Cyberspace has become an indispensable factor for all areas of the modern world. The world is becoming more and more dependent on the internet for everyday living. The increasing dependency on the internet has also widened the risks of malicious threats. On account of growing cybersecurity risks, cybersecurity has become the most pivotal element in the cyber world to battle against all cyber threats, attacks, and frauds. The expanding cyberspace is highly exposed to the intensifying possibility of being attacked by interminable cyber threats. The objective of this survey is to bestow a brief review of different machine learning (ML) techniques to get to the bottom of all the developments made in detection methods for potential cybersecurity risks. These cybersecurity risk detection methods mainly comprise of fraud detection, intrusion detection, spam detection, and malware detection. In this review paper, we build upon the existing literature of applications of ML models in cybersecurity and provide a comprehensive review of ML techniques in cybersecurity. To the best of our knowledge, we have made the first attempt to give a comparison of the time complexity of commonly used ML models in cybersecurity. We have comprehensively compared each classifier’s performance based on frequently used datasets and sub-domains of cyber threats. This work also provides a brief introduction of machine learning models besides commonly used security datasets. Despite having all the primary precedence, cybersecurity has its constraints compromises, and challenges. This work also expounds on the enormous current challenges and limitations faced during the application of machine learning techniques in cybersecurity.
Researchers are investigating machine learning techniques to detect different cybercrimes in cybersecurity. We have provided a detailed discussion of various cyber threats in Section 2. Furthermore, we have briefly presented an overview of frequently used security datasets in Section 2. This section provides a comprehensive survey of each ML model applied to deal with different cyber threats. Subsequent lines will explain the description of each column in Table 1, Table 2, Table 3, Table 4, Table 5 and Table 6. The ML technique columns describe the considered machine learning model. We have considered six ML models for this study: random forest, support vector machine, naïve Bayes, decision tree, artificial neural network, and deep belief network.
Table 1. Evaluation of SVM in Cybersecurity.
Table 2. Evaluation of Decision Tree in Cybersecurity.
Table 3. Evaluation of DBN in Cybersecurity.
Table 4. Evaluation of ANN in Cybersecurity.
Table 5. Evaluation of Random Forest in Cybersecurity.
Table 6. Evaluation of Naïve Bayes in Cybersecurity.
We focus on three critical cyber threats, namely intrusion detection, spam detection and malware detection. The domain columns state the significant cybersecurity threats considered for this review. The reference number and year columns depict the citation number of each article and published year, respectively. The values of approach or sub-domain columns are different for each cyber threat. IDS domain has three values that are anomaly-based, signature/misuse-based and hybrid-based. Malware has three further sub-classifications that are static, dynamic and hybrid. In the case of spam, sub-domains correspond to the medium in which the authors tried to identify the spam such as image, video, email, SMS and tweets. A description of each sub-domain/approach has been provided in Section 2. Finally, the result attribute presents the evaluation of each classifier applied in a particular sub-domain of cyber threat on a specific dataset and provided in the cited paper mentioned in the reference column.
The principle superiority of support vector machine (SVM) is that it produces the most successful results for cybersecurity tasks. SVM distributes each data class on both sides of the hyperplane. SVM separates the classes based on the notation to the margin. Support vector points are those points that lie on the border of the hyperplane. The major drawback of the support vector machine is that it consumes an immense amount of space and time. SVM requires data trained on different time intervals to produce better results for a dynamic dataset .
SVM showed an accuracy of 99.30% with KDD Cup 99 dataset for IDS . 96.92% is the best reported accuracy for malware detection using Enron dataset  and 96.90% with Spambase to classify spam emails . The best reported recall for SVM to detect intrusion is 82% , malware is 100% , and spam is 98.60% . SVM has obtained best precision while detecting the intrusion is 74% , malware is 96.16% , and spam is 98.60% . A detailed performance comparison of SVM to various cyber threats on the frequently used dataset is presented in Table 1.
Decision tree (DT) belongs to the category of supervised machine learning. DT consists of a path and two nodes: root/intermediate and leaf. Root or intermediate node presents an attribute that followed a path that corresponds to the possible value of an attribute. Leaf node represents the final decision/classification class. A decision tree is used to find the best immediate node by following the if-then rule . Further, 99.96% is the reported accuracy of DT while detecting the anomaly-based IDS with KDD dataset . With standard SMOTE dataset, DT shows an outstanding accuracy of 96.62% for malware detection . With the Enron dataset, DT correctly classified ham emails with an accuracy of 96% . The best reported recall for DT to detect intrusion is 98.10% , malware is 96.70% , and spam is 96.60% . DT has obtained best precision while detecting the intrusion is 99.70% , malware is 99.40% , and spam is 98% . A detailed performance comparison of decision tree to various cyber threats on the frequently used dataset is presented in Table 2.
A deep belief network (DBN) consists of various middle layers of restricted Boltzmann machine (RBM) organized greedily. Every layer communicates with the layers behind it and the layers ahead of it. There is no lateral communication between the nodes within a layer. Every layer serves as both an input layer and an output layer, except the first and the last layers. The last layer functions as a classifier. The primary purpose of a deep belief network is image clustering and image recognition. It deals with motion capture data. Deep belief network has shown the accuracy of 97.50% for IDS , 91.40% for malware detection  and 97.43% for spam detection  with KDD, KDD CUP99, and Spambase datasets, respectively. The best reported recall for DBN to detect intrusion is 99.70% , malware is 98.80% , and spam is 98.02% . DBN obtained the best precision while detecting the intrusion is 99.20% , malware is 95.77% , and spam is 98.39% . A detailed performance comparison of DBN to various cyber threats on the frequently used dataset is presented in Table 3.
An artificial neural network (ANN) classier consists of hidden neuron input and output layers and performs in two stages. The first stage is called feedforward. In this stage, each hidden layer receives some input nodes and based on the input layer and activation function, the error is calculated. In the second stage, namely feedback stage, the error is sent back to the input layer and process is continued in iterations until the correct result is gained . The artificial neural network showed an accuracy of 97.53% for IDS , 92.19% for malware detection , and 92.41% for spam detection with NSL-KDD, VX Heavens, and Spambase datasets, respectively. The best reported recall for ANN to detect an intrusion is 98.94% , and spam is 94% . ANN has obtained best precision while detecting the intrusion is 97.89% , malware is 88.89% , and spam is 95% . A detailed performance comparison of ANN to various cyber threats on the frequently used dataset is presented in Table 7.
Random forest (RF) follows through the task by combing different predictions generated by joining different decision trees. RF raised a hypothesis to obtain a result . RF falls under the category of ensemble learning. RF also termed as random decision forest. RF is considered as an improved version of CART that is a sub-type of a decision tree.
RF has shown an accuracy of 99.95% with IDS , 95.60% with malware detection  and 99.54% for spam detection  with KDD, VirusShare, and Spambase datasets, respectively. The best reported recall for RF to detect intrusion is 99.95% , malware is 97.30% , and spam is 97.20% . RF obtained the best precision while detecting the intrusion is 99.80% , malware is 98.58% , and spam is 98.60% . A detailed performance comparison of RF to various cyber threats on the frequently used dataset is presented in Table 5.
The major limitation for Naïve Bayes (NB) classifier is that it assumes that every attribute is independent, and none of the attributes has a relationship with each other. This state of independence is technically impossible in cyberspace. Hidden NB is an advanced form of Naïve Bayes, and it gives 99.6% accuracy . Naïve Bayes showed an accuracy of 99.90% with DARPA dataset for IDS . 99.50% is the best reported accuracy for malware detection using NSL-KDD dataset . With Spambase dataset, Naïve Bayes showed considerable accuracy of 96.46 % to classify spam or ham email . The best reported recall for NB to detect intrusion is 100% , malware is 95.90% , and spam is 98.46% . NB obtained the best precision while detecting the intrusion is 99.04% , malware is 97.50% , and spam is 99.66% . A detailed performance comparison of NB to various cyber threats on the frequently used dataset is presented in Table 6.