# Smart Attacks Learning Machine Advisor System for Protecting Smart Cities from Smart Threats
## 2 Related Work  
There are several attempts to help enhance the performance of various IDS(s) by utilizing Machine Learning, deep learning, and hybrid learning. This section discusses some recent research studies that propose an anomaly-based IDS and that use the NSL-KDD benchmark dataset to evaluate their proposed systems. Later, in the study, we compare our approach with these studies and show that our policy enhances them and achieves better results on the NSL-KDD benchmark dataset. [PERSON] et al. [15] used the NSL-KDD Dataset to train a Deep Neural Network (DNN) for flow-based anomaly detection in a Software-Defined Networking (SDN) model for IDSs [14]. They constructed a fundamental DNN consisting of three hidden layers, an input layer, and an output layer. They employed just six characteristics from the dataset provided as an input of six neurons, including protocol type, src bytes, count, dst bytes, and srv count. These features include fundamental and traffic-based features that may be readily accessed in SDN setups. The binary classifier is the model's output. The neurons in the hidden layers are 12, 6, and 3. The batch size is set to 10 and the epoch is set to 100 in the model start parameters. The results of the experimentations achieved an accuracy of 75.75%. [PERSON] et al. [16] used DNN for IDSs in SDNs, which determined the most appropriate hyperparameters and network configurations in the DNN, and achieved 75.9% accuracy. [PERSON] et al. [17] presented the Localized Evolving Semi-Supervised Learning Based Anomaly Detection Scheme, called LESLA. Offline and online training were combined using semi-supervised learning in contrasting pessimistic likelihood estimation (CPLE) to allow self-evolution during anomaly detection. Hence, the self-training applies a hard label to the unlabeled data, causing the model to worsen, and increasing misclassification. Unlabeled data are soft-labeled in CPLE-based models. The model was trained using 500 labeled data and 120,000 unlabeled data, semi-supervised. Using NSL-KDD, the suggested system's accuracy is 80.93% when all of the dataset's features are used, and 77.26% when just six features are used. [PERSON] et al. [18] applied ML techniques in SDN architecture to suggest a flow-based anomaly detection solution in the OpenFlow controller. Some feature selection approaches, including the Chi-squared test, Symmetric Uncertainty, CFS Subset Evaluator, Gain Ratio, and Info Gain, were used to treat the dataset to enhance the classifier performance. Their research is based on NSL-KDD, which has 41 characteristics. Except for the CFS Subset Evaluator, which extracted nine features, all feature selection techniques extracted 15 features. The reduced dataset is then put through a variety of classifiers (J48, Random Forest (RF), PART, Naive Bayes (NB), Decision Tree (DT), RBFN, and Bayes Net), while aggregating the results using 10-fold cross-validation. With the Gain Ratio for feature selection and RF for classification, this work achieved an accuracy of 82%. [PERSON] and [PERSON] [19] evaluated different measures of well-known anomaly-based intrusion detection techniques. They concentrated on supervised ML algorithms that employ the following classifiers: RF, DT, NB, ELM, Support Vector Machines (SVM), K Nearest-Neighbor (KNN), NN, Linear Discriminant Analysis (LDA), Bagging Trees, LogitBoost, RUSBoost, and AdaBoost. They used the well-known NSL-KDD benchmark dataset. By focusing on just six SDN features, they utilized Principal Component Analysis (PCA) to de-dimensionalize the data. The most significant results were obtained while using Decision Tree, which has an accuracy of 83.24% and an f-score of 89.38%. [PERSON] et al. [20] presented a method for detecting intrusions into SDNs using a Gated Recurrent Unit Recurrent Neural Network (GRU-RNN). The Anomaly Mitigator, the Anomaly Detector, and the Flow Collector are the main components of this method. The Flow Collector module is invoked when a message contains a packet or when a timer function is called.