# Applications of Machine Learning in Cyber Security: A Review
## 6 Shortcomings in Existing IDSs
### False Identification  
In every ML or AI approach, and particularly in classification tasks often used by IDS, the concepts of false positives and false negatives are crucial. These concepts are best understood in a binary classification example (Figure 11) where we attempt to identify \"malicious\" or \"benign\" activities in our monitored network. The real traffic implications of these errors in IDS were studied in [82], proposing mechanisms for their assessment. Data mining and machine learning strategies specifically aimed at reducing false positives in IDS have been explored in [83]. Further research discusses minimizing false positives through decision tree classifiers [84], while adaptive alert classification is used in [85] to improve the accuracy of distinguishing between true and false positives. Finally, the need for enhancing detection accuracy by reducing both false positives and negatives through multi-objective optimization techniques in IDS is presented in [86]. In IDS, a false positive (type I error) leads to unnecessary allocation of resources to investigate non-threatening activities, potentially leading to operational disruptions and alert fatigue, where users become desensitized to warnings [87; 52]. Several methods have been explored for the minimization of false positives in IDS, including optimization techniques [88]. Furthermore, these include hybrid approaches combining different detection methods [89], attack-specific methods [90], and ML [52]. On the other hand, a false negative (type II error) in IDS means that a real threat or malicious activity is not detected. The implications are more severe, as false negatives lead to unmitigated attacks, data breaches, and other security incidents [52], with various  
Figure 11: User perception of FN/FP in IDS and recommended resolutions. strategies investigated over the years [91, 92]. Recent approaches to reduce or mitigate false negatives include ML [93], attention mechanism-based algorithms [94], ensemble model approaches [95], and deep learning [96], among others. The distinction between false positives and false negatives is fundamentally tied to the trade-off between sensitivity (or recall) and specificity of a model. Balancing these errors requires careful tuning of the model's threshold values and continuous evaluation against emerging threats to maintain an acceptable level of security without overwhelming the system or its users with false alarms. The authors in [97] discuss the need for analysts to periodically review and adjust thresholds to optimize the balance between false positives and false negatives, emphasizing the importance of continuous evaluation in security operations. Additionally, the authors in [98] explore enhancing insider threat detection in imbalanced cyber security settings, focusing on fine-tuning threshold values to better manage the trade-offs between detecting true threats and minimizing false positives. Beyond these approaches, in this review, we further argue that the quality of datasets is crucial in every ML/AI approach, especially the aspects of high dimensionality or multicollinearity, which can silently misguide model patterns and introduce hidden biases. Many of the reviewed studies have attempted to address the issue through feature selection. Manual and automated methods have been attempted. In [82], the authors propose statistical methods, and in [73], a more narrative approach is used, but the results have not gained traction in further research. In [60], a fusion of statistical importance methods is proposed, showing reduced computation capacity and retained accuracy. The authors in [57] demonstrate the use of genetic algorithm-based feature extraction, leading to reduced false positives, though it is combined with a different modeling approach, so the individual contribution is not clear. Ref.