## 2 Related Works
### Support Vector Machine  
Support Vector Machine (SVM) is a widely utilized supervised learning approach for regression problems [13]. It is commonly employed in machine learning for regression and classification tasks. The primary objective of SVM is to determine the optimal line and decision boundary that effectively separates classes in an n-dimensional space, enabling accurate categorization of new data points [14]. SVM constructs a hyperplane or a set of hyperplanes in a high or infinite-dimensional space, which can be applied to classification, regression, and outlier detection tasks [14]. The quality of separation achieved by SVM relies on the hyperplane that maximizes the distance to the nearest training data point from any class, also known as the functional margin. A larger margin leads to a lower generalization error, thereby improving the classifier's performance [14]. In the field of intrusion detection systems, SVM is widely employed. Studies have tested SVM on the KDD 99 dataset by varying the number of features [15] or by exploring different SVM kernel types to evaluate accuracy [16]. SVM has also been tested on the UNSW-NB15 dataset, comparing its performance with other binary and multi-class classification methods [17; 18]. Furthermore, SVM has been utilized with the CSE-CIC-IDS2018 dataset in work by [PERSON] et al. [19] and [PERSON] et al. [20]. Support Vector Machine (SVM) is a widely employed machine learning algorithm in intrusion detection systems. One of its key advantages is its ability to accurately classify complex and high-dimensionaldatasets, which is crucial for detecting unknown and evolving cyber threats. SVM is capable of handling both linear and non-linear data and can efficiently process large datasets. However, one of the drawbacks of SVM is the potentially time-consuming training process, particularly with large datasets. Additionally, the performance of SVM heavily relies on selecting appropriate parameters, which can pose a challenge. Moreover, the presence of irrelevant and noisy data can negatively impact the accuracy of intrusion detection using SVM [15; 20]. In summary, SVM is a popular machine learning algorithm used in intrusion detection systems. It demonstrates strong performance in accurately classifying complex datasets, but considerations should be given to training time, parameter selection, and the presence of irrelevant data to ensure effective intrusion detection. Support Vector Machines (SVM) is a supervised learning algorithm used for both classification and regression tasks. It aims to find the optimal decision boundary, known as the hyper-plane, that separates data points belonging to different classes in a high-dimensional feature space. Given a training dataset with labeled examples, the SVM learning process involves the following steps:  
**Feature Mapping**: If the data is not linearly separable in the input space, SVM uses a kernel function to map the input data into a higher-dimensional feature space. This allows for finding a linear decision boundary that can separate the classes in the transformed space. Margin Maximization: SVM aims to find the hyperplane that maximizes the margin between the support vectors, which are the data points closest to the decision boundary. The margin is the distance between the hyperplane and the support vectors. The larger the margin, the better the generalization performance of the SVM. **Soft Margin (C-parameter)**: In cases where the data is not perfectly separable, SVM allows for some misclassifications by introducing a regularization parameter called the C-parameter. This parameter controls the trade-off between maximizing the margin and minimizing the misclassification errors. A smaller C-value allows for a larger margin but permits more misclassifications, while a larger C-value reduces the margin to achieve better classification accuracy. **Optimization**: The SVM learning algorithm solves a constrained optimization problem to find the optimal hyperplane.