Short description and motivation
AI and machine-learning techniques are increasingly used to detect cyber attacks, but high detection accuracy on benchmark datasets does not necessarily translate into robust detection when attack behaviour or the operating environment changes. This thesis will investigate the robustness and generalisation of AI-based intrusion detection using publicly available and/or experimentally generated cybersecurity data. The focus is on understanding when and why AI-based detection methods succeed or fail, rather than simply developing another classifier.
Main objective
The main objective is to design and experimentally evaluate AI-based methods for cyber attack detection, with particular emphasis on robustness and generalisation to previously unseen or modified attack scenarios.
Tasks to be followed for completion
- Review literature on AI-based intrusion detection, robustness and generalisation.
- Define a suitable use case, threat model, attack scenarios and evaluation methodology.
- Prepare datasets/experimental environments and implement selected AI-based detection methods.
- Conduct controlled experiments, including evaluation against previously unseen or modified attacks.
- Analyse and critically discuss detection performance, robustness, limitations and implications.
Suggested references
- He, K., Kim, D. D., & Asghar, M. R. (2023). Adversarial Machine Learning for Network Intrusion Detection Systems: A Comprehensive Survey. IEEE Communications Surveys & Tutorials.
- Hossain, M. A., & Islam, S. (2023). Ensuring network security with a robust intrusion detection system using ensemble-based machine learning.
- Alalisalem, D., Almohsen, A., & Aljughaiman, A. (2026). Cross-Dataset Generalization in Intrusion Detection Systems Using Transfer Learning. IEEE Access.
- Nourildean, S. W., Mefteh, W., & Frihida, A. M. (2025). Scalable and generalizable AI-based intrusion detection in AIoT: a review and lightweight ensemble solution. International Journal of Data Science and Analytics.