A Systematic Review of Intrusion Detection using Hidden Markov Models: Approaches, Applications, and Challenges

Nowadays, due to the increasing use of the Internet, security of computer systems and networks has become one of the main quality of service (QoS) criteria in ICT-based services. Apart from using traditional security solutions in software systems such as cryptography, firewalls and access control mechanisms, utilizing intrusion detection systems are also necessary. Intrusion detection is a process in which a set of methods are used to detect malicious activities against the victims. Many techniques for detecting potential intrusions in software systems have already been introduced. One of the most important techniques for intrusion detection based on machine learning is using Hidden Markov Models (HMM). Three main advantages of these techniques are high degree of precision, detecting unseen intrusion activities, and visual representation of intrusion models. Hence, in recent decades, many research communities have been working in HMM-based intrusion detection. Therefore, a large volume of research works has been published and hence, various research areas have emerged in this field. However, until now, there has been no systematic and up-to-date review of research works within the field. This paper aims to survey the research in this field and provide open problems and challenges based on the analysis of advantages, limitations, types of architectural models, and applications of current techniques.