Towards Sociotechnical Intelligence in Cyber Intrusion Detection: A Systematic Review Integrating ML/DL Performance, Human Adoption, and RAG-Enhanced Explainable AI

Towards Sociotechnical Intelligence in Cyber Intrusion Detection: A Systematic Review Integrating ML/DL Performance, Human Adoption, and RAG-Enhanced Explainable AI | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Systematic Review Towards Sociotechnical Intelligence in Cyber Intrusion Detection: A Systematic Review Integrating ML/DL Performance, Human Adoption, and RAG-Enhanced Explainable AI Yali Ren, Ning Wang This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-9329228/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract Intelligent Intrusion Detection Systems (IDS) routinely report accuracy above 99% on standard benchmarks, yet real‑world deployment remains limited, an operational divergence we formalize as the Performance–Adoption Gap (PAG). This Preferred Reporting Items for Systematic Reviews and Meta‑Analyses (PRISMA) compliant systematic survey integrates 153 empirical IDS studies (2009–2025), an extended UTAUT2 adoption survey of 300 security professionals, and the distributed‑systems literature to examine this gap from a sociotechnical perspective. We contribute: (1) a transparent six‑stage PRISMA pipeline with reproducibility artifacts; (2) a Six‑Axis Sociotechnical Taxonomy that extends four technical IDS dimensions with two empirically grounded human‑factors axes; (3) a quantitative meta‑analysis showing a mean accuracy of 97.1% but a median minority‑class recall of 0.648 and an average cross‑dataset accuracy drop of 18 percentage points; (4) a formal definition of the PAG as a divergence measure; and (5) a ten‑stage Sociotechnical IDS Architecture that maps detection, explanation, and analyst‑interaction stages to distributed edge–cloud and federated deployment scenarios. The analysis highlights scalability constraints, including inference latency, horizontal partitioning, and model‑synchronization overhead, that directly affect cluster‑based IDS deployments. Finally, we outline a prioritized research roadmap, identifying Retrieval‑Augmented Generation augmented (RAG-augmented) explainability as a high‑leverage direction for bridging technical performance with operational adoption in distributed and federated IDS environments. Intrusion Detection Systems (IDS) Distributed and Federated Learning RAG‑Augmented Explainable AI Edge–Cloud Security Architecture Performance–Adoption Gap (PAG) Sociotechnical Systems Full Text Additional Declarations The authors declare no competing interests. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-9329228","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Systematic Review","associatedPublications":[],"authors":[{"id":617959708,"identity":"7a3d9dd2-2e19-4e6c-a158-efdcf8d5a9e9","order_by":0,"name":"Yali Ren","email":"","orcid":"","institution":"Georgia Institute of Technology","correspondingAuthor":false,"prefix":"","firstName":"Yali","middleName":"","lastName":"Ren","suffix":""},{"id":617959709,"identity":"2e4d103c-5e4f-48a2-bdf1-d112b3446c06","order_by":1,"name":"Ning Wang","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAAnUlEQVRIiWNgGAWjYNCCCoYEIGlAipYzJGthbCNFi7lE8rOHX+cdzmNgb94mQZQWyxlp5say2w4XM/AcKyNOi8HtBDNpyW2HExskcsyI1ZL+TVpyDlCL/BuiteSYSX5sANnCQ6yW+2/KpBmOpSe28aQVWxCn5czxbZI/aqwT+9kPb7xBlBYQYOYBEmxEKwcBxh8kKR8Fo2AUjIIRBwDFTC3tvexlGAAAAABJRU5ErkJggg==","orcid":"","institution":"University of Houston","correspondingAuthor":true,"prefix":"","firstName":"Ning","middleName":"","lastName":"Wang","suffix":""}],"badges":[],"createdAt":"2026-04-06 02:42:05","currentVersionCode":1,"declarations":{"humanSubjects":false,"vertebrateSubjects":false,"conflictsOfInterestStatement":false,"humanSubjectEthicalGuidelines":false,"humanSubjectConsent":false,"humanSubjectClinicalTrial":false,"humanSubjectCaseReport":false,"vertebrateSubjectEthicalGuidelines":false},"doi":"10.21203/rs.3.rs-9329228/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-9329228/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":106404475,"identity":"fd3ff0c6-5167-42fa-b1a1-3c1eccc8a211","added_by":"auto","created_at":"2026-04-08 09:16:05","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":1137952,"visible":true,"origin":"","legend":"","description":"","filename":"SociotechnicalIntelligenceinCyberIntrusionDetectionReviewFinal.pdf","url":"https://assets-eu.researchsquare.com/files/rs-9329228/v1_covered_c69268a2-80a4-401a-8012-583046e52ed1.pdf"}],"financialInterests":"The authors declare no competing interests.","formattedTitle":"\u003cp\u003eTowards Sociotechnical Intelligence in Cyber Intrusion Detection: A Systematic Review Integrating ML/DL Performance, Human Adoption, and RAG-Enhanced Explainable AI\u003c/p\u003e","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":true,"hideJournal":true,"highlight":"","institution":"University of Houston","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":true,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"Intrusion Detection Systems (IDS), Distributed and Federated Learning, RAG‑Augmented Explainable AI, \tEdge–Cloud Security Architecture, Performance–Adoption Gap (PAG), Sociotechnical Systems","lastPublishedDoi":"10.21203/rs.3.rs-9329228/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-9329228/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003e\tIntelligent Intrusion Detection Systems (IDS) routinely report accuracy above 99% on standard benchmarks, yet real‑world deployment remains limited, an operational divergence we formalize as the Performance–Adoption Gap (PAG). This Preferred Reporting Items for Systematic Reviews and Meta‑Analyses (PRISMA) compliant systematic survey integrates 153 empirical IDS studies (2009–2025), an extended UTAUT2 adoption survey of 300 security professionals, and the distributed‑systems literature to examine this gap from a sociotechnical perspective. We contribute: (1) a transparent six‑stage PRISMA pipeline with reproducibility artifacts; (2) a Six‑Axis Sociotechnical Taxonomy that extends four technical IDS dimensions with two empirically grounded human‑factors axes; (3) a quantitative meta‑analysis showing a mean accuracy of 97.1% but a median minority‑class recall of 0.648 and an average cross‑dataset accuracy drop of 18 percentage points; (4) a formal definition of the PAG as a divergence measure; and (5) a ten‑stage Sociotechnical IDS Architecture that maps detection, explanation, and analyst‑interaction stages to distributed edge–cloud and federated deployment scenarios. The analysis highlights scalability constraints, including inference latency, horizontal partitioning, and model‑synchronization overhead, that directly affect cluster‑based IDS deployments. Finally, we outline a prioritized research roadmap, identifying Retrieval‑Augmented Generation augmented (RAG-augmented) explainability as a high‑leverage direction for bridging technical performance with operational adoption in distributed and federated IDS environments.\u003c/p\u003e","manuscriptTitle":"Towards Sociotechnical Intelligence in Cyber Intrusion Detection: A Systematic Review Integrating ML/DL Performance, Human Adoption, and RAG-Enhanced Explainable AI","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-04-07 04:05:59","doi":"10.21203/rs.3.rs-9329228/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"76612af8-43b2-4655-beaa-ff3aad96b80f","owner":[],"postedDate":"April 7th, 2026","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[],"tags":[],"updatedAt":"2026-04-07T04:05:59+00:00","versionOfRecord":[],"versionCreatedAt":"2026-04-07 04:05:59","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-9329228","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-9329228","identity":"rs-9329228","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}