## 2 Related Work
### Recent Works and Methods
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline \multicolumn{1}{c}{**Work**} & \multicolumn{1}{c}{**Dataset**} & \multicolumn{1}{c}{**FE**} & \multicolumn{1}{c}{**FS**} & \multicolumn{1}{c}{**DP**} & \multicolumn{1}{c}{**HS**} & \multicolumn{1}{c}{**ML**} & \multicolumn{1}{c}{**PM**} \\ \[PERSON] et al. [13] & KDDCup’99, NGIDS-DS & – & – & – & – & – & classical & A, TFR \\ [PERSON] et al. [15] & KDDCup’99 & – & proposed & – & – & classical & TFR \\ [PERSON] et al. [17] & CICIDS2017 & existing & existing & – & – & classical & F1, P, R \\ [PERSON] et al. [18] & BCF, NSL-KDD & proposed & – & normalization & manual & deep learning & A, F1 \\ [PERSON] et al. [19] & ISCX12, NSL-KDD & – & proposed & – & – & deep learning & A, TFR, ROC \\ [PERSON] et al. [20] & MAWI & proposed & – & manual & deep learning & O \\ [PERSON] et al. [12] & UCR’16 & proposed & mean, normalization & manual & statistical & AUC \\ [PERSON] et al. [21] & KDDCup’99 & – & existing & – & – & classical & F1, P, R \\ [PERSON] et al. [22] & NSL-KDD, NDN-NB15 & – & existing & – & – & other & A, TFR \\ [PERSON] et al. [3] & KDDCup’99, NSL-KDD,UNSW-NB15 & – & existing & mean & existing & classical & A, F1 \\ [PERSON] et al. [24] & UNSW-NB15 & – & – & – & – & classical & A, TFR \\ [PERSON] et al. [25] & KDDCup’99, NSL-KDD & – & proposed & – & – & classical & A, TFR, AUC \\ [PERSON] et al. [26] & CTU-13 & – & – & – & – & other & A, TFR, O, F1, P, R \\ [PERSON] et al. [27] & MAWI & proposed & proposed & normalization & existing, manual & other, classical & A, TFR, F1, P, R \\
**[PERSON] et al.** & **existing** & **normalization** & **existing** & **classical** & **F1, P, R, AUC** \\ \hline
**F Feature Engineering: existing (existing proposal), proposed (author’s proposal), DP (Data Pre-processing): mean, normalization. FS (Feature Selection): existing, proposed, manual. HS (Hyper-parameter Selection): existing, proposed. ML (Machine Learning): classical, deep learning, statistical, other PM (Performance Metrido: A (Accuracy), TFR (Tine Positive Rate), FP (False Positive Rate), TN (True Negative Rate) or FN (False Negative Rate)), F1, R (Recall), P (Precision), ROC, AUC, O (Others).** \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Methodology comparison for NIDS evaluation. A deep learning approach for network anomaly detection is introduced by [PERSON] et al. [18]. In this work, authors evaluated an LSTM (Long Short-Term Memory) neural network and BLS (Broad Learning Techniques) deep learning-based techniques for anomaly detection. In this sense, two network datasets were used: NSL-KDD and a BGP (Border Gateway Protocol)-based dataset. A manual HS process was carried out to select the optimal neural network architecture. On the other hand, a dataset normalization and a dummy FE approach were done as part of their methodology. Finally, they supported the BLS technique as a feasible alternative to sophisticated deep learning methods since it offered similar performance rates with less training time. Although this solution almost contemplated all the stages according to our recommended procedure, an important step such as FS was not taken into account and should not be eluded. A novel greedy FS approach was proposed in [19] to improve the attack detection classification performance in communication networks. NSL-KDD and ICSX12 datasets were considered to evaluate their proposal together with several deep learning and ML classical approaches. The authors concluded the feasibility of the approach in terms of classification performance and memory consumption. However, no FE, DP and HS steps were mentioned nor proposed in this work. A tool to enhance previously generated network datasets was introduced by [PERSON] et al. [20]: the I2 DT tool. I2 DT can add a diverse type of attacks to existing datasets, thus providing a useful tool that, as the authors claim, hardly reduces the time spent in building an adequate dataset for NIDSs evaluation.