# Machine-Learning-Enabled Intrusion Detection System for Cellular Connected UAV Networks
## 2 Background and Related Works
### Related Works
#### 2.2.1 Related Works for CSE-CIC-IDS2018 Dataset  
This section summarizes the research that has been done that leverages the CSE-CIC-IDS2018 dataset to employ machine learning techniques. It also gives a quick review of the main machine learning techniques and demonstrates how the CSE-CIC-IDS2018 dataset can be used to evaluate and test different types of machine learning methods. To detect network intrusion traffic and identify attack types, the authors of [41] used a variety of deep learning frameworks. For training and testing, ten-fold cross-validation with an 80-20 or 70-30 split was utilized. The main drawback of this study is the use of only one classifier. In [42], the authors analyzed how well the results of an intrusion detection dataset can be generalized by integrating both CIC-IDS-2017 and CIC-IDS-2018. The authors employed 12 supervised learning algorithms from various families to assess performance. The assumption that some categorical characteristics, such as destination port, have the same number of unique values in both datasets is a shortcoming of this study. This study presents a taxonomy of deep learning intrusion detection models as well as a summary of pertinent research publications. The KDD Cup 1999 [43], NSL-KDD [44], CICIDS2017, and CICIDS2018 datasets were then used to test four deep learning models (feed-forward neural network, auto encoder, deep belief network, and LSTM). The usage of KDD Cup 1999 and NSL-KDD, both of which are outdated and have recognized faults, is one of the study's drawbacks. The biggest issue with KDD Cup 1999 is a large number of duplicate records [44]. NSLKDD is a better variant that avoids the problem of duplicated instances, although it is still far from ideal. For instance, in the NSL-KDD test dataset, some attack classes have no records. In [45], to detect Botnet attacks, the authors trained a two-layer MLP using Python and Scikit-learn. The AUC for this study was one, which is a perfect score. All of the related accuracy, precision, and recall ratings were perfect. The article is four pages in length (with two references), and there is a noticeable lack of depth. Another disadvantage is that it used just one classifier to evaluate the performance. In [46], the authors used DoS datasets from the KDD Cup 1999 and CIC-IDS-2018 to train a CNN. Python and Tensor Flow were used to create the model. The train-to-test ratio was 70-30 for both datasets. The authors employed around 283,000 samples in KDD and approximately 11,000,000 in CIC-IDS-2018. The use of the KDD Cup 1999 dataset, which, as previously mentioned, is an older dataset with a significant number of redundant instances. This is one of the fundamental flaws of the KDD Cup 1999 dataset. Some papers [47] used outdated datasets to evaluate the IDS system using machine learning such as KDD Cup 1999, NSL-KDD, and ISCX2012. These datasets are obsolete, with a huge number of redundant occurrences compared to the rapid development of new types of network technologies and introduction of newer cybersecurity attacks. Several recent research papers detect IDS and malware utilizing various ML techniques. One ofthem is [48], which proposed a multi-dimensional feature fusion and stacking ensemble mechanism (MFFSEM) machine learning in Network IDS to detect anomalous behaviors. They used their proposed scheme on multiple feature datasets to achieve global multi-dimensional anomaly detection model in the real world. They claimed that their scheme is superior to other ensemble approaches; however, they used old datasets such as KDD Cup 99, NSL-KDD, UNSW-NB15, and CIC-IDS2017. They also did not include decision-tree-pruning methods or optimal feature selection strategies. The authors in [49] proposed ensemble-based classification using stacked ensemble of dense, convolutional neural networks (CNN), and a meta-learner for malware detection in Windows Portable Executable (WinPE) small operating system. They used Classification of Malware with PE headers (ClaMP) dataset for this type of malware detection.