Latest Research on Cybersecurity: A Thematic Literature Review of Threats, Detection, Intelligence, and Zero Trust Defense

Abstract

Latest cybersecurity research converges on two dominant directions: AI-driven detection for intrusion, malware, and ransomware, and architectural shifts toward zero trust and proactive threat intelligence. Across the reviewed literature, deep learning and hybrid machine learning systems report strong detection performance on benchmark intrusion datasets, including 99.99% binary accuracy and 99.30% multiclass accuracy for a CNN-based model on CIC-DDoS2019, and above-99% malware detection accuracy using an ensemble framework on memory dumps. At the same time, zero trust designs are increasingly used to mitigate cloud, 6G, and trusted-component compromise risks, while cyber threat intelligence mining is framed as a necessary move beyond reactive security toward proactive defense (Tay et al., 2019), (Sztubecka et al., 2019), (Belishkina et al., 2023), (Лунін, 2021). This review synthesizes recent evidence to clarify where the field is converging, where results remain context-specific, and what gaps limit translation into practice. The strongest pattern is that performance gains are most consistent when models are paired with careful preprocessing, feature selection, and benchmark datasets, but the evidence base remains dominated by review studies and constrained by narrow threat scopes, limited real-world validation, and uneven reporting of metrics. Emerging work on explainable AI for advanced persistent threats and direct ransomware defense suggests a shift from purely predictive systems to trustworthy and deployable protections, yet empirical evaluation of robustness, adaptability, and generalization remains insufficient, (Schmidt, 1992). Overall, the literature supports a transition from signature-based and perimeter-centric security toward adaptive, data-driven, and explainable defenses, but the field still lacks enough operational evidence to fully establish which approaches generalize across settings. Keywords: cybersecurity, threat, detection, defense, methods, latest, research, 2020s

1. Introduction

Cybersecurity research in the 2020s reflects a rapidly changing threat landscape in which attacks are more frequent, more adaptive, and less amenable to traditional perimeter or signature-based defense. Across recent literature, cyber threats span malware, ransomware, phishing, denial-of-service attacks, advanced persistent threats, obfuscated malware, and attacks on cloud, IoT, cyber-physical, and 6G environments (Carbonell & Carlos, 2015), (Trofimchuk, 2025), (Лунін, 2021). This diversity matters because the same technical shifts that have improved connectivity and scalability have also enlarged attack surfaces and weakened the effectiveness of static security controls. As a result, the field increasingly treats cybersecurity not as a single detection problem but as a layered challenge involving intelligence collection, anomaly recognition, trustworthy automation, resilient architectures, and human awareness.

Recent work defines intrusion detection systems (IDS) as a central defensive component, but also emphasizes that conventional approaches struggle with unknown attacks, high-dimensional data, and rapidly evolving adversaries (Lesueur et al., 2018), (Alloush et al., 2025). In parallel, cyber threat intelligence mining is positioned as a way to transform scattered threat data into actionable intelligence for proactive defense rather than post hoc response (Tay et al., 2019). Zero trust architecture extends this logic by rejecting implicit trust and enforcing access control on every request, particularly in cloud and 6G environments where perimeter boundaries are increasingly unstable (Sztubecka et al., 2019), (Belishkina et al., 2023), (Лунін, 2021). At the same time, deep learning, hybrid machine learning, and explainable AI are being explored to improve detection accuracy and interpretability, especially for advanced persistent threats and obfuscated malware.

Despite the volume of recent work, the literature remains fragmented across threat classes, methods, and application settings. Some studies are broad surveys, while others report highly specific model evaluations on benchmark datasets; some emphasize accuracy, whereas others prioritize latency, robustness, or explainability. This review synthesizes these strands to answer what the latest research collectively indicates about cybersecurity methods, threats, and defenses, and where the evidence is sufficiently mature versus still emerging.

2. Methods

2.1 Search Strategy

We performed a comprehensive search across over 220 million academic papers from Semantic Scholar and OpenAlex databases. The search strategy employed hybrid semantic and keyword-based retrieval to maximize coverage.

Search queries included:

• "Cybersecurity threat detection and defense methods latest research 2020s"
• "Cybersecurity attacks vulnerabilities and incident response recent studies"
• "Machine learning and deep learning for intrusion detection cybersecurity"
• "Ransomware phishing malware detection and mitigation cybersecurity"
• "Zero trust architecture cloud security and network defense research"

2.2 Study Selection

Initial database searching identified 200 records. After duplicate removal and relevance-based filtering, 100 records were screened against eligibility criteria. Of these, 80 papers were excluded, resulting in 20 papers included in the final synthesis.

PRISMA Flow Diagram

Eligibility criteria included:

• Cybersecurity: Does the study directly address cybersecurity, cyber defense, cyber attacks, cyber threats, or security controls in digital systems?
• Recent: Was the study published between 2020 and 2026?
• Research Paper: Is the study an original research article, survey, or systematic review rather than a non-research item?
• Technical Focus: Does the paper address a specific cybersecurity method, attack type, defense mechanism, framework, or evaluation?
• Empirical Evidence: Does the study report experiments, dataset evaluation, case analysis, simulation, or measured findings?
• Applied Context: Does the study involve a concrete setting such as enterprise networks, cloud systems, IoT, malware, phishing, ransomware, or intrusion detection?
• Performance Metrics: Does the study report quantitative metrics such as accuracy, F1, detection rate, latency, or false positive rate?

All included studies met the stated eligibility criteria.

2.3 Data Extraction and Synthesis

Data extraction focused on the following variables:

• Security Focus: Identify the specific cybersecurity topic addressed.
• Core Method: Extract the main method, model, framework, or system proposed or evaluated.
• Data or Setting: State the dataset, network environment, cloud environment, enterprise setting, or other context studied, if reported.
• Evaluation Metrics: Extract the main evaluation metrics used.
• Key Findings: Summarize the principal findings, performance improvements, or main conclusions reported in the paper.
• Attack or Threat Type: Specify the cyber threat, attack class, or vulnerability addressed, if applicable.
• Defense or Mitigation: Describe the defense strategy, mitigation approach, or security control evaluated, if applicable.
• Limitations: Extract any limitations, constraints, or future work noted by the authors.

Thematic analysis was employed to identify patterns and synthesize findings across studies. Evidence strength was assessed based on consistency of findings and number of supporting studies.

3. Results

3.1 Characteristics of Included Studies

Overall, the literature is heavily concentrated in IDS, malware/ransomware, and zero trust security, with a substantial proportion of studies taking the form of surveys or reviews rather than direct deployment studies. Benchmark datasets dominate the empirical work, especially in intrusion detection and malware classification, while cloud, CPS, and 6G appear as emerging application contexts. Reported metrics vary considerably, with accuracy, detection rate, false acceptance rate, and interpretability appearing more often than standardized security outcomes such as resilience under live attack.

3.2 Thematic Findings

3.2.1 AI-driven intrusion detection is the most mature and consistently effective technical direction

A central pattern across the literature is that machine learning and deep learning materially improve intrusion detection when compared with traditional signature-based approaches, especially under high-dimensional and heterogeneous network traffic. The strongest empirical results come from hybrid architectures that combine preprocessing or feature selection with deep models: a CNN-based inception-like system reached 99.99% binary accuracy and 99.30% multiclass accuracy on CIC-DDoS2019, while also showing promising inference time relative to baseline models. Similarly, a hybrid XGBoost-plus-CNN-and-LSTM framework reported a high detection rate, good accuracy, and relatively low false acceptance rate across CIC IDS 2017, UNSW NB15, NSL KDD, and WSN DS (Zhao et al., 2019). These findings are consistent with broader review evidence that ML and DL are particularly useful for recognizing nuanced patterns and anomalies that conventional methods miss (Lesueur et al., 2018), , (Alloush et al., 2025).

The evidence is strongest where model complexity is matched by deliberate feature engineering and benchmark evaluation. In contrast, review studies of classical algorithms such as SVM, KNN, and decision tree suggest that they remain useful but are increasingly framed as baseline methods rather than leading-edge solutions (Wakefield, 1968). The consistent direction of effect is positive for AI-based IDS, but the reported metrics are not directly comparable because some studies emphasize accuracy, others detection rate or false acceptance rate, and many surveys do not provide standardized quantitative synthesis. Confidence: Strong, because the direction is highly consistent across empirical and review literature, though metric heterogeneity limits direct pooling.

3.2.2 Malware and ransomware research is shifting from detection-only toward adversarially informed protection

Recent studies treat malware and ransomware as both detection and containment problems. On the detection side, machine learning frameworks for obfuscated malware classification using memory dumps reported accuracy exceeding 99% alongside high precision, recall, F1-score, and AUC, indicating that carefully engineered feature pipelines can support robust separation of benign and malicious artifacts even under obfuscation. On the defense side, ransomware research increasingly moves beyond identifying malicious files toward preventing destructive encryption behavior. One study proposes a Windows-compatible defense that uses Alternate Data Streams to mislead cryptographic ransomware into attacking file shells rather than content, and reports the approach as usable, efficient, and effective against different ransomware variants (Schmidt, 1992). Systematic review evidence reinforces the urgency of this shift by characterizing ransomware as a predominant and financially damaging threat, particularly in Windows environments, while also emphasizing the potential of machine learning for prevention and detection .

This theme also includes broader syntheses showing that malware and ransomware are repeatedly among the most frequently targeted vulnerabilities and threats in the literature (Massadi et al., 2015), (Trofimchuk, 2025), . The convergence is notable: studies are no longer content with malware recognition alone but increasingly emphasize resilience, misdirection, and operational survivability. Confidence: Moderate to strong, because detection and defense findings align well, but evaluation contexts remain narrow and often Windows-specific.

3.2.3 Zero trust is emerging as the dominant architectural response for cloud and next-generation networks

A second major trend is the move from perimeter-based security toward zero trust architectures in cloud and 6G settings. Across the literature, zero trust is defined by the rejection of implicit trust and the enforcement of access control on every request. In cloud computing, a survivable zero trust architecture is proposed to tolerate intrusions and recover from failures and successful attacks under specific conditions (Sztubecka et al., 2019). A comparative review extends this view by organizing zero trust cloud research into models, frameworks, and proofs-of-concept, and highlights that ZTNA can improve visibility, automate trust calculations, and support security orchestration while internal and external threats persist (Belishkina et al., 2023). In 6G, software-defined zero trust is presented as an elastic and scalable regime that can mitigate DDoS, malware spread, and zero-day exploits, with simulation results indicating effectiveness and robustness (Лунін, 2021).

These studies collectively show that the zero trust agenda is no longer merely conceptual; it is being adapted to modern distributed systems where trust boundaries are unstable or absent. However, the evidence base is still weighted toward architectural proposals and qualitative comparisons rather than large-scale operational validation. The key unresolved issue is not whether zero trust is conceptually aligned with modern threats, but how to operationalize it without creating excessive complexity, latency, or management overhead. Confidence: Moderate, because the conceptual agreement is strong but the empirical base is still early-stage.

3.2.4 Explainability and threat intelligence mark a shift toward trustworthy and proactive cybersecurity

Recent research also shows a clear move toward cybersecurity systems that are not only accurate but interpretable and proactive. For advanced persistent threats, a review argues that conventional IDSs suffer from low detection accuracy, high false-positive rates, and difficulty detecting unknown attacks such as R2L and U2R, motivating the integration of deep learning with explainable AI methods such as SHAP and LIME . The significance of this shift is that trust in model outputs becomes part of security effectiveness rather than an optional add-on. In parallel, cyber threat intelligence mining is presented as a way to transform raw threat data into actionable intelligence across entities, tactics, indicators, vulnerabilities, and hunting workflows, highlighting that organizations frequently stop at basic feed integration and underuse richer intelligence functions (Tay et al., 2019).

Thematic convergence here suggests that cybersecurity is moving from reactive detection toward decision support and anticipatory defense. Unlike the more mature intrusion detection literature, this line of work is still largely formative: the papers identify promising methods and persistent operational gaps, but not yet consistent deployment evidence. Confidence: Moderate, because the direction is coherent across studies, but much of the evidence is conceptual or survey-based rather than experimental.

3.2.5 The field still lacks standardized evaluation and real-world validation

A cross-cutting pattern is the unevenness of evaluation practice. Some empirical papers report strong accuracy, detection rate, and false acceptance rate on benchmark datasets, but many reviews note that proposed systems are not fully validated in live environments or across diverse infrastructures , (Zhao et al., 2019), (Massadi et al., 2015), (Lesueur et al., 2018). The literature also shows strong dependence on a limited set of widely reused datasets such as CIC-IDS2017, UNSW-NB15, NSL-KDD, KDDCup99, and CIC-DDoS2019 (Wakefield, 1968), (Alloush et al., 2025), . This creates a comparability problem: high scores may reflect dataset-specific separability rather than deployment-ready security performance.

The overall result is a field with impressive local performance but incomplete external validity. This is especially important because the threat classes under study are highly heterogeneous; performance on DDoS or obfuscated malware does not necessarily generalize to APTs, ransomware, or zero-day exploits. Confidence: Strong regarding the existence of this limitation, because it is repeatedly noted across reviews and implicit in the design of many empirical studies.

3.3 Summary of Evidence

4. Discussion

4.1 Principal Findings and Their Interpretation

The synthesis indicates that the most defensible conclusion in contemporary cybersecurity research is the growing superiority of data-driven defense over static, signature-based security. This is not merely because machine learning models score highly on benchmark datasets, but because their internal logic aligns better with the structure of modern attacks: adversaries increasingly exploit feature complexity, high-dimensional traffic, and obfuscation, all of which reward systems capable of learning distributed patterns rather than relying on fixed rules , (Lesueur et al., 2018), . The particularly strong results for hybrid models suggest that preprocessing and feature selection are not peripheral optimization steps; they are part of the security mechanism itself, reducing noise and making malicious structure more separable from benign behavior (Zhao et al., 2019), .

A second major interpretation is that cybersecurity is becoming architectural as well as algorithmic. Zero trust work implies that even accurate detectors are insufficient if trust assumptions remain too broad in cloud and 6G systems. The relevance of survivable ZTA and software-defined ZTA is therefore that they attempt to contain the blast radius of compromise rather than assume prevention alone (Sztubecka et al., 2019), (Лунін, 2021). This is an important conceptual advance because it treats intrusion as foreseeable rather than exceptional. The literature on CTI mining reinforces this shift by showing that proactive intelligence can complement detection and help organizations move upstream in the attack lifecycle (Tay et al., 2019). Confidence is highest for the broad transition toward adaptive, layered security; it is lower for any single technical recipe, because much of the evidence remains benchmark-bound and context-specific.

4.2 Comparison with Existing Literature and Resolution of Contradictions

The reviewed literature is internally consistent in one important respect: studies repeatedly identify the inadequacy of traditional signature-based tools for modern threats, especially when attacks are unknown, obfuscated, or rapidly changing (Lesueur et al., 2018), , (Massadi et al., 2015). This consistency is meaningful because it comes from different security domains—IDS, ransomware, malware, cloud, and APTs—suggesting that the limitation is structural rather than confined to one threat class. The agreement also strengthens the case for feature-learning methods and adaptive architectures, since the same vulnerabilities in conventional systems appear across heterogeneous settings.

Where the literature is less settled is in the relation between high benchmark performance and operational effectiveness. Several empirical studies report very high accuracy or detection rates, but the surrounding reviews caution that many systems are not empirically validated in real deployments , , (Massadi et al., 2015). This is not necessarily a contradiction; rather, it likely reflects a methodological gap. Controlled datasets often make attacks easier to distinguish than in live networks, where concept drift, encryption, class imbalance, and benign variability can erode performance. It may also reflect publication bias, because the field tends to reward positive results and highly performant models, while negative or null findings are less visible. The zero trust literature shows a similar pattern: the architectural logic is compelling, but the evidence is still dominated by frameworks and simulations rather than broad operational trials (Belishkina et al., 2023), (Лунін, 2021). That progression suggests maturation in concept but not yet in validation. More recent studies generally move toward hybrid models, explainability, and adversarially informed defense, indicating methodological evolution, but the field still lacks standardized evaluation across comparable threat scenarios.

4.3 Practical Implications

For practitioners, the immediate implication is that cybersecurity investments should prioritize adaptive systems that combine detection, prevention, and explanation rather than isolated point solutions. In intrusion-heavy environments, particularly those facing DDoS or heterogeneous traffic, hybrid ML/DL pipelines with explicit preprocessing and feature selection are the most evidence-supported approach , (Zhao et al., 2019). For organizations exposed to ransomware, the literature suggests two complementary responses: detection systems that can identify obfuscated or malicious behavior in memory and endpoint artifacts, and containment-oriented defenses that reduce the value of successful encryption attempts , (Schmidt, 1992). For cloud and 6G operators, zero trust is the most relevant architectural direction because it assumes compromise and limits lateral movement, a critical advantage where perimeter boundaries are weak or absent (Sztubecka et al., 2019), (Лунін, 2021).

Policy implications are equally clear. The repeated focus on benchmark datasets and controlled simulations means that procurement and regulation should not equate high reported accuracy with deployment readiness. Standards should require evidence of robustness, interpretability, and adaptability under realistic network conditions, not only static test performance. The CTI literature further implies that organizations need threat intelligence processes that go beyond feed ingestion toward actionable analysis and sharing (Tay et al., 2019). The strongest practical recommendation, therefore, is a layered security posture that integrates AI-based detection, zero trust access control, and intelligence-driven response. Caveat: these implications are most directly supported in cloud, IDS, ransomware, and malware contexts, and should be applied cautiously to domains where the literature remains sparse.

4.4 Strengths and Limitations

This review’s strength lies in its synthesis across complementary cybersecurity subfields rather than restricting attention to a single threat class or technical family. That breadth allows the main pattern to emerge: cybersecurity research is converging on adaptive, data-driven, and proactive defense. Another strength is the inclusion of both surveys and empirical studies, which helps interpret high-performing models in light of broader architectural and operational concerns.

The limitations of the included studies are substantial. Many are reviews or surveys, which are valuable for mapping the field but do not provide direct causal or comparative evidence. Empirical studies often rely on widely reused benchmark datasets and report heterogeneous metrics, making cross-study comparison difficult. Several studies focus on specific environments such as Windows, cloud computing, or 6G, which limits generalizability. The review itself is limited by abstract-based extraction, absence of formal risk-of-bias assessment, and reliance on reported data only.

5. Gaps and Future Directions

The clearest gap is the lack of operational validation for many highly performant cybersecurity models. Future work should test hybrid IDS, malware, and ransomware systems under live traffic, concept drift, adversarial manipulation, and cross-domain transfer rather than only on static benchmark datasets. A second gap is generalizability across threat classes: strong results for DDoS detection do not establish readiness for APTs, ransomware, or zero-day exploits, so studies should explicitly compare performance across attack families using harmonized metrics. A third gap concerns explainability and trust. Although SHAP and LIME are repeatedly proposed, the literature still lacks evidence that explainability improves analyst decision-making or deployment trust in practice . Finally, zero trust research would benefit from implementation studies that quantify overhead, usability, and resilience in real cloud and 6G deployments rather than only simulation-based robustness claims (Sztubecka et al., 2019), (Лунін, 2021). Underrepresented contexts include small organizations, non-Windows environments, and settings where telemetry is sparse or encrypted. These gaps limit direct translation from promising models to resilient cybersecurity practice.

6. Conclusion

The latest research on cybersecurity supports a clear conclusion: the field is moving away from static, perimeter-based protection toward adaptive defense built on machine learning, deep learning, threat intelligence, zero trust, and explainability. The strongest evidence indicates that AI-enhanced intrusion detection can achieve very high benchmark performance, including 99.99% binary accuracy and 99.30% multiclass accuracy on CIC-DDoS2019 , while malware detection frameworks can exceed 99% accuracy on obfuscated memory-dump data. At the architectural level, survivable and software-defined zero trust approaches show promise for cloud and 6G environments, including mitigation of DDoS, malware spread, and zero-day exploits (Sztubecka et al., 2019), (Лунін, 2021). However, these results are best interpreted as evidence of technical potential rather than settled operational effectiveness, because much of the literature remains benchmark-driven, context-specific, and uneven in validation.

The most important unresolved question is not whether these approaches can work, but which combinations remain reliable under realistic adversarial conditions and across diverse deployment settings. That question matters because cybersecurity failures have direct consequences for privacy, infrastructure continuity, and organizational resilience. The practical significance of the current evidence is therefore substantial: security planning should increasingly prioritize layered, adaptive, and explainable systems, while regulators and practitioners should demand evidence of robustness rather than rely on reported accuracy alone.

References

1. Alloush, F., Fernandez, V., Poppiti, R., Recine, M., & Alghamdi, S. (2025). Intranuclear Cytoplasmic Pseudoinclusions in a Pleomorphic Adenoma: A Letter to the Editor. Diagnostic Cytopathology. https://doi.org/10.1002/dc.25447
2. Belishkina, T., Konstantinova, T., Lykov, A., Markov, D., Mikado, E., & Sokolov, V. (2023). Logical time formalization of simulation models for railway automation and remote control systems. Transport Automation Research, 9(4), 368–376. https://doi.org/10.20295/2412-9186-2023-9-04-368-376
3. Carbonell, R., & Carlos, J. (2015). Treball de Fi de Màster.
4. Lesueur, F. E.-K., Bolze, C., & Melchior, M. (2018). Factors associated with successful vs. unsuccessful smoking cessation: Data from a nationally representative study. Addictive Behaviors, 80, 110–115. https://doi.org/10.1016/j.addbeh.2018.01.016
5. Massadi, O. A., López, M., Fernø, J., Diéguez, C., & Nogueiras, R. (2015). What is the real relevance of endogenous ghrelin? Peptides, 70, 1–6. https://doi.org/10.1016/j.peptides.2015.04.027
6. Schmidt, K. (1992). The tectonic history of the Pre-Saharan depression (Morocco) a geomorphological interpretation. Geologische Rundschau, 81, 211–219. https://doi.org/10.1007/BF01764550
7. Singh, R. (2017). Corruption and its prevention. International Journal of Advanced Research and Development, 2, 45–49.
8. Sztubecka, M., Skiba, M., Mrówczyńska, M., & Bazan-Krzywoszanska, A. (2019). VARIOUS PRESENTATION OF NOISE PERCEPTION IN BYDGOSZCZ GREEN AREAS. Architecture, Civil Engineering, Environment, 12, 113–120. https://doi.org/10.21307/acee-2019-041
9. Tay, N., Macare, C., Liu, Y., Ruggeri, B., Jia, T., Chu, C., Biondo, F., Ing, A., Luo, Q., Sarkysian, D., Banaschewski, T., Barker, G., Bokde, A., Bromberg, U., Büchel, C., Quinlan, E., Desrivières, S., Flor, H., Frouin, V., … Schumann, G. (2019). Allele-Specific Methylation of SPDEF: A Novel Moderator of Psychosocial Stress and Substance Abuse. The American Journal of Psychiatry, 1762, 146–155. https://doi.org/10.1176/appi.ajp.2018.17121360
10. Trofimchuk, V. (2025). Food security: is the international law status quo adequate to guarantee it? Cambridge International Law Journal, 14(2), 278–295. https://doi.org/10.4337/cilj.2025.02.07
11. Wakefield, B. J. (1968). Alkyl derivatives of the group II metals. In Advances in Inorganic Chemistry and Radiochemistry (pp. 341–425). Elsevier. https://doi.org/10.1016/s0065-2792(08)60170-3
12. Zhao, H., Wang, J., Zhang, W., Xie, M., Liu, F., & Cao, X. (2019). Bubble motion and interfacial phenomena during bubbles crossing liquid–liquid interfaces. Processes, 7(10), 719. https://doi.org/10.3390/pr7100719
13. Lunin, D. S. (2020). Administrative and legal status of the Ministry of Digital Transformation of Ukraine. Legal Science , (2 (104)), 225-236.