Over the past decade, the rapid digital transformation of infrastructures to digital forms, such as cloud computing, Internet of Things (IoT), and large-scale interconnected network systems, has made the threat of cybercrime much more pronounced. Of those, Zero-Day attacks are regarded as the most serious since they are previously unseen and so the traditional signature-based intrusion detection systems are useless. This paper presents an in-depth overview of machine learning (ML) and deep learning (DL) methods of detecting Zero-Day attacks. The methodology is based on reviewing, analyzing, and synthesizing recent literature, which is applied to ML, DL, and hybrid methods, threat intelligence integration, and real-time intrusion detection systems. The findings suggest that both ML and DL methods have high detection accuracy but have a number of weaknesses including high computational complexity, data imbalance, scarce availability of labeled data, and susceptibility to adversarial attacks. Moreover, this review shows some of the main gaps in research, especially in coping with the unknown attack patterns, the development of lightweight and real-time detection models, and the enhancement of the generalization abilities. Finally, the research paper shows that it is crucial to establish adaptive, scalable, and hybrid intelligent systems to improve the detection of Zero-Day attacks. To enhance actual cybersecurity applications in the future, future studies should focus on efficient learning mechanisms, strong adversarial defenses, and data-efficient models.
Maha Khalil Ibrahim (Thu,) studied this question.