## 2 Related Work  
Currently, there are several approaches of how to apply ML to cybersecurity based on a network sensor response, specifically for intrusion detection. These different approaches consider diverse parameters such as the classification of the attacks, network flow variables that should be included, solutions based on data mining, or solutions directly based on various ML algorithms with the aim of finding the best model. In Reference [5], the authors established the basis of intrusion detection systems. In that work, one of the main contributions was defining how IDSs should work in order to detect more attacks easily by analyzing the detecting mechanism. Another contribution was a classification of the different attacks. As stated, by establishing the differences between the types of attacks, the detection mechanism can be fine-tuned, ending in a better detection. In addition, those researchers tried giving an approach to a good ML model for IDSs by using different techniques. In those studies, the best results were achieved by neural networks, closely followed by decision trees and nearest neighbor. Following the approach started by Reference [5], the authors of Reference [18] tried going deeper with the objective of proposing a model with optimal parameters for neural networks. Their research was based on previous works that, however, did not reach truly optimal models. To solve this problem, they adopted an approach based on a five-stage model with the aim of studying the majority of possibilities. This approach specifies a comparison to get the best parameters related to the best dataset features and the way that those features must be normalized to get the best of them. Furthermore, they specified the way in which the neural network must be built having to account for the number of hidden layers, the number of nodes inside each one of the layers, the activation function, and some other parameters for the best adjustment of the neural network. Afterward, the research made a comparison with a combination of different solutions, whether proposed by them or by other researchers. The conclusion was clear; they identified the best activation function to be used rectified linear unit (ReLU), the formula to calculate the architecture of the neural network model, and how to normalize each type of data included in the dataset. The rules defined are shown in Equations (1) [19], (2) [20], (3), and (4) [21], where \(H\) is the number of hidden layers of an IDS, _input_ is the number of entries, and _output_ is the number of exits in the neural network model. \[\text{H}=0.75\times\text{Input}+\text{Output}, \tag{1}\]  
\[\text{H}=(\text{Input}+\text{Output})/2, \tag{2}\]  
\[\text{H}=\text{Input}\times 70\%, \tag{3}\]  
\[\text{H}=\text{Input}\times 90\%. \tag{4}\]  
Different approaches were presented using techniques such as Apache Spark to improve the preprocessing of the dataset and its performance [5; 7; 22]. However, the used datasets cannot be currently considered as large-scale and did not include real background traffic. The most common dataset used in nearly all the studies analyzed is KDD'99, as mentioned before in Section 1. KDD'99 is a dataset that includes a lot of useful features; however, it is not a good representation of the most modern attacks and cannot be used as information to train a modern IDS because of its type and the source of the flows it contains (synthetic) [6]. The same happens with the DARPA dataset. Reference [10] introduced a new, modern, and up-to-date dataset with real network traffic taken directly from an internet service provider for citizens as customers (TIER-3 ISP): the UGR'16 dataset. The information included in the dataset was anonymized providing real and complete information to build a model. This part of the dataset is called \"calibration data\". The dataset also includes some parts to test the correct training of an IDS.