Artificial Intelligence for Intrusion Detection and Prevention: A Systematic Review of Methods, Challenges, and Future Directions

This systematic review synthesizes AI-based techniques for detecting and preventing cyberattacks published between 2019 and 2025. Following PRISMA 2020, we searched IEEE Xplore, Scopus, and the ACM Digital Library (550 records) and included 74 studies after independent dual screening; study quality was appraised with a modified JBI checklist, the risk of bias of the review was assessed with ROBIS, and the review was not registered. We include a higher-level taxonomy of present methods divided into seven categories: (1) traditional machine learning algorithms; (2) deep learning models; (3) hybrid intelligence frameworks; (4) blockchain-based systems; (5) reinforcement learning approaches; (6) ensemble learning methods; and (7) explainable AI (XAI) techniques. Reported accuracies are high in all seven categories (category medians between 95.3% and 99.9%), but individual results range from 58.17% to 100% and were obtained with different datasets, data splits, and evaluation protocols, so they do not support a ranking of the categories. Latency and resource consumption are rarely reported and, when reported, were measured under non-comparable conditions. Automated prevention actions (blocking, rate limiting, or network reconfiguration) are evaluated far less often than detection, although false positives are more costly when they trigger blocking. Targeted machine learning methods report strong performance in phishing detection (96.83–98.3% accuracy in the tabulated studies). This study also identifies several major areas needing improvement, including a predominant reliance on legacy benchmark datasets (NSL-KDD, KDD99, UNSW-NB15), which were used by 25 of the 48 studies with identifiable datasets (52.1%) and a limited capability to interpret “black box” AI models. Accordingly, we suggest that future research use more realistic test environments and recent datasets, develop lightweight and adaptive AI models, and adopt a standardized minimum reporting protocol (accuracy, precision, recall, F1-score, false positive rate, latency, resource usage, and statistical validation), for which we provide a concrete proposal and a list of recent datasets. The intention of this study is to assist cybersecurity practitioners in identifying and implementing effective AI-based security solutions in relation to present-day threats.