## 2 Literature Review
### ML-Based IDS Studies
They used a hybrid neural network and decision a decision classifier. In this study, KDD datasets and the min-max method were used for normalization. The highest detection rate, evaluated using WEKA, was 0.98. In addition, [PERSON] et al. [20] proposed an IDS model using a pipeline for feature selection, normalization, and SVM. They used feature selection as an information gain (IG) filter. They selected 17/41 features from the NSL-KDD dataset. The overall accuracy evaluated by WEKA was 0.99; it showed a training time of 56.603 s and a testing time of 2.094 s. These studies showed high performance in terms of classification accuracy. However, the dataset used is outdated. Therefore, new dataset options must be identified to represent new attacks. In addition, [PERSON] et al. [21] evaluated the performance of several ML algorithms (linear regression, support vector machine, decision tree, random forest, artificial neuron networks, K-nearest neighbor, bagging, boosting, and stacking) on the CICIDS2017 and UNSW-NB15 datasets using 10-fold cross-validation with the information gain ratio to select the top 25 highly relevant features. The study reported that the proposed method can efficiently identify IoT cyber-attack threats in a smart city. The stacking ensemble model showed a better result than comparable models for detecting cyber-attacks in smart city systems. The authors' approach to the performance achieved 0.96 accuracy, 25.6 s training time, and 5.70 s testing time. [PERSON] et al. [22] reported that APT attacks can be detected using ML. Furthermore, the models can be trained using a record of the network's traffic. The authors used the NSL-KDD dataset to train the ML models. They used 10-fold cross-validation to test the models. The ML models they used included the C5.0 decision tree, Bayesian network, and deep learning to classify APT attacks. Deep learning yielded the best results among the classification models (0.98 accuracy). However, using the NSL-KDD dataset for an APT attack is inefficient due to the lack of attacks and stages that represent the nature of APTs. [PERSON] et al. [23] designed a network based on network flow to detect command and control channels. These are used to control the host from a distance in order to steal and spy on the network. The authors reported that APT attacks are similar when it comes to intrusion tools and services, which could help find unknown malware due to hidden shared attributes. To identify hidden attributes, the authors used deep learning methods for mining. Subsequently, they trained and tested several classifier detection performances on the Contagio blog malware database. They found that their method of detecting unknown malicious network flows using gradient-boosted decision trees showed the highest result (reaching 0.968 F-1 scores). [PERSON] and [PERSON] [24] analyzed APT attacks using network traffic logs. They reported that using an ensemble of classifiers and the majority voting method can yield better results for stealthy APT attacks. The authors trained and tested an ensemble of support vector machine, RF, and decision tree classifiers and found that the proposed ensemble of classifiers showed a 0.90 detection accuracy. Nevertheless, they did not focus on the privacy perspective using synthetic datasets isolated from private systems. Moreover, collecting APT attacks requires several months of recording and storage [25]. CTGAN can solve privacy and storage limitations. In addition, [PERSON] et al. [26] proposed a dataset focused on an APT attack called DAPT2020, which collected a dataset using a real-world network and attackers to capture multistage and different attack vectors. They then used semi-supervised learning to benchmark anomaly detection performance. However, it is important to include IoT network attacks and focus on classification time and accuracy. Moreover, using deep learning generators can improve the balancing of instances and is less expensive when collecting datasets. [PERSON] et al.