An Overview of Machine Learning Algorithms for Intrusion Detection in Networked Systems

Abstract

With the rapid evolution of digital communication and widespread connectivity, networked systems have become a prime target for cyber-attacks. Traditional Intrusion Detection Systems (IDS), which rely on predefined rules or signature patterns, struggle to detect novel and sophisticated threats, making them inadequate in modern network environments. To address these limitations, Machine Learning (ML) has emerged as a promising approach to enhance IDS capabilities by enabling systems to learn from historical data and detect abnormal behaviors effectively.This survey provides a comprehensive overview of various machine learning algorithms applied to intrusion detection in networked systems. It explores both supervised and unsupervised learning techniques, highlighting their strengths, weaknesses, and applicability in real-time security scenarios. Popular ML models such as Support Vector Machines (SVM), Decision Trees (DT), Random Forests (RF), k-Nearest Neighbors (KNN), Naive Bayes (NB), and clustering methods are examined in terms of accuracy, efficiency, and adaptability.The paper also discusses key performance metrics used for evaluating ML-based IDS, including accuracy, precision, recall, F1-score, and false positive rate. By reviewing recent advancements and comparative studies, the survey identifies current challenges in the field such as imbalanced datasets, high false alarm rates, and the need for real-time intrusion detection. Finally, it outlines future research directions, including the integration of explainable AI, edge-based detection systems, and adversarial robustness, to build more secure and intelligent IDS for evolving network environments.