## 2 AI Techniques in Communication Networks
### Machine Learning and Deep Learning in Network Applications
#### 2.1.1 Supervised Learning  
Supervised learning is one of the most widely used techniques in network applications. In this paradigm, algorithms are trained on labeled data, where the desired output is known, allowing the model to learn the relationship between input features and the output [32]. In the context of network security, supervised learning has shown remarkable success in detecting and mitigating various types of attacks. For example, supervised models can be trained to recognize patterns of normal and malicious behavior in network traffic, enabling the identification of threats such as Denial of Service (DoS) attacks, Distributed Denial of Service (DDoS), and malware infections. Several general types of networks in supervised learning are employed in security tasks. These include feedforward neural networks, Support Vector Machines (SVMs), and ensemble methods, which are all capable of classifying network traffic and identifying anomalies. These models are trained on labeled datasets of normal and malicious traffic, where the goal is to generalize well to unseen data. For instance, feedforward networks are often used for binary classification tasks, such as distinguishing between benign and malicious traffic, while ensemble methods, like random forests, improve accuracy by combining multiple models' predictions. In contrast, SVMs are highly effective in cases where the data are not linearly separable and can provide robust performance with smaller datasets. Convolutional Neural Networks (CNNs) are a type of supervised learning model primarily known for their superior performance in image processing tasks [25]. However, CNNs have also proven to be highly effective for network intrusion detection. Their ability to automatically extract hierarchical features from raw network traffic data makes them well suited for identifying patterns of normal and malicious behavior [26]. For example, CNNs can be trained to detect various types of attacks such as DoS and DDoS by analyzing packet data [33]. The CNN's ability to capture complex patterns in high-dimensional data enhances the accuracy of detection systems while minimizing false positives. On the other hand, Decision Trees (DTs) are also commonly employed in network applications such as traffic classification [34]. Decision trees work by recursively splitting the data based on feature values, forming a tree structure where each node represents a decision based on an attribute [35]. This makes decision trees efficient and interpretable, which is an essential feature in network monitoring, where understanding the model's decisionmaking process is crucial for troubleshooting and improving security measures [36]. They are particularly useful for classifying network traffic into different categories (e.g. web browsing, file transfers, etc.) and identifying patterns that might indicate abnormal behavior or congestion [32]. Table 1 provides a benchmark comparison of CNNs and decision trees in terms of performance, showing their accuracy and computational efficiency in network security tasks. The results presented in Table 1 highlight significant differences in the performance and computational efficiency of CNNs and DT models within network intrusion detection applications:  
* Accuracy and Precision: CNNs exhibit superior accuracy (99%) and precision (98%), suggesting their effectiveness in correctly identifying legitimate and anomalous network activities. This high precision is particularly valuable for minimizing false positives, which is crucial to maintain reliable network performance and security. In contrast, DT models, with lower accuracy (93%) and precision (88%), may be more prone to misclassifications, although they remain effective in scenarios where high interpretability is prioritized over absolute precision [38]. * Recall and F1 score: CNNs show strong recall (97%) and F1 score (98%), indicating consistent and balanced performance in various classes, including different types of attacks.