A Systematic Review of Machine Learning Applications in Cybersecurity Threat Detection and Classification (2018–2026)

Abstract

This study addresses the growing difficulty organizations face in detecting and classifying increasingly sophisticated cybersecurity threats when conventional signature-based and rule-based mechanisms are challenged by previously unseen attacks, changing malicious behavior, high-volume security data, and complex cloud and enterprise infrastructures. The purpose of the research is to systematically examine machine-learning applications in cybersecurity threat detection and classification and quantitatively determine how major machine-learning capabilities contribute to Cybersecurity Threat Detection and Classification Performance. The study combines a systematic review of 82 eligible studies published between 2018 and 2026 with a quantitative, cross-sectional, case-study-based empirical design focused on cybersecurity-oriented enterprise, network, and cloud-enabled organizational environments where machine learning is used for security monitoring and threat management. The empirical sample comprised cybersecurity analysts, information-security specialists, network-security engineers, SOC professionals, IT security personnel, machine-learning practitioners, and cybersecurity managers. Of 320 questionnaires distributed, 301 were returned and 286 usable responses were retained, yielding an 89.4% usable response rate. The key explanatory variables were ML-Based Automated Threat Detection, Intelligent Feature Learning and Pattern Recognition, Real-Time Anomaly and Intrusion Detection, and ML-Based Threat Classification Capability, with Cybersecurity Threat Detection and Classification Performance serving as the dependent variable. Data were analyzed using descriptive statistics, Cronbach's alpha, KMO and Bartlett's tests, Pearson correlation, multiple regression, ANOVA, standardized beta coefficients, tolerance, VIF, and Durbin-Watson diagnostics. The findings showed that Cybersecurity Threat Detection and Classification Performance recorded M = 4.18, SD = 0.53, while Real-Time Anomaly and Intrusion Detection achieved M = 4.16, SD = 0.55. All four predictors were significantly associated with performance, with Real-Time Anomaly and Intrusion Detection showing the strongest correlation, r = .74, followed by ML-Based Threat Classification Capability, r = .71, ML-Based Automated Threat Detection, r = .69, and Intelligent Feature Learning and Pattern Recognition, r = .63, all p < .001. The regression model achieved R = .834, R² = .696, adjusted R² = .692, F (4, 281) = 160.84, p < .001, explaining 69.6% of the variance. Real-Time Anomaly and Intrusion Detection emerged as the strongest predictor, β = .31, followed by ML-Based Threat Classification Capability, β = .28, ML-Based Automated Threat Detection, β = .24, and Intelligent Feature Learning and Pattern Recognition, β = .18. All five hypotheses were supported. These findings imply that organizations should prioritize real-time anomaly recognition, accurate threat classification, automated detection, and intelligent feature learning as complementary capabilities for improving cybersecurity performance across enterprise and cloud environments.