Reviews in Online Data Stream and Active Learning for Cyber Intrusion Detection - A Systematic Literature Review

Intrusion Detection Systems (IDS) monitor com-puter networks for attack. Network data streams are potentially infinite and require real-time processing in order to provide timely detection of changing attacks. To address the nature of the network data stream it is important to consider the use of online data stream learning methods for IDS. Online data stream learning is an extension of Machine Learning (ML) where special consideration is given to finding anomalies in the data stream via supervised and unsupervised methods, adapting to concept drift, processing real-time events, and management of labelling cost by using Active Learning (AL). This paper asks the question of which online data stream and AL methods for IDS have been recently reviewed? A Systematic Literature Review (SLR) was performed and found that there is currently no reviews available that focus primarily on IDS data stream learning. Reviews were organised into categories and key considerations presented.