## 2 Related Works
### Linear Discriminant Analysis  
Linear Discriminant Analysis (LDA) is a multivariate technique used to classify individual observation vectors into predefined groups based on measurements [32]. Unlike cluster analysis, LDA is a supervised method that relies on a training dataset with pre-assigned groups. LDA, also known as [PERSON]'s linear discriminant, aims to find a linear combination of features that effectively distinguishes between classes of objects. It belongs to the analysis of variance family, where one independent variable is expressed as a linear combination of other features. LDA assumes that the features are independent variables for each observation. The goal of LDA is to create synthetic features, which are linear combinations of the original variables, that best capture the differences between known groups while minimizing the variances within the groups. By using statistical parameters, LDA constructs a boundary between the known classes of training objects. This boundary is defined by a discriminant function, which assigns a score or value to a test object, indicating the group to which the new object should be assigned [33]. LDA has been widely employed in intrusion detection research, particularly in studies using the KDD 99 [34; 35], UNSW-NB15 [36], and CSE-CIC-IDS2018 [37] datasets. These studies often compare the performance of LDA with other intrusion detection methods. The main advantage of using LDA for anomaly detection is its effectiveness in handling large datasets and achieving high accuracy. LDA can identify patterns in the data and make predictions based on these patterns, making it a powerful tool for anomaly detection. However, there are also some limitations to consider when using LDA for anomaly detection. One major drawback is that it requires a substantial number of features to be effective. This is because LDA is designed to work with multidimensional data, necessitating a sufficient number of features to capture all relevant patterns and relationships. Additionally, LDA can be sensitive to noisy data, which may lead to false positive anomalies. Linear Discriminant Analysis is a statistical method used for supervised classification problems. It aims to find a linear combination of features that maximizes the separation between predefined classes. The learning process of LDA involves the following steps:  
* Data Preprocessing: LDA requires a training dataset with predefined classes. The training dataset consists of feature vectors \(X\) and their corresponding class labels \(y\);
* Class-wise Summary Statistics: For each class in the training dataset, LDA computes class-specific summary statistics. These statistics include the mean vector \(\mu\) and the covariance matrix \(\Sigma\) of the features within each class;
* Between-class Scatter Matrix: LDA computes the between-class scatter matrix (\(SB\)), which measures the separation between different classes. It is defined as the sum of the outer products of the difference between class means and the overall mean, weighted by the number of samples in each class. \[SB=\sum(Ni(\mu_{i}-\mu)(\mu_{i}-\mu)^{T})\] (4) where \(Ni\) is the number of samples in class \(i\), \(\mu_{i}\) is the mean vector of class \(i\), mu is the overall mean vector. Within-class Scatter Matrix: LDA computes the within-class scatter matrix (SW), which measures the spread of the samples within each class. It is defined as the sum of the covariance matrices of each class, weighted by the number of samples in each class. \[SW=\sum(N\Sigma_{i}),\] (5) where \(\Sigma_{i}\) is the covariance matrix of class \(i\). * [PERSON]'s Criterion: LDA aims to find a projection that maximizes the separation between classes while minimizing the scatter within each class. This is achieved by computing [PERSON]'s criterion, which is the ratio of the determinant of SB to the determinant of SW. \[J(w)=(w^{T}SBw)/(w^{T}SWw),\] (6) where \(w\) is the projection vector.