# Machine Learning for Network Intrusion Detection--A Comparative Study
## 3 Related Work  
Table 4 presents a list of similar studies and their key results. The studies are divided into two categories. The first category includes studies that use old datasets such as DARPA, KDD CUP '99, and NSL-KDD. For example, [PERSON] et al., 2020 [9] used the KDD-Cup dataset to study the performance of ML algorithms such as random forest, support vector machine, and Gaussian Naive Bayes to identify attacks. Their research concluded that the random forest model outperformed the other models by predicting each attack with 99.81% accuracy. As can be seen in Table 4, although many of these studies report very good results, they use datasets that are not representative of modern attacks and do not meet the criteria of a true intrusion detection dataset [15; 17]. Therefore, the ability of these approaches might be limited when detecting novel attacks as they have not been evaluated and have not achieved similar results regarding modern attack types. \begin{table}
\begin{tabular}{l l l l l} \hline \hline
**No.** & **Feature Name** & **No.** & **Feature Name** & **No.** & **Feature Name** \\ \hline
1 & Destination Port & 28 & Bwd IAT Std & 54 & AvgFwd Segment Size \\ \hline
2 & Flow Duration & 29 & Bwd IAT Max & 55 & AvgBwd Segment Size \\ \hline
3 & Total Fwd Packets & 30 & Bwd IAT Min & 56 & Fwd Header Length \\ \hline
4 & Total Backward Packets & 31 & Fwd FSH Flags & 57 & FwdAvg Bytes/Bulk \\ \hline
5 & Total Length of Fwd Packets & 32 & Bwd FSH Flags & 58 & FwdAvg Packets/Bulk \\ \hline
6 & Total Length of Bwd Packets & 33 & Fwd URG Flags & 59 & FwdAvg Bulk Rate \\ \hline
7 & Fwd Packet Length Max & 34 & Bwd URG Flags & 60 & BwdAvg Bytes/Bulk \\ \hline
8 & Fwd Packet Length Min & 35 & Fwd Header Len & 61 & BwdAvg Packets/Bulk \\ \hline
9 & Fwd Packet Length Mean & 36 & Bwd Header Length & 62 & BwdAvg Bulk Rate \\ \hline
10 & Fwd Packet Length Std & 37 & Fwd Packets/s & 63 & SubflowFwd Packets \\ \hline
11 & Bwd Packet Length Max & 38 & Bwd Packets/s & 64 & SubflowFwd Bytes \\ \hline
12 & Bwd Packet Length Min & 39 & Min Packet Length & 65 & SubflowBwd Packets \\ \hline
13 & Bwd Packet Length Mean & 40 & Max Packet Length & 66 & SubflowBwd Bytes \\ \hline
14 & Bwd Packet Length Std & 41 & Packet Length Mean & 67 & Init\_Win\_bytes\_forward \\ \hline
15 & Flow Bytes/s & 42 & Packet Length Std & 68 & Init\_Win\_bytes\_backward \\ \hline
16 & Flow Packets/s & 43 & Packet Length Variance & 69 & act\_datapktfwd \\ \hline
17 & Flow IAT Mean & 44 & FIN Flag Count & 70 & min\_seg\_size\_forward \\ \hline
18 & Flow IAT Std & 45 & SYN Flag Count & 71 & Active Mean \\ \hline
19 & Flow IAT Max & 46 & RST Flag Count & 72 & Active Std \\ \hline
20 & Flow IAT Min & 47 & PSH Flag Count & 73 & Active Max \\ \hline
21 & Fwd IAT Total & 48 & ACK Flag Count & 74 & Active Min \\ \hline
22 & Fwd IAT Mean & 49 & URG Flag Count & 75 & Idle Mean \\ \hline
23 & Fwd IAT Std & 50 & CWE Flag Count & 76 & Idle Std \\ \hline
24 & Fwd IAT Max & 51 & ECE Flag Count & 77 & Idle Max \\ \hline
25 & Fwd IAT Min & 52 & Down/Up Ratio & 78 & Idle Min \\ \hline
26 & Bwd IAT Total & 53 & Average Packet Size & 79 & Label \\ \hline
27 & Bwd IAT Mean & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 3: The features and the network parameters of the CICIDS-2017 dataset. The second category of studies includes those that have used the same dataset that we use in our work (i.e., the CICIDS-2017 dataset). For instance, [PERSON] et al., 2020 [32] focused on evaluating the performance of different supervised machine learning algorithms using a reduced CICIDS-2017 dataset. They reported the highest accuracy of 99.87% using 22 relevant selected features. Other similar studies (e.g., [PERSON] et al., 2019 [29], [PERSON] et al., 2019 [30], [PERSON] et al., 2019 [10], and [PERSON] et al., 2019 [31]) also reported high accuracy using the CICIDS-2017 dataset. These studies used accuracy as the evaluation metric for this