## 1 Introduction  
The number of internet users is increasing worldwide. This presents a chance for attackers to escalate their attacks and continue to infringe upon the resources and capabilities of network and computer systems. This places additional strain on networks in relation to their security requirements. Consequently, there is an increasing demand for network security systems and applications that aid in enhancing the availability of networks, bolstering their reliability, lessening the vulnerability and potential misuse of network and computer systems, and decreasing the frequency and severity of malicious attacks. Thus, various methods have been developed for the detection of illegal access and probing attack attempts that enable end users to reject or accept incoming malicious requests [1]. Common means of attack detection include firewalls and intrusion detection systems (IDSs). Both approaches have been widely used to preclude undesirable incoming and outgoing data [2]. In general, IDSs focus on an intruder who can change a user's system data or steal it [3]. In 1980, [PERSON] [4] formulated the concept of IDSs by developing an application that monitors a computer system that operates by tracking and identifying a user's behavior for the detection of any anomalous behaviors [4]. In 2014, [PERSON] et al. [5] clarified that IDSs can be classified based on their detection methods or data sources. IDSs that are based on data sources encompass the host-based intrusion detection system (HIDS), which is a system that receives information from individual hosts and traces and checks the system records. The monitoring tool is installed on all monitored hosts, allowing us to analyze event logs, key system files, and network activity for any suspicious changes or patterns that may signal malicious activity [5]. Network-based intrusion detection systems (NIDS) control traffic based on network requests and packets. These systems analyze network packets, isolate those that seem to be unordinary packets, and flag them accordingly. NIDSs can also be applied to data collected from various hosts to identify signs of intrusion [5]. Generally, NIDSs perform two types of intrusion detection (ID): misuse and anomaly ID. Misuse ID, also known as signature-based ID, is based on the signatures of attacks that are established in NIDSs as alarms of intrusion. Attack signatures include patterns of specific activities or movements that differ from established patterns of normal movements or activities, which define whether a particular activity is a normal or intrusive activity [6]. Anomaly ID, on the other hand, identifies new types of intrusions and infusions in the normal use of system resources. Anomaly detection methods are useful for unknown counterattacks and new attacks because of the lack of previous knowledge regarding the necessary steps for dealing with these types of intrusions [6]. Anomaly IDSs were classified according to the detection method employed. IDSs generally apply numerous detection methods, such as machine learning methods, reinforcement learning (RL) [7], neural networks (NNs) [8], fuzzy logic [9], and support vector machines (SVMs) [10]. To provide a safe and secure network environment, numerous artificial intelligence techniques have been employed to detect intrusions. In this respect, several measures of ID efficiency have been used, the most common of which are the detection rate (DR), accuracy (AC), and the false alarm rate (FAR). The development of a high-performance IDS model poses substantial obstacles, particularly when dealing with network packets that consist of a diverse array of features. This gives rise to the feature selection dilemma, which plays a crucial role in the development of IDS. Utilizing optimized feature sets aids in reducing computational demands and processing duration, ultimately resulting in improved classification precision and a reduction in the false alarm rates.