A Systematic Review of Multi-Model Machine Learning Approaches for Network Anomaly Detection and Security

Abstract

The rapid expansion of interconnected digital infrastructures such as Cyber-Physical Systems (CPS), Supervisory Control and Data Acquisition (SCADA) networks, Internet of Things (IoT) environments, smart grids, cloud platforms, and smart cities has significantly increased exposure to cyber threats. Traditional anomaly detection and intrusion detection systems, largely based on signature matching and rule-based monitoring, struggle to detect sophisticated attacks such as zero-day intrusions, distributed denial-of-service (DDoS) campaigns, stealth anomalies, and adversarial manipulation. Consequently, researchers have adopted machine learning (ML) and deep learning (DL) techniques to enhance anomaly detection accuracy, robustness, and adaptability across diverse network environments. This systematic review examines recent multi-model approaches including supervised, unsupervised, ensemble, hybrid, and deep learning-based frameworks used for network anomaly detection and cyber security improvement. The review highlights widely used models such as Support Vector Machines, Random Forest, Gradient Boosting, Convolutional Neural Networks, Long Short-Term Memory networks, and Autoencoders, alongside emerging multi-model integrations such as GAN-based synthetic data generation, Transformer-based sequential modeling, Vision Transformers, and fusion pipelines combining Isolation Forest, GANs, and Transformers. Findings reveal that hybrid and multi-model architectures frequently outperform standalone methods, especially in domains such as CPS water distribution, DDoS detection, cloud anomaly classification, and IoT intrusion detection, with multiple studies reporting near-perfect performance under controlled datasets. However, major limitations remain, including dependence on benchmark datasets, lack of real-world industrial validation, limited explainability, computational complexity, dataset imbalance, and insufficient evaluation against encrypted and zero-day attacks. This review consolidates existing methodologies, compares strengths and weaknesses across domains, identifies critical research gaps, and provides future research directions focused on deployment-ready, scalable, explainable, privacy-aware, and edge-efficient anomaly detection frameworks for next-generation network security.