## 1 Introduction  
The inclusion of computational elements into the daily life of people, i.e., Internet of things, wearable technology, or Ubicomp, applied to a sensitive user context such as healthcare, offers new intrusion vectors that directly affects people's lives [1]. Currently, the use of sophisticated techniques and technology to develop new and more efficient cyber-attacks is exponentially increasing the number of cyber-threats  
The improvement of methods for preventing and detecting cyberattacks acquired great importance, increasing the impact on technological developments and becoming a fundamental pillar of the digital era. In this sense, the integration of artificial intelligence (AI) in the context of cybersecurity favored this necessary improvement [2]. The integration of AI and cybersecurity can be applied to different cybersecurity systems, i.e., to prioritize events using resilient incident response platforms in SecurityOperation Center (SOCs), to automatize security analysis, or to detect and predict threats before they materialize. The integration of AI can be especially positive in intrusion detection systems (IDSs), which process a huge amount of network traffic from Internet of things (IoT), wearables, wireless sensors, host-host-based sensors, and network computing. IDSs are software systems that monitor and analyze the behavior of networks and systems with the objective of detecting some possible intrusion. There are two classes of IDSs: those based on signature detection and those based on anomaly detection. IDSs that are based on signature detection apply different rules to detect an attack over a network or a host. Alternatively, an anomaly-based detection IDS can differentiate between normal and anomalous flow. However, the problem of false alarms (false positives) is a major concern in the use of IDS [3], which consequently leads to the need for an expert in cybersecurity to evaluate the results and investigate the veracity of these false positives [4]. This process takes a considerable amount of time with a need for qualified people. Technology and techniques used to implement IDSs are mostly publicly known; thus, attackers are always improving their methods, trying to find a way to bypass IDSs without being detected [5]. This led to the materialization of a new generation of IDSs which, through the use of AI, try to improve their efficiency and effectiveness via anomaly-based IDS. Nevertheless, many of these research works were usually based on KDD'99 and DARPA datasets, which have twenty years of history and do not represent the current state of the art of systems, attacks, and cybersecurity [6; 7; 8; 9]. These datasets are small and do not represent large-scale data compared with other recent datasets such as UGR'16 [10]. In Reference [11], there is a representation of the most used datasets in the last decade for machine learning applications related to intrusion detection. For instance, DARPA 98, DARPA 99, and DARPA 2000 datasets [12] constituted 8.6% of usage and the GureKddcup dataset [13] constituted 1.4%, a percentage shared by the ISCX2012 dataset [14] and UNB-CIC [15]. Other used datasets are NSL-KDD [16] with 11.6% of usage, KDD-99 [17] with 63.8% of usage, and finally generated and simulated datasets with 11.6%. These datasets mentioned above do not represent the current state of the art related to information security. In recent years, AI and specifically machine learning (ML) techniques were implemented to solve problems related to anomaly-based IDSs, in order to improve attack detections. However, training ML-based IDSs is costly in terms of time and computational requirements due to the large amount of data needed to be processed. The use of ML methods for developing a better IDS is a trending research topic which provided good results. Nevertheless, some stages of the ML process must be optimized, such as data preparation (preprocessing), to obtain good results in terms of accuracy.