# Ensemble Classifiers for Network Intrusion Detection Using a Novel Network Attack Dataset +
## 3 Literature Survey and Related Work  
Anomaly-based IDS was first introduced by [PERSON] in 1980 [45]. Since then, the topic of anomaly detection has been the subject of many surveys and review articles. Various researchers have applied ML algorithms and used different publicly available datasets for their research in order to achieve better detection results [46]. [PERSON] et al. [47] reviewed ML algorithms and their performance in terms of anomaly detection and discussed and explained the role of feature selection in ML-based IDSs. [PERSON] et al. [48] presented a structured review of the research on anomaly detection in different research areas and application fields, including network IDSs. [PERSON] [49] used the DARPA-Lincoln dataset to evaluate and compare the performance of four supervised ML classifiers in detecting four categories of attacks: denial of service (DoS), remote-to-local, probe, and user-to-root. Their results showed that the J48 classifier outperformed the other three classifiers (IBK, MLP, and naive Bayes [NB]) in prediction accuracy. In [50], [PERSON] et al. conducted an empirical study to evaluate a comprehensive set of ML classifiers on the KDD99 dataset to detect attacks from the four attack classes. [PERSON] et al. [51] tested the performance of three ML classifiers--J48, NN, and support vector machine (SVM)--using the KDD99 dataset and found that the J48 algorithm outperformed the other two algorithms. [PERSON] et al. [46] analyzed the NSL-KDD dataset and and used it to measure the effectiveness of ML classifiers in detecting anomalies in network traffic patterns. In their experiment, 20% of the NSL-KDD dataset was used to compare the accuracy of three classifiers. Their results showed that when correlation-based feature selection was used for dimensionality reduction, J48 outperformed SVM and NB in terms of accuracy. In [52], [PERSON] et al. checked the performance of four supervised ML classifiers--SVM, RF (random forest), LR (linear regression), and NB--on intrusion detection over the NSL-KDD dataset. The results showed that the RF classifier had 99% accuracy. In terms of feature selection, [PERSON] et al. [53] utilized different feature selection techniques to remove irrelevant features in a proposed IDS model. Their experiment indicated that the highest accuracy result could be achieved with only 17 features from the NSL-KDD dataset by using the C4.5 algorithm along with information gain. In [54], [PERSON] et al. applied a wrapper approach based on a genetic algorithm as a search strategy and logistic regression as a learning algorithm to select the best subset of features of the KDD99 and UNSW-NB15 datasets. They used three different DTclassifiers to measure and compare the performance of the selected subsets of features. Their results showed that they could achieve a high detection rate with only 18 features for KDD CUP 99 and 20 features for UNSW-NB15. [PERSON] et al. [55] also proposed an IDS framework with selection of features within the NSL-KDD dataset that were based on dividing the input dataset into different subsets and combining them using the information gain filter. The optimal set of features was then generated by adding the list of features obtained for each attack. Their experimental results showed that, with fewer features, the researchers could improve system accuracy while decreasing complexity. Besides selecting the relevant features that can represent intrusion patterns, the choice of ML classifier can also lead to better accuracy. Moreover, the literature suggests that assembling multiple classifiers can reduce false positives and produce more accurate classification results than single classifiers [56]. [PERSON] et al. [57] used REPTree as a base classifier and proposed a bagging ensemble method that provides higher classification accuracy and lowers false positives for the NSL-KDD dataset. [PERSON] et al. [58] suggested a cluster-based ensemble IDS model based on the ADTree and KNN algorithms.