The review team followed the PRISMA 2020 guidelines, the internationally recognized standard for conducting transparent systematic reviews. They searched five major scholarly databases, namely IEEE Xplore, SpringerLink, ScienceDirect, Taylor & Francis Online, and Web of Science, for peer-reviewed studies published between January 2021 and January 2026, completing the final database search on 31 January 2026. From an initial pool of 400 identified records, 200 studies passed predefined eligibility and quality criteria and entered the synthesis. The scope was deliberately broad, encompassing supervised, unsupervised, semi-supervised, deep learning, hybrid, and ensemble detection approaches, and each study was examined with respect to detection performance, validation strategies, deployment readiness, computational efficiency, adaptability, and explainability. This breadth matters, because detecting a volumetric denial-of-service flood is a fundamentally different problem from spotting the subtle, low-and-slow behavior of an address resolution protocol attacker quietly positioning themselves between a student laptop and the campus gateway.

The technical distinction between the two threats explains why detection is so challenging. A distributed denial-of-service attack aims to exhaust bandwidth, memory, or processing capacity by overwhelming a target with traffic from many sources, often amplified through compromised devices. Detection typically means recognizing statistical anomalies in traffic volume, packet rates, or flow distributions, which machine learning classifiers can learn from labeled examples of benign and malicious traffic. Address resolution protocol spoofing, by contrast, exploits a foundational weakness of local networks: the protocol that maps internet protocol addresses to hardware addresses accepts replies without verification. An attacker who floods a network with forged mapping replies can redirect traffic through their own machine, enabling interception or man-in-the-middle manipulation. Detecting this requires monitoring mapping tables, spotting conflicting hardware-address associations, and flagging inconsistencies in timing and sequence, a task suited to different feature sets and, often, different learning architectures.

On the headline question of whether machine learning works, the review’s answer is broadly affirmative. Many of the 200 reviewed studies reported strong detection performance across all major learning paradigms, from classical supervised classifiers trained on labeled traffic datasets to deep neural networks capable of learning intricate patterns directly from raw or minimally processed packet data. Hybrid and ensemble models, which combine multiple learners to offset the weaknesses of any single approach, frequently demonstrated strong reported results. Ensembles can, for example, pair a fast decision-tree family model that excels at tabular flow features with a deep network that captures temporal structure, or aggregate the votes of several specialized detectors to reduce false alarms. In campus settings, where a false positive might quarantine a researcher mid-experiment and a false negative might expose personal data, that trade-off between sensitivity and precision is not academic; it determines whether security teams trust the system at all.

Yet the review’s most consequential finding is not about what performed well, but about whether the performance numbers can be compared at all. Because of differences in datasets, attack scenarios, feature sets, validation procedures, and experimental environments, the reported results across studies were not directly comparable, the authors conclude. One study’s ninety-nine percent detection rate might be measured against a benchmark dataset with clean, well-separated attack classes, while another’s lower figure might reflect a messier, more realistic simulation. Without a common evaluation ground, the evidence does not establish universal superiority of any particular learning paradigm. Instead, the review suggests that reported performance depends substantially on the evaluation context and methodological conditions, a conclusion that should temper the enthusiasm of anyone shopping for a campus intrusion detection system based on leaderboard figures alone.

The statistics on evaluation practice reveal how wide the gap between laboratory and operational reality remains. Benchmark datasets were used in 48 percent of the reviewed studies, meaning just under half of the research rested on standardized collections of network traffic that may date from different eras, capture different attack generations, and differ statistically from the traffic actually flowing through a university. More striking, only 12 percent of studies evaluated their systems on real university networks. Real-time detection was assessed in 40 percent of studies, which means the majority of published detectors have never been asked to make a decision within the latency budget of a live network, where a model that takes seconds to classify traffic may be useless against an attack that unfolds in milliseconds. These numbers paint a portrait of a field rich in algorithmic innovation but comparatively poor in deployment evidence.

Adaptability emerged as another underdeveloped frontier. Continuous learning, concept-drift detection, and model adaptation received comparatively limited attention across the reviewed literature. The omission matters because campus traffic is anything but static. A model trained on the network behavior of a February exam period will encounter something quite different in September, when thousands of new devices join the network simultaneously. New attack tools alter traffic signatures, streaming services shift traffic mixtures, and remote learning periods reshape usage patterns overnight. Concept drift, the phenomenon in which the statistical relationship between features and labels changes over time, is therefore not an edge case for university networks but a constant condition. A detector that cannot recognize when its assumptions have expired will silently degrade, and security teams may not notice until an incident forces the conversation.

Explainability compounds the problem. Deep learning models, for all their accuracy on paper, often operate as opaque functions whose decisions resist straightforward interpretation. In an operational security setting, an analyst receiving an alert needs to know why a flow was flagged: which features drove the decision, whether the alert resembles known attack patterns, and how confident the model is. Without that context, triage becomes slow and trust erodes. The review’s authors argue that the field needs adaptive, context-aware, cross-layer, and explainable intrusion detection approaches capable of addressing the operational characteristics of university networks. Cross-layer detection, which correlates evidence from the physical, network, and application layers, is particularly relevant to the two threats under study, since a spoofing attack at the link layer may manifest only indirectly in traffic statistics at higher layers.

The specific vulnerabilities of universities make this agenda urgent rather than merely interesting. Open-access architectures, by design, welcome a rotating population of devices whose owners cannot be vetted the way corporate endpoints can. Bring your own device practices mean the network administrator neither controls the hardware nor the software running on it. Internet of Things integration multiplies the number of lightly defended devices that can be conscripted into denial-of-service botnets or used as launch points for spoofing. Dynamic traffic patterns, driven by academic calendars and student behavior, undermine the stationarity assumptions on which many machine learning models are built. A detection system that excels on a stable enterprise network may flounder on a campus precisely because campuses violate every neat assumption the model was trained under.

What emerges from this systematic review is a research program rather than a verdict. The strength of the evidence supports continued investment in machine learning for campus network defense, particularly in hybrid and ensemble architectures that can balance speed, accuracy, and robustness. But the weaknesses in the evidence base point equally clearly toward what must change: more studies evaluated on real university infrastructure, more work on real-time performance under realistic computational budgets, more attention to continuous learning and drift detection so that models remain valid as networks evolve, and more emphasis on explainability so that human analysts can act on model outputs with confidence. Until the field closes the gap between benchmark success and operational proof, campus security teams should treat published accuracy figures as starting points for evaluation rather than guarantees, and researchers should regard the 88 percent of studies that never touched a real university network as a measure of unfinished work. The machines are learning; the harder task, it turns out, is making them learn in the places that need them most.

Subject of Research: Machine learning-based detection of DDoS and ARP spoofing attacks in university networks

Article Title: Enhancing university network security through ML-based detection of DDoS and ARP spoofing attacks: a systematic review

Article References: Enhancing university network security through ML-based detection of DDoS and ARP spoofing attacks: a systematic review. (n.d.). https://doi.org/10.3389/fcomp.2026.1900515

Image Credits: AI Generated

DOI: 10.3389/fcomp.2026.1900515

Keywords: network security, machine learning, DDoS, ARP spoofing, university networks, intrusion detection, systematic review, deep learning, ensemble models, concept drift, explainability, cybersecurity