Adversarial Intelligence: A Systematic Review of AI-Driven Cyber Threat Detection, Adaptive Malware Evasion, and Arms Race Dynamics in Zero Trust Security Environments

Technical Summary: Adversarial Intelligence in Zero Trust Environments

Problem Statement
The paper addresses the critical disconnect between the rapid adoption of Artificial Intelligence (AI) for cyber defense and the parallel evolution of AI-driven adversarial attacks. While defenders increasingly deploy machine learning (ML) and deep learning (DL) for intrusion detection, malware classification, and behavioral analytics, adversaries are repurposing these same statistical and generative tools to craft evasive malware and adversarial network traffic. This dynamic has created a continuous "arms race" where detection accuracy is consistently countered by evasion success. A significant gap exists in the literature: few works integrate AI-driven detection, adversarial evasion, and Zero Trust Architecture (ZTA) governance into a single analytical framework. Consequently, practitioners and policymakers struggle to understand the system-level consequences of deploying AI in security stacks, particularly as generative models and Large Language Models (LLMs) compress the time and skill required for evasion. Furthermore, ZTA deployments rely on continuous AI-driven verification, yet the adversarial robustness of these underlying AI components is rarely evaluated within the context of ZTA governance.

Methodology
This study is a systematic review of 80 peer-reviewed articles, preprints, and technical reports published between 2010 and 2026. The review followed a PRISMA-inspired process, searching databases including IEEE Xplore, ACM Digital Library, SpringerLink, ScienceDirect, MDPI, and arXiv. Search terms were drawn from five thematic clusters: intrusion detection, adversarial ML/malware evasion, GANs in security, Zero Trust architecture, and Explainable AI (XAI) in cybersecurity.

Inclusion criteria required the work to involve an AI/ML component, address a cybersecurity detection/evasion/governance task, and report sufficient methodological detail. The review adopts a thematic synthesis approach rather than a quantitative meta-analysis, grouping sources into four overlapping clusters: detection-focused, evasion/attack-focused, defense/robustness-focused, and governance/ZTA-focused. The analysis includes the creation of comparative tables, taxonomies, and quantitative charts characterizing the composition and growth of the reviewed literature.

Key Contributions

1. Unified Taxonomy of Detection and Evasion: The paper introduces a structured taxonomy of AI-driven detection techniques (Classical ML, Deep Learning, Generative/Adversarial, Federated, and LLM-based) and maps them against corresponding families of adversarial evasion (Gradient-based, GAN-based, Reinforcement Learning, and Search-based).
2. Four-Generation Escalation Model: The authors trace the co-evolution of attack and defense across four technological generations:
   • Gen 1: Signature-based defense vs. obfuscation/packing.
   • Gen 2: Feature-engineered classical ML vs. feature-space perturbation.
   • Gen 3: Deep learning (CNN/LSTM/Transformers) vs. gradient-based and GAN-crafted adversarial samples.
   • Gen 4: Adversarial training/Federated Learning/XAI vs. LLM-assisted malware generation and automated red teaming.
     The review demonstrates that rising detection accuracy has consistently been matched by rising evasion success rates, rather than one trend dominating.
3. Zero Trust Governance Gap Analysis: The paper identifies a "governance gap" where ZTA frameworks structurally depend on AI for continuous verification but lack integrated adversarial robustness evaluation. It argues that adversarial robustness must be treated as a first-class ZTA design requirement, not a separate ML research concern.
4. Synthesis of Explainability and Trust: The review analyzes the trade-off between detection accuracy and interpretability. It highlights that while techniques like SHAP and LIME provide post-hoc explanations, they may not faithfully represent model decisions and could potentially aid adversaries. It notes that regulatory frameworks (e.g., EU AI Act, NIST AI RMF) are beginning to mandate explainability, creating a compliance imperative for secure AI.
5. Benchmark and Evaluation Critique: The paper critiques the field's reliance on outdated datasets (e.g., KDD Cup 1999, NSL-KDD) and the prevalence of "feature space" attacks that do not translate to "problem space" (real executable files or network packets). It calls for standardized adversarial robustness metrics and problem-space realizable benchmarks.

Results and Findings

• Detection Techniques: Deep learning architectures (CNNs, LSTMs, Transformers) dominate current literature, achieving high accuracy (>99% on benchmarks) but suffering from opacity and high computational costs. Generative Adversarial Networks (GANs) are used both defensively (to synthesize minority class samples) and offensively (to generate adversarial traffic).
• Evasion Strategies: Adversarial attacks have evolved from simple feature perturbations to sophisticated GAN-based synthesis and Reinforcement Learning (RL) guided modifications that preserve malicious functionality. Black-box attacks, utilizing substitute models or query-based methods, are increasingly prevalent.
• Defense Mechanisms: Adversarial training (retraining on perturbed samples) is the most studied defense but often fails to generalize to unseen attack families. Ensemble methods and detection-based filtering (identifying adversarial inputs before classification) offer complementary protection.
• ZTA Integration: While authentication and authorization are mature in ZTA implementations, the "environmental perception" and "orchestration" components—reliant on AI analytics—are underexplored regarding adversarial robustness.
• Open Challenges: The review identifies five critical clusters of open challenges: (1) Robustness and generalization (lack of cross-family transferability), (2) Data and benchmarking (need for problem-space realizable datasets), (3) Explainability and trust (faithfulness of post-hoc explanations), (4) Operational constraints (computational costs of robust training), and (5) Governance and standardization (lack of unified robustness metrics).

Significance
The paper claims its significance lies in consolidating a fragmented body of research into a coherent account of how AI reshapes both sides of the cyber conflict. By visualizing the evolution of the arms race through structured figures and quantitative summaries, the work aims to shorten the path from awareness to actionable practice.

For practitioners, the provided taxonomies and arms race models explain why detectors performing well on static benchmarks often fail against adaptive adversaries. For policymakers and standards bodies, the synthesized evidence regarding explainability, robustness, and ZTA integration offers a basis for drafting sector-specific guidance (e.g., for healthcare and finance) aligned with frameworks like the NIST AI Risk Management Framework. For the research community, the review highlights concrete gaps—such as the scarcity of realistic adversarial benchmarks and the unresolved trade-off between interpretability and accuracy—to inform future experimental design. Ultimately, the paper argues that closing the gap between detection accuracy and adversarial resilience requires treating robustness, explainability, and continuous verification as jointly optimized properties of a single security system.