Multi-Attribute Decision-Making for Intrusion Detection Systems: A Systematic Review

Abstract

Intrusion detection systems (IDSs) employ sophisticated security techniques to detect malicious activities on hosts and/or networks. IDSs have been utilized to ensure the security of computer and network systems. However, numerous evaluation and selection issues related to several cybersecurity aspects of IDSs were solved using a decision support approach. The approach most often utilized for decision support in this regard is multi-attribute decision-making (MADM). MADM can aid in selecting the most optimal solution from a huge pool of available alternatives when the appropriate evaluation attributes are provided. The openness of the MADM methods in solving numerous cybersecurity issues makes it largely efficient for IDS applications. We must first understand the available solutions and gaps in this area of research to provide an insightful analysis of the combination of MADM techniques with IDS and support researchers. Therefore, this study conducts a systematic review to organize the research landscape into a consistent taxonomy. A total of 28 articles were considered for this taxonomy and were classified into three main categories: data analysis and detection ([Formula: see text]), response selection ([Formula: see text]) and IDS evaluation ([Formula: see text]). Each category was thoroughly analyzed in terms of a variety of aspects, including the issues and challenges confronted, as well as the contributions of each study. Furthermore, the datasets, evaluation attributes, MADM methods, evaluation and validation and bibliography analysis used by the selected articles are discussed. In this study, we highlighted the existing perspective and opportunities for MADM in the IDS literature through a systematic review, providing researchers with a valuable reference.