Operational architectures for hybrid ai-based network intrusion detection: a critical review and multi-axial taxonomy

Haddad, Alaa and Wajs, Sarvesh August and Habaebi, Mohamed Hadi and Al-Hussaini, Mohammed Abdulla Salim (2026) Operational architectures for hybrid ai-based network intrusion detection: a critical review and multi-axial taxonomy. Computers, 15 (10). pp. 1-37. E-ISSN 2073-431X

PDF - Published Version Restricted to Repository staff only Download (5MB) | Request a copy

Abstract

Artificial intelligence is widely used in network intrusion detection, but evidence regarding operational architecture remains fragmented across model families, fusion patterns, deployment environments, and evaluation practices. We conducted a PRISMA 2020-compliant systematic review of secondary AI-NIDS reviews published from 1 January 2020 to 22 September 2026. OpenAlex and arXiv were searched on 22 September 2026; deterministic DOI/title deduplication and prespecified text rules preceded title/abstract screening, and a single reviewer assessed the retrieved full texts. Review-level limitations were appraised across eligibility, search reproducibility, selection/data collection, evidence traceability, and synthesis appropriateness; no aggregate quality score or statistical pooling was used. Of 8519 identified records, 1091 duplicates and 2256 automatically ineligible records were removed, 5172 records were screened, 101 reports were sought, 25 full texts were assessed, and 22 reviews were included. The synthesis supports a five-axis taxonomy spanning observation, AI intelligence, fusion, deployment, and trust/operations, but also shows weak search reproducibility in 12 of 22 included reviews and absent selection transparency in 15 of 22. The findings provide a bounded architectural framework rather than a universal performance ranking. Limitations include open-index coverage, 76 unretrieved reports, single-reviewer assessment, and the use of primary studies only as separate illustrative validation sources. The review was not prospectively registered; a revision-stage protocol was frozen before the new search, and its amendment is reported. A worked five-axis example, a decision-level contrast between sequential and hierarchical integration, appraisal-weighted confidence statements, and proposed evaluation criteria for each open challenge make the framework directly usable for design and assessment

Item Type:	Article (Journal)
Uncontrolled Keywords:	hybrid intrusion detection, network intrusion detection, AI architecture, deployment evaluation, evidence synthesis, explainable AI, federated learning, reinforcement learning
Subjects:	T Technology > TK Electrical engineering. Electronics Nuclear engineering > TK7800 Electronics. Computer engineering. Computer hardware. Photoelectronic devices > TK7885 Computer engineering
Kulliyyahs/Centres/Divisions/Institutes (Can select more than one option. Press CONTROL button):	Kulliyyah of Engineering > Department of Electrical and Computer Engineering
Depositing User:	Dr. Mohamed Hadi Habaebi
Date Deposited:	22 Oct 2026 15:56
Last Update:	22 Oct 2026 16:22
Queue Number:	2026-10-Q5789
URI:	http://irep.iium.edu.my/id/eprint/132193
Indexed In:	Google Scholar

Actions (login required)

View Item