## 3 Background
### Machine Learning  
Machine learning is defined as a form of applied statistics which focuses more on the estimation of complicated functions, using computers, and less on testing them [5]. In addition, it can be defined as an application of artificial intelligence that provides the systems with the ability of learning to produce the desired output for given inputs without being explicitly programmed [25]. Therefore, machine learning algorithms build mathematical models from observations or data in order to detect patterns and make better future predictions or decisions based on past examples. This is used in IDS to detect attacks by learning normal and attack behavior [5]. Machine learning algorithms can be divided into different categories: supervised learning, unsupervised learning, and semi-supervised learning.  
Supervised learning algorithms are based on applying what they learn from a set of features or labeled examples, learning a function that maps or associates some input with some output. Therefore, if the function adequately approximates the output, the algorithm can predict outputs given inputs. While learning, as the results or outputs are known, the algorithm can be corrected until it reaches an acceptable level of performance [26]. In this sense, supervised learning is the most extended approach to define these learning algorithms [27]. This kind of algorithm builds a mathematical model from a set of data that contains both the inputs and the desired outputs.  
Supervised learning offers discriminative power in order to classify data into patterns. Some examples of supervised learning algorithms are as follows:  
* Recurrent neural network (RNN);
* Convolutional neural network (CNN);
* Long short-term memory (LSTM);
* Random forest (RF);
* Decision trees (DT).  
Unsupervised learning algorithms are those used when there are only inputs and no outputs, that is, when information is neither classified nor labeled. Different methods are suggested to manage data: clustering, which intends to classify data; association rule mining, which consists of looking for rules and patterns from the data; and dimensionality reduction, which reduces the number of variable characteristics in the dataset. Unsupervised learning is planned to capture the high-order correlation of the observed data to look for patterns when there is no available information about a target class label. Some examples of unsupervised learning are as follows:  
* K-nearest neighbors (KNN);
* Boltzmann machine (BM);
* Restricted Boltzmann machine (RBM);
* Neural network (NN);
* Deep autoencoder;
* Support vector machine (SVM)/  
Semi-supervised learning algorithms are an intermediate method between supervised and unsupervised learning algorithms because they use both labeled and unlabeled data for training. They are used when the goal is to reduce the amount of labeled data required during the learning phase [26]. The most important algorithms in this category are random forests, neural networks, decision trees, k-means, or nearest neighbor [13]. Another important learning algorithm is reinforcement learning [15], which is less common. These algorithms try to show what actions a software should choose in a determined environment to maximize achievement of a reward.  
Finally, there are different processes and techniques that can be applied to different ML algorithms to enhance their work. The most common ones are association rules, anomaly detection, sparse dictionary learning, and feature learning [13].  
This research applies supervised ML algorithms as a basis. Then, the deep learning (DL) and non-DL algorithms used in our work are presented.