Toward Adaptive Intelligent Intrusion Detection: A Review of Zero-day Attack Detection Methods and Future Cyber Defence Directions

This study presents a comprehensive synthesis of artificial intelligence driven approaches for zero-day attack detection, addressing the growing limitations of traditional signature-based intrusion detection systems in dynamic and evolving cyber environments. The review examines major detection paradigms, dataset utilization patterns, and performance trends across widely adopted cybersecurity benchmarks such as NSL-KDD, UNSW-NB15, CICIDS2017, BoT-IoT, and ToN-IoT. The analysis reveals a clear progression from classical machine learning techniques, which rely heavily on handcrafted features, to more advanced deep learning and hybrid frameworks that leverage automated feature representation and behavioural modelling. These modern approaches have significantly improved detection capability, particularly in identifying complex and previously unseen attack patterns. However, despite these advancements, several critical challenges remain. These include limited dataset realism, weak cross-domain generalization, high computational overhead, vulnerability to adversarial manipulation, and lack of model interpretability, all of which constrain real-world deployment. In response to these limitations, this study proposes a unified adaptive hybrid detection framework that integrates anomaly-based monitoring, supervised classification, deception-driven intelligence, and predictive threat forecasting within a single architecture. Furthermore, the paper outlines key future research directions aimed at enhancing dataset diversity, improving model robustness, and advancing explainable artificial intelligence techniques. These contributions provide a strategic foundation for developing scalable, interpretable, and resilient intrusion detection systems capable of operating effectively in modern heterogeneous cybersecurity environments.