# Applications of Machine Learning in Cyber Security: A Review
## 7 Open Questions  
From the aforementioned analysis, we concur that future work must focus on the improvement of input data for IDS approaches. Additionally, parameters such as explainability, bias, robustness, and efficiency must undertake a larger role in the furtherment of the field. Based on these observations, we identify several open questions:  
* RQ1: Which features used in ML/AI training can be considered sensitive data, and how can these be protected without losing utility?
* RQ2: Which datasets and ML approaches used for intrusion detection have been affected by unnecessary high dimensionality or multicollinearity?
* RQ3: What methods can be used to detect and mitigate bias in IDS models?
* RQ4: Which of the modern approaches for transparency and explainability are useful for cyber security-relevant datasets and IDS models, and how should they be adapted?
* RQ5: How can we protect ML models for IDS from adversarial attacks, including evasion and poisoning attacks?
* RQ6: What are the legal and accountability implications of ML/AL-based decisions in IDS?
* RQ7: Which modern approaches in incremental learning can be adapted to enable IDS models to learn continuously and adapt to evolving threats without introducing new ethical or security issues?
* RQ8: What optimizations can be suitably applied in IDS techniques to make them computationally efficient and propose acceptable trade-offs between accuracy and resource consumption?
* RQ9: What frameworks and certification processes can be developed to standardize ethical practices in ML/AI for IDS?  
Addressing these open questions requires multidisciplinary research and collaboration, combining expertise from ML, AI, cyber security, ethics, law, and user experience design. As a result, wider and complete teams will be necessary in the future to truly address the challenges posed and provide industry adoptable solutions with practical impact beyond academia. Potential pathways for advancing the field should consider developing and integrating new datasets, as well as providing viable approaches to combine existing datasets. Significant effort should be made to adopt ethical AI practices such as enriched white-box models with transparency and explainability tools. Finally, research should focus on establishing a common understanding of features that provide a realistic representation of the question being investigated, e.g., network traffic. This should consider both the availability of features, the format and representation, the mathematical underpinning, as well as the categorization/classification of attacks, thus addressing the identified limitations in current approaches.  
Conceptualization, IJ.V.; methodology, IJ.V.; validation, A.L.M.; investigation, I.J.V. and A.L.M.; resources, IJ.V. and A.L.M.; writing--original draft preparation, J.J.V.; writing--review and editing, A.L.M.; visualization, IJ.V.; project administration, A.L.M.; funding acquisition, IJ.V. and A.L.M. All authors have read and agreed to the published version of the manuscript.  
**Funding:** This work was partly funded through the UK Transformative Technologies competition supported by UKRI, specifically Innovate UK (app. no: 10074348).  
**Institutional Review Board Statement:** Not applicable.  
**Informed Consent Statement:** Not applicable.  
**Data Availability Statement:** All datasets are generally publicly available and widely used in the domain. No new data were created.  
**Conflicts of Interest:** The funders had no role in the design of the study; in the collection, analyses, or interpretation of data; in the writing of the manuscript; or in the decision to publish the results. [PERSON] has declared conflicts of interest in her role as a Lecturer at the University of Glasgow and has the approval to conduct research related to this paper without acknowledging the University. Netrity Ltd. is a commercial entity in which both authors have commercial interests.