## 2 Literature Review
### Summary  
This study identifies four challenges associated with IDSs: low detection rates, false alarm rates, response times, and unbalanced datasets. Several limitations exist both in data source methods and in detection methods. These challenges can be addressed by three detection techniques: ML, data mining, and statistical techniques. In this study, ML will serve as a detection technique. According to advantages and disadvantages, a hybrid model achieves the highest accuracy result, as demonstrated in [33; 34], as an outcome of related work, where 100% accuracy was achieved. However, when probability-based learning is used, the accuracy result is lower, as shown in in [27]; the proposed model's accuracy was 89.7%. The accuracy of information-based learning and error-based learning is always over 98%. Additionally, feature selection will significantly impact the accuracy result, as demonstrated by the research study in [28], where the accuracy result of the proposed model is 99.73%. Furthermore, the feature selection method can have a significant effect on the accuracy of the ML model, as shown in the following related papers: [33; 34; 35; 36; 37; 38; 39]; the method in each falls under the hybrid model approaches, but they differ in accuracy. Both feature selection and parameter selection can significantly impact the model's accuracy. In all cases, SDNs show an accuracy of 95% or greater. The literature review considers no specific network architecture for applying ML-based IDSs. However, this study considersthe network architecture the principal component for applying ML-based IDSs. Also, the related works provided one-layer security and did not consider the organizations' requirements if they were under prime time or special event conditions. Most related studies test one ML model on multiple datasets or one dataset trained with multiple models, so there needs to be more explicit information about whether the results are accurate. Moreover, most of the mentioned related works are unrelated to specific domains, such as cloud computing or the Internet of Things, so this field has been left as N/A. Table 3 shows the summary of related work. Consequently, a novel centralized network architecture based on a multi-model IDS is proposed, called multi-model IDS based on traffic load. Further, the following datasets will be used in this study: CIC-MalMem-2022, a recent dataset; the CIC-IDS-2018 and CIC-IDS-2017 datasets, the most commonly used in related studies. In addition to this, the CIC-MalMem-2022, CIC-IDS-2018, and CIC-IDS-2017 datasets serve as valuable resources for researchers involved in intrusion detection and malware analysis. As a result of their real-world representation, diversity of attack types, labeled data, public accessibility, and status as benchmarking standards, they are widely used to develop and evaluate new security solutions. Finally, several learning approaches will be used for this experiment, including hybrid models, information-based learning techniques, and error-based learning techniques. as they achieve high levels of accuracy. The following are the learning approaches and algorithms that will be used in the experiments:  
* Hybrid models: The Stacking classifier and the Voting classifier enable different estimators to predict the result. * Information-based learning techniques: AdaBoost is a powerful and versatile meta-algorithm particularly useful for cybersecurity applications as it can handle imbalanced and noisy datasets [47]. Random Forest is the most used in related studies, and XGBoost is one of the most powerful gradient-boosting algorithms available [48]. Generally, tree-based algorithms such as RF, AdaBoost, and XGbbost have demonstrated high efficiency and effectiveness in handling binary and categorical data and identifying complex feature relationships. Various ML applications use these algorithms, such as classification, regression, and anomaly detection.