## 3 Recent Literature Analysis
### Cyber Security
#### 3.1.3 Machine Learning for Intrusion Detection  
Machine learning and its subsets were often applied within the scope of recent novel cyber security research to address research challenges associated with Intrusion Detection. Intrusion detection research within the context of cyber-physical systems has also been a focus of the recent literature, highlighting how system connectedness with cellular technologies, such as 5G, potentially exacerbates cyber security threats and underscores the need to defend this terrain [26]. The authors focus on detections of Distributed Denial-of-Service (DDoS) attacks in particular, utilizing a deep convolutional neural network and current network data to enable accurate and timely attack identification [26]. Another study investigated DDoS detection using Recurrent Neural Networks (RNNs), which yielded accuracies to different attack scenarios at above 99% [27]. Whilst focused on the DDoS research area, there may be potential to cross-apply these methods to other attack categories, such as phishing.  
Machine learning was also identified at the leading edge of intrusion detection research for cyber security. Deep belief network (DBN) models were tested within healthcare CPS environments in order to identify potential attacks towards the system [19]. [PERSON] et al. developed a novel multi-stage optimized machine learning framework in order to address complexity challenges within existing research whilst retaining intrusion detection accuracy [28]. This work highlights opportunities that could improve the optimization of intrusion detection machine learning applications, with future work in this space having the ability to focus on the investigation of models that can handle nonlinear and high-dimensional datasets, in addition to those that contain a combination of supervised and unsupervised machine learning techniques [28].  
Challenges to existing machine learning applications for intrusion detection are discussed in the work of [PERSON] and [PERSON], where they explore solutions for rebalancing and resampling machine learning datasets to recognize cyber-attack events better [29]. This research highlights the potential bias that machine learning datasets can introduce into accurate intrusion detection applications, as well as the processing and cost compromises associated with resampling and rebalancing this data. In another study, this problem set was addressed through the lens of energy theft as a cyber-attack in smart meter infrastructure [30]. The use of ensemble machine learning models was suggested to reduce variance and bias by leveraging meta-algorithms, with the best performing utilizing bootstrap aggregation methods being used to improve accuracy and bias-variance trade-offs [30].  
From the perspective of identified attacker techniques, malware detection was also highlighted within the recent novel literature as a field of note. In this case, deep learning was identified as a potential model of use, offering additional fidelity compared to existing traditional static and dynamic analysis methods for malware identification [31]. Whilst this study focuses on the oil supply chain case study in particular, its findings have the potential to influence a wide variety of industrial applications.  
The level of trust in machine learning algorithms was also discussed in the most recent novel literature. [PERSON] et al. [32] discussed in their research the need for 'Explainable AI' models that are readable by experts so that data evidence can be cognitively understood and therefore trusted. Such models have the potential to assist experts in identifying influence factors within machine learning models and thus enhance trust in the decisions made [32]. The identified limitations of this work include the overfitting of algorithms due to noise capture in datasets, especially when training data differs substantially from test data, and the prediction performance impact associated with the number of levels in decision trees [32].