## 2 Related Works
### K-Nearest Neighbors  
The K-nearest neighbors algorithm (KNN) is a non-parametric supervised learning method. It is commonly used for classification and regression problems. KNN classifies unlabeled observations by assigning them to the class of the most similar labeled examples. The similarity is determined based on distance calculations between observations. The algorithm stores the data and identifies the nearest points based on their similarity to classify them into classes. The neighbors are obtained from a set of classes where the object properties are known. The KNN algorithm uses a positive integer, typically small, called K to determine the number of nearest neighbors considered for classification. For example, when K = 1, only the closest neighbor is considered for determining class membership. In regression tasks, the output value is the average of the K neighboring values. To ensure accurate results, it is important to normalize or standardize the dataset since KNN relies on distance calculations. KNN is widely utilized in developing intrusion detection systems (IDS) in computer networks, as seen in previous studies [38; 39; 40; 41; 42]. One of the key advantages of KNN is its simplicity and ease of understanding, making it suitable for small-scale or entry-level systems. It is also fast, efficient, and accurate, making it suitable for real-time intrusion detection. Additionally, KNN does not require extensive training or high computational resources, making it a cost-effective solution for intrusion detection. However, the performance of the KNN algorithm heavily relies on the quality of the training data. Outdated or irrelevant data can impact its effectiveness and may lead to incorrect classifications. KNN is a supervised learning algorithm used for both classification and regression tasks. It is a non-parametric method that makes predictions based on the similarity between input data points. The learning process of KNN involves the following steps:  
* Data Preparation: The training dataset consists of labeled examples, where each example is represented by a feature vector \(X\) and its corresponding class label \(y\). * Choosing the Value of \(k\): The value of \(k\), representing the number of nearest neighbors to consider, needs to be determined. Typically, \(k\) is chosen based on domain knowledge or through cross-validation. * Computing Distance: KNN utilizes a distance metric, such as Euclidean distance or Manhattan distance, to measure the similarity between feature vectors. Lets denote the distance metric as \(dist(x_{1},x_{2})\), where \(x_{1}\) and \(x_{2}\) are two feature vectors. * Finding \(K\) Nearest Neighbors: Given an input data point \(x\), the distances between \(x\) and all data points in the training set are computed. The \(k\) nearest neighbors of \(x\) are selected based on the smallest computed distances. Lets denote the set of \(k\) nearest neighbors as \(N(x)\). * Voting or Averaging: For classification tasks, KNN employs majority voting to determine the class label of the input data point. It assigns the class label that is most frequent among the class labels of the \(k\) nearest neighbors in \(N(x)\). Mathematically, the predicted class label for \(x\), denoted as \(y_{pred}\), is given by: \[y_{pred}=argmax(\sum(y_{i}\in N(x))I(y_{i}))\] (8) where \(y_{i}\) represents the class label of the \(i\)th neighbor in \(N(x)\), \(I(*)\) is the indicator function, and \(argmax(*)\) returns the class label with the highest count. For regression tasks, KNN takes the average of the target values of the \(k\) nearest neighbors to make a prediction. Mathematically, the predicted value for \(x\), denoted as \(y_{pred}\), is given by: \[y_{pred}=(1/k)\sum(y_{i}\in N(x))y_{i}\] (9) where \(y_{i}\) represents the target value of the \(i\)th neighbor in \(N(x)\). * Handling Ties: In cases where there is a tie in the number of votes for different classes during majority voting, various strategies can be employed.