# Machine Learning for Network Intrusion Detection--A Comparative Study
## 3 Related Work
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline \multicolumn{4}{|c|}{**Non-CICIDS-2017-Based Studies**} \\ \hline
**No.** & **Study** & **Dataset Used** & **ML Techniques** & **Key Results** \\ \hline
1 & [PERSON] et al., 2013 [18] & KDD CUP ’99, DDoS dataset, NSL-KDD, TUIDS & Multi-level hybrid intrusion detection & 99.99\% detection rate \\ \hline
2 & [PERSON] et al., 2014 [19] & NSL-KDD & Naive Bayes, J48 & 99.88\% accuracy, 99.83\% specificity, 99.97\% sensitivity \\ \hline
3 & [PERSON] et al., 2016 [20] & KDD CUP ’99, NSL-KDD and Kyoto 2006+ & Least Square Support Vector Machine (LSSVM) & Accuracy of 99.79\%, 99.91\%, and 99.77\% for KDD CUP ’99, NSL-KDD, and Kyoto 2006+, respectively \\ \hline
4 & [PERSON] et al., 2017 [21] & KDD CUP ’99 & Deep Belief Network, Probabilistic Neural Network & Accuracy of 99.14\% and detection rate of 93.25\% \\ \hline
5 & [PERSON] et al., 2017 [7] & NSL-KDD & J48, ANN, RF, SVM, RNN of 97.09\% & Accuracy of 81.29, detection rate of 97.09\% \\ \hline
6 & [PERSON] et al., 2017 [22] & KDD CUP ’99 & DNN, SVM & Accuracy of 99.99\% \\ \hline
7 & [PERSON] et al., 2017 [23] & NSL-KDD & NB, SVM, MLP, DT rate & 90\% accuracy, 89.75\% detection rate \\ \hline
8 & [PERSON] et al., 2017 [24] & UNSW-NB15D & ANN & 98.99\% accuracy \\ \hline
9 & [PERSON] et al., 2018 [25] & KDD CUP ’99, NSL-KDD & GRU and LSTM & Detection rate of 99.42\% using KDD CUP ’99 and 99.31\% using NSL-KDD \\ \hline
10 & [PERSON] et al., 2018 [26] & UNSW-NB15 & DT, SVM, RF, NB & 97.49\% accuracy \\ \hline
11 & [PERSON] et al., 2019 [27] & KDD CUP ’99, NSL-KDD & NDNN & Accuracy of 99.9\% \\ \hline
12 & [PERSON] et al., 2019 [28] & NSL-KDD & SVM, NB & Accuracy of 97.29\% and misclassification of 2.7\% \\ \hline
13 & [PERSON] et al., 2020 [9] & KDD CUP ’99 & RF, SVM, GNB & 99.81\% accuracy \\ \hline \multicolumn{4}{|c|}{**CICIDS-2017-Based Studies**} \\ \hline
**No.** & **Study** & **Dataset Used** & **ML Techniques** & **Key Results** \\ \hline
14 & [PERSON] et al., 2019 [29] & UNSW-NB15, CICIDS-2017 & DNN, RF, GBT & 99.19 accuracy using UNSW-NB15, 99.99\% accuracy using CICIDS-2017 \\ \hline
15 & [PERSON] et al., 2019 [10] & CICIDS-2017 & Tree-based algorithms & 98.37\% accuracy \\ \hline
16 & [PERSON] et al., 2019 [30] & KDD CUP ’99, NSL-KDD, UNSW-NB15, WSNDS, CICIDS-2017 & Hybrid DNNs & Binary classification accuracy of 93.1\% using CICIDS-2017 \\ \hline
17 & [PERSON] et al., 2019 [31] & CICIDS-2017, CTU & CNN, LSTM & 99.8\% accuracy for CICIDS-2017 \\ \hline
18 & [PERSON] et al., 2020 [32] & CICIDS-2017 & Random Forest (RF), Bayes Net (BN), Random Tree (RT), Naive Bayes (NB), J48, and Feature Selection & Accuracy of 99.87\% \\ \hline
19 & [PERSON] et al., 2020 [12] & CICIDS-2017, UNSW-NB15, ICS & LR, GNB, KNN, DT, AdaB, RF, CNN, CNN-LSTM, LSTM, GRU, RNN, DNN & 0.99\% accuracy, precision, call, and F-score using RF and CICIDS-2017 \\ \hline
20 & [PERSON] et al., 2019 [33] & CICIDS-2017 & OneR, REPTree & Accuracy, 99.83\% specificity, 99.97\% sensitivity \\ \hline
21 & [PERSON] et al., 2021 [34] & CICIDS-2017 & ANN, DT, KNN, NB, RF, SVM, EM, K-means, and SOM & Over 99\% accuracy, precision, call, and F1-score \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Related studies. classification problem. However, accuracy is not the best metric for this intrusion detection problem because we are usually interested not only in making accurate predictions but also in ensuring that all types of attacks have a high detection rate, especially when using imbalanced datasets such as CICIDS-2017. The high accuracy of these models might be due to the correct prediction of benign traffic, which is the majority class in the CICIDS-2017 dataset. In contrast, our work uses different evaluation metrics that are appropriate for this intrusion detection problem and the nature of the CICIDS-2017 dataset. Table 4 lists studies 19, 20, and 21, which present interesting research and results, and each one deserves a separate comparison to our work. [PERSON] et al. [PERSON] et al.