Hybrid Machine Learning Approaches for Efficient Network Outlier Detection: A Review of LightGBM-Based Frameworks

Abstract

The rapid growth of network traffic volume, connected devices and attack diversity has made outlier detection one of the most demanding problems in modern cybersecurity. Signature-based systems are unable to recognise novel or mutated attacks, while many deep learning detectors deliver high accuracy at a computational cost that limits their use in high-speed or resource-constrained environments. Light Gradient Boosting Machine (LightGBM), a histogram-based gradient boosting decision tree framework, has emerged as a strong candidate for efficient network outlier detection because it combines fast training, low memory consumption and competitive accuracy on tabular flow data. It first traces the evolution of network anomaly detection and the development of gradient boosting algorithms, and then analyses benchmark datasets, classical and deep learning detectors, LightGBM-based hybrid frameworks, and the cross-cutting issues of class imbalance, interpretability and deployment. Three comparative tables summarise datasets, algorithm families and representative LightGBM-centred frameworks. The review finds that hybridisation, through feature selection, resampling, parallel processing, ensemble stacking and explainability layers, consistently improves the efficiency and reliability of LightGBM detectors. It also identifies persistent gaps in dataset quality, cross-dataset generalisation, concept drift handling and adversarial robustness, and proposes directions for future research.