# A Novel Intrusion Detection Approach Using Machine Learning Ensemble for IoT Environments
## 2 Literature Review
### Machine Learning Enabled Intrusion Detection for IoT Appliances
#### 2.1.2 CSE-CIC-IDS2018-V2 Dataset  
The dataset has a huge impact on the performance evaluation of a machine learning algorithm [12]. A review of the literature suggests that most of the intrusion detection methods that are based on machine learning have been trained by the DAROA 98/991 and KDD CUP 992 datasets. However, the method of intrusion detection using these datasets is not very effective, and many researchers [13; 14; 15; 16; 17] are against the recommendation of their use. This is why a new dataset, CSE-CIC-IDS 2018 ([[https://registry.opendata.aws/CS](https://registry.opendata.aws/CS)]([https://registry.opendata.aws/CS](https://registry.opendata.aws/CS)) E-CIC-IDS2018-V2/, accessed on 15 March 2021), collected by the Canadian Institute of  
\begin{table}
\begin{tabular}{c c} \hline \hline  & Based on dedicated host \\ Intrusion detection prone area & Based on dedicated network \\  & Based on remote accessibility \\  & Based on analytics of network behavior \\ \hline \hline  & Based on authorized signature values \\ Methodologies of intrusion detection & Based on data pattern irregularity or anomaly \\  & Based on analytics of stateful protocols \\ \hline \hline \end{tabular}
\end{table}
Table 1: Summary of some of IDS types.  
Cyberspace (CIC) on Amazon's AWS LAN network, was used in our research work [18]. This dataset is also termed as CIC-AWS-2018. This dataset provides TCP/IP level traffic data details like IP address, port number, detection of CIC-AWS dataset, and statistical data of traffic based on the flow of data in the network. A network flow generator and analyzer, CICFlowMeter, was used to calculate the statistical data.  
The dataset includes six types of infiltration conditions: DoS attack, Brute Force attack, botnet attack, DDoS attack, web attack, and infiltration, which are within the network, along with 14 different types of intrusions: FTP-Brute Force, Brute Force-Web, botnet, SSH Brute Force, DDoS-HOIC attacks, DDoS-LOIC-HTP attacks, SDL injections, Brute Force-XSS, DoS GoldenEye attacks, DoS Hulk attacks, DoS slow HTTP test attacks, infiltration, and DoS Slowloris attacks. The data is labeled according to three criteria, namely, the number of transmitted packets, data flow duration, and counts of certain flags. The CIC-AWS-2018 datasets also contain the records of network traffic and event logs.  
However, considerable research work has been done on CIC-IDS-2017, an older version of the CIC-AWS-2018 dataset. Some researchers [19] have implemented a classifier based on unsupervised learning. [PERSON] et.al, the creator of the CIC-IDS-2017 dataset, used the random forest regression model, developed by CIC, to select only the top four features that are fully capable of detecting intrusion derived from machine learning techniques [20]. In our analysis, we used the CSE-CIC-IDS 2018 because it is more recent than the other datasets like CIDDS-001 (CIDDS-001 dataset. [[https://www.hs-coburg.de/forsc](https://www.hs-coburg.de/forsc)]([https://www.hs-coburg.de/forsc](https://www.hs-coburg.de/forsc)) hungkooperation/forschungsprojekte-oeftentlich/ingenieurwissenschaften/cidds-coburg intrusion-detectiondata-sets.html, accessed on 20 April 2021), UNSW-NB15 (UNSW-NB15 dataset. [[https://www.unsw.adfa.edu.au/australian-centre-for-cyber-security/cybersecurity/ADFA-NB15-Datasets/](https://www.unsw.adfa.edu.au/australian-centre-for-cyber-security/cybersecurity/ADFA-NB15-Datasets/)]([https://www.unsw.adfa.edu.au/australian-centre-for-cyber-security/cybersecurity/ADFA-NB15-Datasets/](https://www.unsw.adfa.edu.au/australian-centre-for-cyber-security/cybersecurity/ADFA-NB15-Datasets/)), accessed on 20 April 2021), and NSLKDD (NSL-KDD dataset. [[http://nsl.cs.unb.ca/nsl-kdd/](http://nsl.cs.unb.ca/nsl-kdd/)]([http://nsl.cs.unb.ca/nsl-kdd/](http://nsl.cs.unb.ca/nsl-kdd/)), accessed on 20 April 2021). In addition, this dataset has the latest information about traffic attacks that supports building IDSs to detect novel attacks.