## 2 Literature Review
### ML-Based IDS Studies  
[PERSON] et al. [15] provided a lightweight ML-based IDS with a new feature selection algorithm implemented on Raspberry Pi. This feature selection algorithm, called correlated set thresholding on the gain ratio (CST-GR), was designed to select the necessary features and create fast classifiers. The CST-GR algorithm was run on the Bot-IoT dataset collected from an IoT environment and evaluated using the Weka tool. It concluded that the IDS is lightweight enough for implementation in IoT environment devices, such as Raspberry Pi, without compromising detection performance, and it has a 0.99 true positive rate (TPR), 8.61 s training time, and 0.81 s testing time. This study experimented in an environment that represents the IoT network; however, it did not consider or compare other options for feature selection evaluators. Unbalanced dataset statistics showed a significant gap between the attacks. [PERSON] et al. [16] proposed an IDS framework based on feature selection and ensemble classifiers. This study used CFS-BA to reduce dimensionality. It combines C4.5, RF, and forest by penalizing attribute (ForestPA) algorithms for detection accuracy when run on the NSL-KDD, AWID, and CIC-IDS2017 datasets. The research revealed that the proposed CFS-BA-ensemble feature selection technique with the ForestPA-ensemble classifier showed a stronger performance compared to related approaches. The authors' approach achieved an accuracy of 0.99 and 36.28 s training time on NSL-KDD, 0.99 accuracy and 92.62 s training time on AWID, and 0.99 accuracy and 98.42 s training time on CIC-IDS2017 datasets. [PERSON] et al. [17] suggested a structural design for an effective IDS for an IoT network of resource-constrained devices. They proposed two methods, semi-distributed and distributed, combined with preprocessing and feature selection methods to solve centralized IDS limitations for resource-constrained devices. The authors reported that applying the semi-distributed method to the AWID dataset achieved a detection accuracy of 0.99 and a long CPU time (186.26 s). In comparison, the distributed method achieved the lowest CPU time (73.52 s) with respect to building the model, with a detection accuracy of 0.97. The authors stated that further investigation using other representative dataset options and feature selection methods is required for a scalable ML-based IDS in IoT network environments. However, none of these studies focused on reducing model-building time using ML methods, such as feature selection or preprocessing, which is important for lightweight IoT devices. Moreover, the used datasets did not focus on IoT environments. Furthermore, [PERSON] and [PERSON] [8] attempted to identify the most appropriate feature evaluators for building an effective IDS. They studied four filter-based feature evaluation measures: consistency, correlation, information, and distance. They applied feature evaluators to different ML algorithms and ran them on NSL-KDD/UNSW-NB15 datasets. The authors reported that the random forest (RF) classifier yielded the best results with all feature evaluators. However, this study focused on a general network rather than an IoT network environment. Moreover, the detection performance is limited to a specific dataset depending on the features, and one cannot apply the ML model to other datasets [11]. Additionally, [PERSON] and [PERSON] [18] proposed an anomaly-based IDS using a hybrid algorithm of supervised and unsupervised learning schemes on the KDDcup99 dataset. The feature selection method integrated principal component analysis (PCA) with a support vector machine (SVM), selecting 10/41 features. The detection rate of the proposed method using PCA with fuzzy adaptive resonance theory (FART) was 0.97. However, KDDcup99 is already known as a general network attack dataset and does not focus on the IoT network environment. [PERSON] et al. [19] suggested a lightweight IDS for multiclass categorization. Feature selection is a wrapper-based genetic algorithm.