## 2 Related Works
### Intrusion Detection  
[PERSON] et al. [31] considered several types of deep learning systems for network attack detection, including supervised and unsupervised models, and they compared the efficiency and effectiveness of different attack detection methods using two intrusion detection datasets: the \"KDD Cup 99\" dataset and an improved version known as NSL-KDD [32, 33]. These two datasets have been used widely in the past by academic researchers; however, they do not fairly represent modern network traffic analysis problems due to concept-drift. Networks have increasing numbers of connected devices, increasing communications per second, and new applications using the network. The use of computer networks and the Internet has changed substantially in twenty years. The continued introduction of IPv6, network address translation, Wi-Fi, mobile 5G networks, and cloud providers has changed network infrastructure [34]. Furthermore, the Internet is now increasingly used for financial services. Akamai [35] reported that financial services now see millions or tens of millions of attacks each day. These attacks were less common twenty years ago. Furthermore, social media now constitutes much internet traffic and most social media platforms were founded after the KDD Cup 99 and NSL-KDD datasets were introduced. For example, Facebook, YouTube, and Twitter were founded in 2004, 2005, and 2006, respectively. This limits the validity of some research using outdated datasets. Therefore, we suggest research should use modern datasets that represent modern network traffic. [PERSON] et al. [36] analysed intrusion detection systems (IDS) that use a machine learning approach. They specifically considered the datasets used, the ML algorithms, and the evaluation metrics. They warned that some researchers are still using datasets first introduced decades ago (e.g., KDD Cup 99, NSL-KDD). They warned that this trend could result in no or insufficient progress on IDS. This would ultimately lead to the untenable position of obsolete IDS while intrusion attacks continue to evolve along with user behaviour and the introduction of new technologies. Their paper did not consider adversarial examples or robustness of ML models. [PERSON] and [PERSON] [37] tabulated a list of network intrusion datasets in the literature that we extend in Table 1. \begin{table}
\begin{tabular}{l l l l l} \hline \hline
**Work** & **Dataset** & **Network** & **Year** & **Attack Categories** \\ \hline
[32] & KDD Cup 99 & Traditional & 1999 & DoS, Probe, User 2 Root and Remote to User \\
[38] & NSL-KDD & Traditional & 2009 & DoS, Probe, User 2 Root and Remote to User \\
[39] & DARPA & Traditional & 2009 & DDoS, Malware, Spambolos, Scans, Phishing \\
[40] & CTU-13 & Traditional & 2011 & Botnet \\
[41] & Kyoto & Traditional & 2015 & Botnet \\
[42] & UNSW-NB15 & Traditional & 2016 & Backdoors, Fuzzers, DoS, Generic, Shell code, Reconnaissance, Worms, Exploits, Analysis \\
[43] & WSN-D5 & Wireless & 2016 & Greyhole, Blackhole, Scheduling, Flooding. \\
[44] & SDN Traffic & SDN & 2016 & DDoS \\
[45] & CICIDS2017 & Traditional & 2017 & DoS, SDLoS, SSH-Patator, Web, PortScan, FTP-Patator, Bot. \\
[46] & Hirai & IoT & 2017 & Botnet \\
[45] & CICIDS2018 & Traditional & 2018 & Bruteforce Web, DoS, DDoS, Botnet, Infiltration. \\
[46] & CICIDoS2019 & Traditional & 2019 & DDoS \\
[47] & Bot-IOT & IoT & 2018 & DDoS, DoS Service Scan, Keylogging, Data exfiltration \\
[48] & Kitsune & IoT & 2018 & Recon, Man in the Middle, DoS, Botnet Malware \\
[49] & IEEE BigData Cup & Traditional & 2019 & N/A \\
[50] & HIKARI-2021 & IoT & 2021 & Brute force attack, Brute force attack (XMLRPC), Vulnerability, probing, Synthetic Traffic \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Datasets used in the literature. [PERSON] et al. [51] considered adversarial machine learning for intrusion detection and malware scenarios, noting that IDS are typically signature-based, and that machine learning approaches are being widely employed for intrusion detection.