"3630","DOI":"10.1016\/j.comnet.2013.08.009","article-title":"Towards adaptive character frequency-based exclusive signature matching scheme and its applications in distributed intrusion detection","volume":"57","year":"2013","journal-title":"Computer Networks"},{"key":"key2020120808591006200_ref035","first-page":"286","article-title":"Anti-malware tools: intrusion detection systems","year":"2005"},{"issue":"7","key":"key2020120808591006200_ref036","doi-asserted-by":"crossref","first-page":"737","DOI":"10.1016\/j.cose.2010.05.002","article-title":"Network anomaly detection through nonlinear analysis","volume":"29","year":"2010","journal-title":"Computers & Security"},{"key":"key2020120808591006200_ref037","unstructured":"PandaLab (2015), \u201cPandaLab\u2019s annual report 2015\u201d, available at: www.pandasecurity.com\/mediacenter\/src\/uploads\/2014\/07\/Pandalabs-2015-anual-EN.pdf (accessed November 5, 2015)."},{"issue":"10","key":"key2020120808591006200_ref038","first-page":"1255","article-title":"A memory-based NFA regular expression match engine for signature-based intrusion detection","volume":"36","year":"2013","journal-title":"Computer Communications"},{"issue":"18","key":"key2020120808591006200_ref039","doi-asserted-by":"crossref","first-page":"2227","DOI":"10.1016\/j.comcom.2011.07.001","article-title":"Practical real-time intrusion detection using machine learning approaches","volume":"34","year":"2011","journal-title":"Computer Communications"},{"issue":"2","key":"key2020120808591006200_ref040","doi-asserted-by":"crossref","first-page":"302","DOI":"10.1109\/TSMCB.2005.843274","article-title":"Hierarchical Kohonenen net for anomaly detection in network security","volume":"35","year":"2005","journal-title":"IEEE Transactions on Systems, Man, and Cybernetics, Part B: Cybernetics"},{"key":"key2020120808591006200_ref041","doi-asserted-by":"crossref","first-page":"311","DOI":"10.1016\/j.eswa.2016.03.042","article-title":"An efficient proactive artificial immune system based anomaly detection and prevention system","volume":"60","year":"2016","journal-title":"Expert Systems with Applications"},{"key":"key2020120808591006200_ref042","doi-asserted-by":"crossref","first-page":"161","DOI":"10.1016\/j.neucom.2012.12.023","article-title":"Designing of on line intrusion detection system using rough set theory and Q-learning algorithm","volume":"111","year":"2013","journal-title":"Neurocomputing"},{"issue":"4","key":"key2020120808591006200_ref043","doi-asserted-by":"crossref","first-page":"494","DOI":"10.1109\/TSMCC.2010.2068544","article-title":"F-sign: automatic, function-based signature generation for malware","volume":"41","year":"2011","journal-title":"IEEE Transactions on Systems, Man, and Cybernetics Part C: Applications and Reviews"},{"key":"key2020120808591006200_ref044","first-page":"212","article-title":"Improved intrusion detection system using fuzzy logic for detecting anomaly and misuse type of attacks","year":"2009"},{"issue":"1","key":"key2020120808591006200_ref045","doi-asserted-by":"crossref","first-page":"129","DOI":"10.1016\/j.eswa.2011.06.013","article-title":"Decision tree based light weight intrusion detection using a wrapper approach","volume":"39","year":"2012","journal-title":"Expert Systems with Applications"},{"issue":"3","key":"key2020120808591006200_ref046","doi-asserted-by":"crossref","first-page":"225","DOI":"10.1109\/TEVC.2004.841683","article-title":"Training genetic programming on half a million patterns: an example from anomaly detection","volume":"9","year":"2005","journal-title":"IEEE Transactions on Evolutionary Computation"},{"key":"key2020120808591006200_ref047","doi-asserted-by":"crossref","first-page":"330","DOI":"10.1016\/j.eswa.2016.07.036","article-title":"OCPAD: one class Naive Bayes classifier for payload based anomaly detection","volume":"64","year":"2016","journal-title":"Expert Systems with Applications"},{"key":"key2020120808591006200_ref048","unstructured":"Symantec (2015), \u201cSymantec internet security threat report 2015\u201d, available at: www4.symantec.com\/mktginfo\/whitepaper\/ISTR\/21347932_GA-internet-security-threat-report-volume-20-2015-social_v2.pdf (accessed November 15, 2015)."},{"issue":"4","key":"key2020120808591006200_ref049","doi-asserted-by":"crossref","first-page":"565","DOI":"10.1109\/TC.2010.130","article-title":"Signature tree generation for polymorphic worms","volume":"60","year":"2011","journal-title":"IEEE Transactions on Computers"},{"issue":"2","key":"key2020120808591006200_ref050","doi-asserted-by":"crossref","first-page":"512","DOI":"10.1109\/TNET.2010.2070845","article-title":"Parametric methods for anomaly detection in aggregate traffic","volume":"19","year":"2011","journal-title":"IEEE\/ACM Transactions on Networking"},{"issue":"10","key":"key2020120808591006200_ref051","doi-asserted-by":"crossref","first-page":"1795","DOI":"10.1016\/j.cpc.2009.05.004","article-title":"A research using hybrid RBF\/Elman neural networks for intrusion detection system secure model","volume":"180","year":"2009","journal-title":"Computer Physics Communications"},{"issue":"1-3","key":"key2020120808591006200_ref052","first-page":"178","article-title":"Misuse-based intrusion detection using Bayesian networks","volume":"1","year":"2010","journal-title":"International Journal of Critical Computer-Based Systems"},{"key":"key2020120808591006200_ref053","first-page":"74","article-title":"Survey on malware detection methods","year":"2009"},{"issue":"1","key":"key2020120808591006200_ref054","doi-asserted-by":"crossref","first-page":"53","DOI":"10.1109\/TNET.2009.2020431","article-title":"Thwarting zero-day polymorphic worms with network-level length-based signature generation","volume":"18","year":"2010","journal-title":"IEEE\/ACM Transactions on Networking"},{"issue":"1","key":"key2020120808591006200_ref055","doi-asserted-by":"crossref","first-page":"54","DOI":"10.1109\/TNET.2008.923716","article-title":"A large-scale hidden semi-Markov model for anomaly detection on user browsing behaviors","volume":"17","year":"2009","journal-title":"IEEE\/ACM Transactions on Networking"},{"issue":"3","key":"key2020120808591006200_ref056","doi-asserted-by":"crossref","first-page":"859","DOI":"10.1016\/j.asoc.2009.10.003","article-title":"Sequential anomaly detection based on temporal-difference learning: principles, models and case studies","volume":"10","year":"2010","journal-title":"Applied Soft Computing"},{"key":"key2020120808591006200_ref057","first-page":"70","article-title":"HIDS-DT: an effective hybrid intrusion detection system based on decision tree","year":"2010"},{"issue":"5","key":"key2020120808591006200_ref058","doi-asserted-by":"crossref","first-page":"649","DOI":"10.1109\/TSMCC.2008.923876","article-title":"Random-forests-based network intrusion detection systems","volume":"38","year":"2008","journal-title":"IEEE Transactions on Systems, Man, and Cybernetics, Part C: Applications and Reviews"},{"issue":"3","key":"key2020120808591006200_ref059","doi-asserted-by":"crossref","first-page":"597","DOI":"10.1109\/TSMCB.2009.2033564","article-title":"Maintaining defender\u2019s reputation in anomaly detection against insider attacks","volume":"40","year":"2010","journal-title":"IEEE Transactions on Systems, Man, and Cybernetics, Part B: Cybernetics"},{"issue":"1","key":"key2020120808591006200_ref060","doi-asserted-by":"crossref","first-page":"124","DOI":"10.1016\/j.cose.2009.06.008","article-title":"A survey of coordinated attacks and collaborative intrusion detection","volume":"29","year":"2010","journal-title":"Computers & Security"},{"key":"key2020120808591006200_ref061","first-page":"410","article-title":"Medical technology in smart homes: exploring the user\u2019s perspective on privacy, intimacy and trust","year":"2011"}],"container-title":["Online Information Review"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.emerald.com\/insight\/content\/doi\/10.1108\/OIR-12-2015-0394\/full\/xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.emerald.com\/insight\/content\/doi\/10.1108\/OIR-12-2015-0394\/full\/html","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,7,24]],"date-time":"2025-07-24T22:44:24Z","timestamp":1753397064000},"score":1,"resource":{"primary":{"URL":"http:\/\/www.emerald.com\/oir\/article\/41\/2\/171-184\/315262"}},"subtitle":["A review of the literature"],"short-title":[],"issued":{"date-parts":[[2017,4,10]]},"references-count":61,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2017,4,10]]}},"alternative-id":["10.1108\/OIR-12-2015-0394"],"URL":"https:\/\/doi.org\/10.1108\/oir-12-2015-0394","relation":{},"ISSN":["1468-4527"],"issn-type":[{"value":"1468-4527","type":"print"}],"subject":[],"published":{"date-parts":[[2017,4,10]]}}}