Cybersecurity

Detecting and stopping attacks on computer systems and networks.

China leads cybersecurity research, with 14.8% of the 10% most cited papers published 2021–2025; India is second with 11.9%.

This field publishes its leading work largely at conferences, so this technology counts journal articles, conference papers and preprints from any source, not only core journals. A paper posted as a preprint and later published can appear twice.

FirstChina14.8%

SecondIndia11.9%

1.2×lead, by share of the 10% most cited papers, 2021–2025

Highlight a country

Standings

1CNChina14.8%2INIndia11.9%3SASaudi Arabia8.4%4USUnited States7.6%5GBUnited Kingdom3.8%6AUAustralia3.7%7–9CACanada2.8%7–9PKPakistan2.8%7–9KRSouth Korea2.8%10ITItaly2.3%

Share of the 10% most cited papers, 2021–2025; 2,967 papers. Source: OpenAlex, pulled 18 October 2026. Method

Year by year

Share of the 10% most cited papers published in each year. Source: OpenAlex, pulled 18 October 2026. Method

Inside the field

Always the top 10%Pilot

Each paper sorted into one sub-area by an AI model reading its title and abstract, then credited as usual. On 200 hand-labelled papers it chose the same sub-area, or a defensible second, 92% of the time.

Sub-area	Papers	First	Second	Third
Network intrusion detection methods and datasets	757	CNChina15.9%	INIndia15.9%	SASaudi Arabia7.2%
Intrusion detection for IoT and industrial IoT	708	INIndia15.7%	SASaudi Arabia11.6%	CNChina11.1%
Malware and software-vulnerability detection	418	CNChina17.6%	INIndia10.5%	SASaudi Arabia8.9%
Smart grid, industrial control and cyber-physical security	333	CNChina17.0%	USUnited States12.2%	INIndia8.7%
Threat surveys, AI for security and organisational resilience	317	USUnited States14.8%	SASaudi Arabia8.0%	INIndia5.9%
Federated and privacy-preserving intrusion detection	181	CNChina25.7%	INIndia7.1%	SASaudi Arabia7.1%
Vehicle and transport network security	155	CNChina19.4%	KRSouth Korea11.4%	INIndia8.9%
Zero trust, access control and security architecture	83	CNChina18.2%	USUnited States16.3%	AUAustralia10.0%

Share of each sub-area's papers in the top 10%. Source: OpenAlex, pulled 18 October 2026. Method

Earlier and recent

The same top 10%, split into 2021–2023 and 2024–2025.

FallingRising2021–20232024–2025Change

CNChina 14.3%15.1%+0.8 pts

INIndia 11.8%12.1%+0.3 pts

SASaudi Arabia 7.3%9.2%+1.9 pts

USUnited States 7.2%7.9%+0.6 pts

GBUnited Kingdom 3.5%4.0%+0.4 pts

AUAustralia 5.5%2.3%−3.2 pts

CACanada 3.6%2.2%−1.4 pts

PKPakistan 3.3%2.5%−0.8 pts

Share of the 10% most cited papers: 1,289 papers in 2021–2023, 1,678 in 2024–2025. Source: OpenAlex, pulled 18 October 2026. Method

2026 so far: a different count

Not the most cited papers: every 2026 paper matched so far (10,491), and a paper counts in full for each country on it. This year's papers are too new to rank by citations, so these shares cannot be compared with the ones above.

INIndia15.3%of 2026 papers have an author here
CNChina7.4%of 2026 papers have an author here
USUnited States7.3%of 2026 papers have an author here
SASaudi Arabia4.3%of 2026 papers have an author here
IDIndonesia3.3%of 2026 papers have an author here

Who cites the top papers

How much more often a country's top papers are cited from home than its size predicts. Expected is the country's share of all papers in the field; the bar is the excess, in percentage points. Home citers include authors citing their own earlier work.

HomeExpectedExcess

CNChina 36.5%11.3%+25.2

INIndia 34.6%15.8%+18.8

SASaudi Arabia 11.5%5.6%+5.9

USUnited States 14.9%9.7%+5.2

GBUnited Kingdom 8.5%3.9%+4.6

Based on up to 100 of each country's most cited single-country papers in the top 10%. Source: OpenAlex, pulled 18 October 2026. Method

Behind the share

Institutions with the most credit

1INVellore Institute of Technology University0.9%
2SAKing Saud University0.9%
3SAKing Abdulaziz University0.8%
4AUDeakin University0.7%
5JOAl-Ahliyya Amman University0.6%
6SAKing Faisal University0.5%
7CNBeijing University of Posts and Telecommunications0.5%
8AUThe University of Queensland0.5%
9SAPrincess Nourah bint Abdulrahman University0.5%
10SAPrince Sattam Bin Abdulaziz University0.4%

Share of the top 10%. Institutions across all 45 technologies

Who does the work

Sector	All	CN	IN	SA
Universities	94.5%	91.7%	98.1%	98.9%
Research facilities	2.2%	3.9%	0.7%	0.5%
Companies	1.5%	2.1%	0.5%	0.5%
Government labs	1.0%	1.8%	0.7%	0.1%

Share of credit by type of institution, overall and for the three leading countries.

Across borders

41.3% of the top 10% have authors in more than one country.

PKSAPakistan with Saudi Arabia91
INSAIndia with Saudi Arabia78
CNSAChina with Saudi Arabia56
GBSAUnited Kingdom with Saudi Arabia56
SAUSSaudi Arabia with United States56

Most frequent pairings, by number of shared papers.

The papers behind the numbers

The five most cited papers this definition catches. If one looks out of place, the definition needs work.

Edge-IIoTset: A New Comprehensive Realistic Cyber Security Dataset of IoT and IIoT Applications for Centralized and Federated Learning
IEEE Access, 2022AUDZGB
1,190citations
A Comprehensive Review of Cyber Security Vulnerabilities, Threats, Attacks, and Solutions
Electronics, 2023TR
742citations
A comprehensive review study of cyber-attacks and cyber security; Emerging trends and recent developments
Energy Reports, 2021CN
729citations
A new distributed architecture for evaluating AI-based security systems at the edge: Network TON_IoT datasets
Sustainable Cities and Society, 2021AU
725citations
Deep Reinforcement Learning for Cyber Security
IEEE Transactions on Neural Networks and Learning Systems, 2021AUUS
610citations

How this technology is defined

A paper counts if its title or abstract matches the search below. Articles in core journals and proceedings only; retracted papers are excluded.

"intrusion detection" OR malware OR "vulnerability detection" OR "zero trust" OR "cyber attack" OR ransomware

and its main topic in OpenAlex is one of: Network Security and Intrusion Detection; Advanced Malware Detection Techniques; Smart Grid Security and Resilience; Information and Cyber Security; Security in Wireless Sensor Networks; Spam and Phishing Detection; Security and Verification in Computing; Web Application Security Vulnerabilities; Access Control and Trust; Cybersecurity and Cyber Warfare Studies; Digital and Cyber Forensics; Advanced Authentication Protocols Security; Cloud Data Security Solutions. The topic check removes papers that only mention the technology.

Papers matched, 2021–2025: 29,647
In the top 10%: 2,967
In the top 1%: 300
Countries with credit: 104
Credit with no known country: 6.9%

Every one of the 3,337 most cited papers was checked for relevance; 5 were left out as not about cybersecurity

The most cited of those left out:

The hidden threat of cyber-attacks – undermining public confidence in government93 citations
A Gaussian process regression approach to predict the k-barrier coverage probability for intrusion detection in wireless sensor networks87 citations
Comparative analysis of CatBoost, LightGBM, XGBoost, RF, and DT methods optimised with PSO to estimate the number of k-barriers for intrusion detection in wireless sensor networks78 citations
An improved high performance clustering based routing protocol for wireless sensor networks in IoT73 citations
Resiliency of forecasting methods in different application areas of smart grids: A review and future prospects34 citations

3 catalogue records left out: their titles or citation dates do not match the paper

Intrusion Detection Systems: A Survey and Taxonomy234 citations. 52% of citations predate the paper by 2+ years
Machine Learning in Network Intrusion Detection: A Cross-Dataset Generalization Study88 citations. The arXiv number on this record, 2402.10974, belongs to a different paper.
Sovereign Byte Firewall: Comparing Transformer and Mamba-2 Backbones for Tokenization-Free Zero-Day Network Anomaly Detection76 citations. The arXiv number on this record, 2405.21060, belongs to a different paper.

Definition version 0.5, pilot. It is a plain text file: copy it, change it, rerun it.

Read the method