Zero-day attacks: review of the methods used based on intrusion detection and prevention systems

Zero-day attacks pose a paramount challenge to contemporary cybersecurity experts. These exploits capitalize on undisclosed security vulnerabilities within software or operating systems. The absence of standardized and effective defenses against zero-day attacks is conspicuous; even when vulnerabilities remain undisclosed, afflicted software cannot be patched, and antivirus products cannot detect the attack through signature-based analysis [1]. However, to confront this predicament, Machine Learning (ML)-based techniques for detecting zero-day attacks have emerged. ML, a subset of Artificial Intelligence, empowers computer systems to learn and enhance performance through experiential learning, obviating the need for explicit programming for designated tasks. Within the context of zero-day attack detection, ML is harnessed to analyze copious volumes of data, identifying patterns indicative of potential attacks. Such patterns encompass irregularities in network traffic, anomalous user behavior, or suspicious software activities. Upon flagging a suspicious pattern, the system can enact countermeasures to mitigate the attack, including network traffic blocks or deactivation of compromised software. This work delves into the mechanics of zero-day attacks and elucidates the detection methodologies employed within the domain of ML.