# Machine-Learning-Enabled Intrusion Detection System for Cellular Connected UAV Networks
## 4 ML Approaches to Detect Attacks
When the decision tree is built, a tree-pruning step can be applied to decrease the size of the decision tree. A decision tree model with many branches and leaves that is too large is known as overfitting [64]. * GNB: Another classification algorithm for binary (two-class) data is Naive Bayes, which is appropriate for multi-class classification problems. Initially, the Gaussian Naive Bayes classifier specifies the total number of classes and then computes the conditional probability for each dataset class. Then, for each feature, the conditional probability can be calculated. * SGD: A stochastic gradient descent algorithm uses regularized linear models with stochastic gradient descent. In an SGD method, one random point is considered while changing weights, in contrast to gradient descent, which takes into account all of the training data. When there is a huge number of datasets, stochastic gradient descent is the faster choice than gradient descent. * K-M: K-means clustering is classified as unsupervised learning, and it is used when data are unlabeled, such as data without definite categories or groups. The initial goal of this classifier is to find a cluster in the whole data that the number of clusters represents the variable named K. The algorithm iteratively performs until each data point is assigned to one of K clusters according to the features that are considered. In conclusion, data points are clustered based on the similarities that exist between features. In this paper, we use datasets from CSE-CIC-IDS 2018 on AWS, which provides a good understanding of intrusion configurations and characteristics. It is a collaborative project between Communications Security Establishment (CSE) and the Canadian Institute for Cybersecurity (CIC) that began in 2018 [29]. A systematic approach was used to generate the datasets for testing, analyzing, and evaluating the IDS considering the network-based anomaly detectors. It uses the profile concept to produce datasets in a systematic manner that gives comprehensive explanations of intrusions as well as abstract distribution modelsfor programs, protocols, or low-level network entities. It provides an extensive benchmark dataset for IDS that comprises representations of events and behaviors observed in the network. Individual operators may use these profiles for a diverse range of network protocols with different topologies to create network events because of the abstract nature of the profiles. The applied dataset has a complete description of intrusions for applications, protocols, or lower-level network entities and is widely used for test and evaluation of intrusion detection algorithms. The dataset consists of six different attack scenarios such as Botnet attack, HTTP denial of service, Collection of web application attacks, infiltration of the network attacks, brute force attacks, and DDoS attacks. A detail information on these attack scenarios can be found in [29]. It includes 6,437,330 normal records and 1,656,840 total attack records, while it has 20% test records and 80% training records. The complete illustration of attack distribution types within CSE-CIC- IDS2018 dataset is demonstrated in Table 1.