Systematic Review Evaluates Machine Learning Defenses Against Campus Network Cyberattacks

A comprehensive systematic review examining cybersecurity across higher education institutions reveals that machine learning architectures provide adaptive capabilities for detecting and mitigating distributed denial of service and address resolution protocol spoofing attacks on modern campus networks. The investigation, conducted using the Preferred Reporting Items for Systematic Reviews and Meta-Analyses guidelines, analyzed 110 peer-reviewed investigations published between 2020 and 2025 to determine how artificial intelligence counters high-volume flooding and link-layer deception. Modern university network infrastructures support extensive academic, administrative, and research activities across complex, high-traffic environments characterized by dynamic device turnover, diverse user populations, and extensive device mobility. Traditional security mechanisms, such as static rule-based firewalls and signature-dependent intrusion detection platforms, demonstrate severe operational constraints because their inflexible policies fail to adapt to the highly variable traffic profiles found in academic settings. By evaluating the trajectory of computational security models across recent scholarly literature, the review establishes that algorithmic classification and anomaly detection paradigms significantly outperform static defenses by continuously analyzing flow patterns and identifying subtle deviations within live network environments.

The methodological framework for the systematic review involved an exhaustive search across primary scientific databases, including Springer, IEEE, Elsevier, ScienceDirect, ResearchGate, Google Scholar, and arXiv. The search strategy combined Boolean operators with context-specific terminology spanning machine learning, deep learning, network security, intrusion detection, software-defined networks, the Internet of Things, and wireless body area networks. The literature identification phase initially retrieved 206 candidate publications, from which the authors removed 58 duplicate records. Subsequent multi-stage screening excluded 11 records due to an absence of explicit machine learning focus, 10 records because they lacked empirical or experimental validation, and 17 publications that fell outside the scope of campus, Internet of Things, software-defined, or wireless body area network environments. Two independent reviewers conducted the screening of titles, abstracts, and full texts, achieving high inter-reviewer reliability with a Cohen’s kappa coefficient of 0.88, while discrepancies were systematically resolved through structured consensus with a third reviewer. The final corpus comprised 110 methodologically sound investigations, exhibiting a steady upward publication distribution of 14 studies in 2020, 10 in 2021, 19 in 2022, 16 in 2023, 23 in 2024, and 28 in 2025.

The review identifies distributed denial of service intrusions and address resolution protocol spoofing as two distinct, pervasive threats that undermine the operational integrity, availability, and confidentiality of university networks. Distributed denial of service attacks target network and transport layers, utilizing networks of compromised machines to flood targeted infrastructure with massive volumes of illegitimate requests, thereby degrading or completely denying connectivity for legitimate university users. These attacks present as pronounced, high-volume flow deviations requiring the extraction of network-layer metrics such as packet transmission rates, flow durations, overall byte counts, entropy calculations, and connection frequency. In contrast, address resolution protocol spoofing operates exclusively at the data link layer, exploiting the inherent lack of authentication in protocol operations by injecting falsified messages that manipulate binding caches between internet protocol and media access control addresses. Because address resolution protocol spoofing generates low-volume poisoning sequences without macroscopic flow spikes, the malicious activity subtly masquerades as benign local traffic, creating stealthy pathways for man-in-the-middle interceptions, unauthorized credential theft, and persistent denial-of-service conditions across local segments.

Supervised machine learning algorithms have emerged as dominant tools for classifying network traffic flows by utilizing structured datasets labeled with benign and malicious instances. Research literature demonstrates that decision trees, support vector machines, and random forest classifiers consistently achieve high detection accuracy, robust precision, high recall, and strong F1-scores when distinguishing attack patterns from normal activity. Random forest classifiers frequently surpass traditional baseline models, such as naive Bayes, linear discriminant analysis, and k-nearest neighbors, due to their structural resistance to feature noise during massive traffic aggregation. Concurrently, deep learning architectures—including convolutional neural networks, long short-term memory networks, and bidirectional variants—capture complex spatial relationships and temporal dependencies in streaming traffic data. Researchers have also combined these mechanisms into hybrid convolutional and recurrent neural network ensembles, allowing intrusion detection systems to track immediate packet transitions alongside extended temporal sequences. Despite these classification capabilities, the authors emphasize that supervised frameworks depend heavily on extensive pre-labeled datasets, which fundamentally limits their ability to recognize previously unseen zero-day attacks or dynamically emerging exploit vectors.

To overcome the reliance on labeled training data, researchers have developed unsupervised and semi-supervised techniques designed to isolate hidden anomalies within dynamic campus communication streams. Unsupervised algorithms, such as k-means clustering, density-based spatial clustering of applications with noise, and deep autoencoders, process raw, unlabeled network traffic to detect statistical deviations and unusual transmission behaviors without manual categorization. Semi-supervised approaches, including variational autoencoders and graph neural networks, leverage smaller subsets of validated training data alongside vast volumes of unannotated traffic, significantly reducing the overhead associated with data labeling in large academic environments. Reinforcement learning methods, incorporating frameworks such as Q-learning, deep Q-networks, and policy gradient algorithms, introduce self-learning capabilities that autonomously adjust defense postures through iterative environmental interaction. By dynamically executing traffic throttling, protocol filtering, and path rerouting, reinforcement learning agents respond autonomously to unfolding attacks. However, the survey notes that practical deployments of reinforcement learning in campus settings face notable challenges, including high training complexity, convergence latency, and sensitivity to the design of algorithmic reward functions.

The synthesis of empirical data indicates a pronounced imbalance between the depth of research devoted to volumetric floods and the study of link-layer manipulation. While distributed denial of service defenses have been extensively investigated across multiple network tiers, address resolution protocol spoofing remains comparatively underexplored despite its severe operational consequences. Detecting link-layer spoofing necessitates specialized behavioral modeling focused on protocol-specific parameters, such as address resolution protocol request-reply consistency, binding stability between hardware and network addresses, packet inter-arrival temporal spacing, and anomalous address resolution sequence ordering. Specialized frameworks, such as the explainable deep-learning system known as ARP-PROBE, have achieved notable detection accuracies with minimal false-positive and false-negative rates in connected environments. Furthermore, emerging cross-layer investigations have evaluated multi-layered architectures, such as MULTI-LF, to demonstrate the viability of simultaneous mitigation. However, comprehensive frameworks that concurrently resolve volumetric transport attacks and subtle link-layer poisoning remain exceptionally rare in the literature, with only isolated studies like those by Chai and Chatterjee successfully demonstrating multi-layer mitigation.

A critical finding of the systematic review centers on the pervasive dependence of existing research on synthetic and standardized benchmark datasets, including CICIDS2017, CICIDS2019, and Kitsune. Although CICIDS2017 and CICIDS2019 provide extensive labeled flow-level records representing diverse attack classifications, including transmission control protocol, internet control message protocol, and hypertext transfer protocol floods, they are generated under controlled laboratory settings using scripted attack tools. Similarly, the Kitsune dataset provides packet-level traces well-suited for lightweight anomaly detection, but its data originate from constrained, simulated Internet of Things environments. The authors caution that reported detection accuracies approaching near-perfect values must be interpreted with extreme care, as synthetic datasets fail to mirror the operational reality of actual campus infrastructures. Live academic networks exhibit highly diverse academic and administrative traffic mixes, extreme diurnal fluctuations, extensive bring-your-own-device deployments, dense virtual local area network segmentations, dynamic dynamic-host-configuration-protocol allocations, and continuous device roaming, all of which substantially degrade model generalizability when deployed outside laboratory testbeds.

Beyond dataset limitations, the review underscores substantial operational and computational bottlenecks that impede the physical deployment of artificial intelligence models across campus network hardware. Standard campus networking equipment, such as legacy distribution routers and edge access switches, possesses finite processing capacity, limited buffer memory, and restricted forwarding throughput. These hardware constraints make it computationally impractical to execute resource-intensive deep learning models, such as hybrid convolutional-recurrent ensembles, directly on network devices. During peak academic hours, campus network traffic regularly exceeds hundreds of thousands of packets per second, demanding intrusion classification decisions within millisecond latencies to prevent severe network disruption. Moreover, comprehensive packet-level inspection at the network edge raises intricate privacy and regulatory complications regarding administrative surveillance of student and faculty transmissions. Complex machine learning models also exhibit limited interpretability, obscuring internal decision-making processes and preventing network administrators from readily understanding the underlying causes of flagged anomalies, which ultimately diminishes operational trust in automated mitigation systems.

To reconcile the computational complexity of advanced machine learning with the resource realities of campus hardware, recent literature explores architectural integration with software-defined networking, edge-cloud collaboration, and federated learning paradigms. Software-defined networking centralizes control-plane visibility, enabling network controllers to orchestrate dynamic defense interventions, including automated port isolation, granular rate limiting, and real-time path rerouting across physical switches. Distributing defensive responsibilities across edge-cloud topologies allows lightweight algorithmic models, such as extremely randomized trees classifiers, to conduct preliminary packet-level anomaly filtering at local edge nodes, while computationally demanding deep analytical models operate on centralized servers. Federated learning frameworks further enhance operational scalability and data privacy by facilitating collaborative model training across disparate campus subnetworks without necessitating the transmission of raw network traffic records. In addition, model optimization techniques—including network pruning, parameter quantization, and knowledge distillation—significantly compress neural network parameters, decreasing energy and memory consumption while preserving high classification accuracy on resource-constrained campus devices.

The review concludes with strategic recommendations to guide future research toward resilient, context-aware, and operationally viable network defenses for academic institutions. Future research must prioritize the development of modular and lightweight hybrid architectures capable of adapting dynamically to evolving multi-vector threats and adversarial manipulation, such as feature evasion and data poisoning attacks. Investigators must move beyond synthetic benchmarks by conducting rigorous longitudinal validations utilizing continuous traffic traces captured directly from live campus networks. Furthermore, advancing explainable artificial intelligence techniques is essential to provide network engineers with transparent, interpretable rationales for automated intervention, thereby establishing administrative confidence. Addressing class imbalances and raw feature extraction through standardized automated pipelines, including autoencoders and synthetic oversampling, will enhance detection consistency across heterogeneous environments. Ultimately, establishing robust, context-sensitive machine learning frameworks validated against real academic traffic represents the necessary pathway to transforming theoretical algorithmic achievements into dependable, scalable cybersecurity solutions for contemporary university infrastructures.

Subject of Research: Machine learning techniques for defending campus networks against DDoS and ARP spoofing attacks

Article Title: Securing campus networks with intelligence: a review of machine learning techniques for ddos and arp protection

Article References: Richard, K., Sadiq, B. O., & Maniniti, V. (2026). Securing campus networks with intelligence: a review of machine learning techniques for ddos and arp protection. Discover Networks, 2(1), Article 11. https://doi.org/10.1007/s44354-026-00026-1

Image Credits: AI Generated

DOI: 10.1007/s44354-026-00026-1

Keywords: Campus Network Security, Machine Learning, DDoS Prevention, ARP Spoofing, Intrusion Detection Systems, Software-Defined Networking, Federated Learning, Network Cybersecurity, Securing, campus, networks, intelligence