Artificial Intelligence for Real-Time Cyber Threat Classification and Emerging Threat Detection: A Structured Review of Methods, Datasets, Challenges, and Research Directions

The rapid adoption of cloud computing, the Internet of Things (IoT), fifth-generation (5G) communication, and edge computing has significantly expanded the cyber-attack surface, enabling threats that are larger in scale, faster, and more complex. Traditional detection techniques—relying on signatures, rules, and statistical analysis—remain effective for known attacks but are limited in detecting zero-day exploits, polymorphic malware, and advanced persistent threats. Consequently, artificial intelligence (AI) has been increasingly adopted for adaptive and real-time cyber threat analysis. This review evaluates the evolution of AI-driven methodologies for real-time cyber threat classification and emerging threat detection, drawing from over fifty peer-reviewed studies identified through a structured search of leading scholarly databases. Rather than treating studies in isolation, the literature is synthesized based on detection objectives, computational techniques, datasets, evaluation metrics, deployment environments, and acknowledged limitations. The review juxtaposes conventional detection methods with machine learning, deep learning, explainable AI (XAI), reinforcement learning, federated learning, graph neural networks (GNNs), large language models (LLMs), and generative AI. It emphasizes frequently utilized cybersecurity datasets and evaluation practices, as well as ongoing challenges related to class imbalance, adversarial manipulation, computational overhead, model interpretability, privacy concerns, and inadequate validation in real-world scenarios. The reviewed literature indicates that AI-based methodologies often demonstrate superior detection capabilities for intricate and previously unseen attack patterns compared to traditional methods; however, direct performance comparisons are complicated due to discrepancies in datasets, experimental designs, and evaluation protocols. Moreover, a limited number of proposed models have been evaluated under authentic operational circumstances. In light of these observations, the review identifies significant research gaps and outlines prospective paths for developing explainable, privacy-conscious, computationally efficient, and readily deployable AI-enabled cyber-defence systems.

The review follows a structured approach to synthesize the literature on AI for real-time cyber threat classification and emerging threat detection. A systematic search of leading scholarly databases was conducted, yielding over fifty peer-reviewed studies. The inclusion criteria focused on studies that proposed, evaluated, or reviewed AI-based methods for real-time threat detection, classification, or emerging threat identification. The selected studies were analyzed and categorized along several dimensions: detection objectives (e.g., binary classification, multi-class classification, anomaly detection), computational techniques (e.g., machine learning, deep learning, XAI, reinforcement learning, federated learning, GNNs, LLMs, generative AI), datasets used, evaluation metrics (e.g., accuracy, precision, recall, $F_1$-score, false positive rate), deployment environments (e.g., cloud, edge, IoT), and acknowledged limitations. This structured synthesis allows for a comparative analysis of the strengths and weaknesses of different approaches and highlights gaps in the current research. The review also examines the datasets commonly employed in the field, noting their characteristics and limitations, and discusses evaluation practices, including the challenges of comparing results across studies due to varying experimental setups. The methodology emphasizes a critical assessment of the state of the art, aiming to provide a comprehensive overview that informs future research directions.