Machine and Deep Learning for Intrusion Detection: A PRISMA-Guided Systematic Review of Recent Advances

The massive increase in the number and complexity of cyberattacks has surpassed the capabilities of traditional Intrusion Detection Systems (IDS), prompting a shift toward Machine Learning (ML) and Deep Learning (DL) solutions. This systematic literature review critically examines research published between 2020 and 2025 on ML- and DL-based IDSs, focusing on model architectures, benchmark datasets, evaluation metrics, and key performance results. By adapting a rigorous methodology based on PRISMA 2020, 41 high-quality studies were selected and analyzed. The findings reveal a strong preference for DL models, particularly Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM), Gated Recurrent Unit (GRU), Bidirectional Long Short-Term Memory (BiLSTM) and hybrid ensembles, which demonstrate higher detection rates and robustness compared to traditional deep learning methods. However, persistent challenges such as data imbalance, high false positive rates, adversarial vulnerabilities and real-time deployment constraints, continue to hinder widespread adoption.