## 3 The Proposed IDS Framework  
The proposed IDS framework is shown in Figure 1. This architecture includes four steps. The first step is to preprocessing from the original dataset. The second step is to generate feature subsets by SFS. Then, accuracy and error scores are measured corresponding to each subset generated based on a machine learning model. This machine learning model is Decision Tree (DT). In this work, the task of DT is to predict accuracy and loss scores for each combined feature. After that, the best feature subset is chosen based on the maximum accuracy score. In the third step, IDS classifiers are built for learning the best-selected subset feature data. The final step is to evaluate various IDS RNNs models based on two things. The first task is the comparison with other IDS classifiers. The second is measurement memory profilers of the proposed models. **Preprocessing dataset**. This is the first step in the IDS framework. In ISCX dataset, XML files with data labeled as input data are chosen. Then, the following procedures are performed: (1) converting XML files to CSV files; (2) splitting *.CSV files data into training and testing data. In NSL-KDD dataset, the NULL values are solved by using imputation technique. This technique is used to replace missing data with substituted value. **SFSDT model**. The purpose of this component is to select the best feature subset from the complete feature set from the original datasets. In mathematics, given a feature set \(x=x_{i}|i=1\ldots n\), find a subset \(x_{m}=x_{i_{1}},x_{i_{2}},\ldots,x_{i_{m}}\) with \(m<n\), that optimizes an criterion function (CF), ideally the probability of correct classification (see Figure 2). Figure 1: The proposed IDS framework. The first goal of the presented feature selection algorithms is to reduce the feature space \(D=x_{1},x_{2},\ldots,x_{n}\) to a subset of features \(D_{n}\) in order to improve or optimize the computational performance of the classifier and avoid the curse of dimensionality. The second goal is to select a sufficiently reduced subset from the feature space \(D\) without significantly reducing the performance of the classifier. An optimal feature subset of size \(m\) is chosen by \(CF\). \(CF\) is typical, simply, and intuitively assesses the recognition rate of the classifier. This work proposes a model feature selection by hybrid SFS algorithm and DT model because of some reasons as follows. SFS [29] is the simplest greedy search algorithm which is a bottom-up search procedure. SFS starts with an empty feature subset and sequentially adds features from the whole input feature space to this subset until the subset reaches a desired (user-specified) size. For every iteration which is the inclusion of a new feature, the whole feature subset is evaluated which is expected for the features that are already included in the new subset. The evaluation is done by the so-called CF which assesses the feature that leads to the maximum performance improvement of the feature subset if it is included. Besides, DT [30] is a classical and well-known in the machine learning model. DT model has the main different somehow is about the domain of application. While some models like KNN (K-Nearest Neighbour), SVM etc. are used for continuous value input, DT is applicable for continuous and categorical input (discrete values) with high accuracy classification. In NSL-KDD and ISCX datasets, the input features are discrete values. Besides, NSL-KDD data contains multi-output values (with four attack types). The DT model can handle a multi-output problem. In the proposed method, this work adjusted and replaced a simple CF function in SFS algorithm by accuracy and error scores of DT model on each feature subset is generated by SFS. Based on the accuracy and error scores, this proposed method can decide and choose the best feature subset from the original feature set. In summary, the goal of SFSDT is a feature selection based on the learning model.