# Internet of Drones Intrusion Detection Using Deep Learning
## 2 Related Work
### Hybridization of IDSs  
Below is a short overview of several noteworthy studies integrating various classification systems for intrusion detection, as given in Table 2. These systems used both machine learning and statistical models along with the two types of intrusion detection (signature-based IDSs and anomaly-based IDSs). For instance, [PERSON] and [PERSON] [41] selected Chi-square features to reduce the data dimension and find the optimal subset of all data attributes. The selected attributes were then used for multiclass SVM training. In addition, the authors of [42] introduced a two-stage hybrid IDS method integrating a SIDS with AIDS models in a hierarchical fashion. The C4.5 decision tree classifier was built on top of a SIDS. SVM was then used to split the subsets. Similarly, the authors of [43] proposed another hybrid method for detecting known and new attacks based on SVM. They tried to produce small and representative training datasets using a modified k-means method. The proposed approach reduces overall training time and improves the NIDS  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Paper** & **Findings** & \begin{tabular}{c} **Settings/** \\ **Environment** \\ \end{tabular} & **Feature Set** & \begin{tabular}{c} **Technique** \\ **Applied** \\ \end{tabular} & **Dataset** \\ \hline \multirow{4}{*}{[31]} & \multirow{4}{*}{Detection rate 94.7\%, False positive rate 2\%} & \begin{tabular}{c} Down-sampling/ \\ Oversampling 66\% training set/ \\ 34\% testing set \\ WEKA \\ \end{tabular} & 41 features from the TCP dump data & Random Forest & KDD’99 \\ \hline \multirow{4}{*}{[26]} & \multirow{4}{*}{\begin{tabular}{c} Execution time of the \\ proposed time is less than \\ other classifiers, GBDT \\ achieved (98.2 Pre. 97.4 \\ Recall, 97.8 F1) \\ \end{tabular} } & \begin{tabular}{c} 70\% training \\ set/30\% testing set \\ Spark2.2.0, \\ kafka2.11 \\ \end{tabular} & 13 features & \begin{tabular}{c} Distributed \\ Random Forest, \\ Gradient boosting \\ decision tree \\ (GBDT), multiclass \\ SVM and \\ Adaboost \\ \end{tabular} & \multirow{4}{*}{CICIDS2017} \\ \hline \multirow{4}{*}{[32]} & \multirow{4}{*}{RF-FSR: Accuracy 99.9\%} & Normalization/ & \multirow{4}{*}{41 features as the \
\begin{tabular}{c} \\ original KDD’99 \\ \end{tabular} } & \multirow{4}{*}{RF-FSR/RF-BER} & \multirow{4}{*}{
\begin{tabular}{c} Filtered version of \\ KDD’99 \\ \end{tabular} } \\  & & & & \\ \cline{1-1}  & & & & \\ \cline{1-1}  & & & & \\  
performance. Moreover, in [44], the k-means and decision trees model was utilized to detect abnormal and normal computer activity.  
Furthermore, the authors of [25] proposed a hybrid IDS combining C5.0 and one-class SVM. The model was evaluated using NSL-KDD and ADFA datasets. The findings revealed higher detection improvement and lower false alarm rates. With regard to basic classifiers (Naive Bayes, decision trees (C4.5), decision trees, and KNN approach), it is shown that the stacking group technique alone was able to reduce false alarm rates. However, it requires a long execution time. In [45], the authors combined the Average One-Dependence Estimator with a Random Forest ensemble classifier (AODE). The AODE addressed the problem of independence of the attribute due to the naive Bayes deficiency.