Anomaly Detection Model in Network Security Situational Awareness Based on Machine Learning: Limitation, Techniques, and Future Trends

This study focuses on the anomaly detection problem in Network Security Situational Awareness (NSSA). We systematically review traditional approaches and recent advancements based on Machine Learning (ML) and Deep Learning (DL), and assess the application status of various anomaly detection models within the context of NSSA. Building upon this comprehensive review, we identify and analyze the primary challenges currently faced by the field, including the technical complexity of multimodal ML data fusion, insufficient real-time adaptive detection capabilities, limited model interpretability, and bottlenecks in privacy protection and security collaboration. To address these issues, we propose an integrated conceptual model, AFEMAD, which incorporates multimodal ML data fusion, online adaptive detection, enhanced interpretability, Federated Learning (FL), and collaborative privacy-preserving mechanisms, thereby providing an innovative technical framework for anomaly detection in NSSA. Finally, this study deepens the understanding of the anomaly detection problem in NSSA and provides both theoretical and practical guidance for the development of efficient and scalable anomaly detection systems.