Artificial Intelligence-Based Intrusion Detection Systems for Smart University Ecosystems: A Survey of IoT Security, Cloud Learning Platforms, and Connected Campus Services

Smart Universities increasingly rely on connected learning platforms, smart classrooms, Internet of Things (IoT) devices, cloud services, and digital administrative systems. This integration expands the attack surface and creates security requirements involving educational data, heterogeneous infrastructure, and the continuous availability of academic services. This survey examines AI-based intrusion detection through three complementary perspectives: campus-specific threats and architectural layers, detection approaches and their deployment trade-offs, and operational evaluation and governance requirements. It reviews machine learning, deep learning, ensemble and hybrid models, lightweight detection, federated learning, and explainable AI, relating their capabilities and limitations to device, edge, network, cloud, and application layers. The analysis highlights gaps between benchmark performance and evidence of suitability for operational university environments, including limited campus-specific validation, incomplete reporting of latency and resource requirements, and insufficient assessment of privacy safeguards and explanation usefulness. Conventional detection metrics remain necessary but should be complemented by false-alert workload, end-to-end latency, temporal robustness, communication costs, and analyst-centered evaluation. The survey provides a campus-oriented synthesis, an operational evaluation matrix, and a staged research and deployment roadmap prioritizing documented datasets, accountable data governance, baseline assessment, and monitored pilots before broader federation or automated response. AI-based intrusion detection offers promising capabilities for Smart Universities, but its practical value requires validation under representative campus conditions and alignment with institutional resources, privacy obligations, and incident-response processes.