Abstract:As the number of Internet-connected systems rises, cyber analysts find it increasingly difficult to effectively monitor the produced volume of data, its velocity and diversity. Signature-based cybersecurity strategies are unlikely to achieve the required performance for detecting new attack vectors. Moreover, technological advances enable attackers to develop sophisticated attack strategies that can avoid detection by current security systems. As the cyber-threat landscape worsens, we need advanced tools and technologies to detect, investigate, and make quick decisions regarding emerging attacks and threats. Applications of artificial intelligence (AI) have the potential to analyze and automatically classify vast amounts of Internet traffic. AI-based solutions that automate the detection of attacks and tackle complex cybersecurity problems are gaining increasing attention. This paper comprehensively presents the promising applications of deep learning, a subfield of AI based on multiple layers of artificial neural networks, in a wide variety of security tasks. Before critically and comparatively surveying state-of-the-art solutions from the literature, we discuss the key characteristics of representative deep learning architectures employed in cybersecurity applications, we introduce the emerging trends in deep learning, and we provide an overview of necessary resources like a generic framework and suitable datasets. We identify the limitations of the reviewed works, and we bring forth a vision of the current challenges of the area, providing valuable insights and good practices for researchers and developers working on related problems. Finally, we uncover current pain points and outline directions for future research to address them.

Learning Representations for Log Data in Cybersecurity

End-To-End Anomaly Detection for Identifying Malicious Cyber Behavior through NLP-Based Log Embeddings

Anomaly Detection in Cyber Security with Graph-Based LSTM in Log Analysis

An ensemble-based framework for user behaviour anomaly detection and classification for cybersecurity

A Survey on Representation Learning Efforts in Cybersecurity Domain

A Federated Learning Approach for Multi-stage Threat Analysis in Advanced Persistent Threat Campaigns

Towards Characterizing Cyber Networks with Large Language Models

Lateral Movement Detection via Time-aware Subgraph Classification on Authentication Logs

Machine Learning for APT Detection

Log2vec: A Heterogeneous Graph Embedding Based Approach for Detecting Cyber Threats within Enterprise

Cyberattack detection model using deep learning in a network log system with data visualization

A Causal Graph-Based Approach for APT Predictive Analytics

Learning Explainable Representations of Malware Behavior

Log Analysis For Network Attack Detection Using Deep Learning Models

Application of Representation Learning-Based Chronological Modeling for Network Intrusion Detection

AISLE: Self-supervised Representation Learning for the Investigation of Advanced Persistent Threat

A Novel Network Forensic Framework for Advanced Persistent Threat Attack Attribution Through Deep Learning

Hack Me If You Can: Aggregating AutoEncoders for Countering Persistent Access Threats Within Highly Imbalanced Data

A survey on deep learning for cybersecurity: Progress, challenges, and opportunities

Recurrent Neural Network Language Models for Open Vocabulary Event-Level Cyber Anomaly Detection