## 2 Literature Review  
Several studies have been conducted to identify and detect attacks in smart cities. ML-based systems have proven to be effective in quickly detecting intrusion and working efficiently with a large amount of data, considering the destruction of the working principle and purpose of the system design. Feature selection must be considered to increase model performance and reduce data dimensionality by removing redundant or irrelevant features during the construction of an IDS. In [12], the pigeon-inspired optimizer was introduced to identify features with a DT classifier to detect attacks by selecting the most critical features from the dataset. The researchers tried to compare feature selection techniques and evaluate their performance on three datasets: NSL-KDD, KDD cup'99, and UNSW-NB15. The study showed that the model's performance using NSL-KDD with 14 characteristics was 86.9% in accuracy. In [13], the RF classifier removed irrelevant traits from the dataset. Several ML models, such as KNN, Support-Vector Machine (SVM), Decision Tree (DT), and Logistic Regression (LR), were used to train and test the model. As a result, the model achieved an accuracy of 99.3% and 99.2% detection rate on selected significant features (=10) from an entire set (=41) in the NSL-KDD dataset. [PERSON] [14] introduced an ML algorithm consisting of three main components: LR, genetic algorithm (GA), and artificial neural network (ANN). The first stage involved extracting the trait set from the data. The AI neural network (NN) was trained to detect intrusions in the second stage. The performance of the proposed model was 94.4% in terms of accuracy. Two datasets were used to analyze the proposed model. One was the NSL-KDD dataset, and the other was the KDD cup'99. Although the proposed model was only 88.90%, the training and testing time for the proposed method was shallow, as it was 74 s.  
The differential evolution technique was introduced in [15] to reduce the number of traits in the data. This method mainly affects the accuracy of the intrusion detection system. The accuracy of the proposed model was 87.3% for the binary classification and 80.15% for multiple classifications. The proposed model was evaluated against two datasets: NSL-KDD and KDD cup'99. The proposed model performed lower in accuracy compared to existing studies in intrusion detection systems. [PERSON] et al. in [16] studied network data classification by implementing multiple ML technologies such as SVM, KNN, LR, Naive Bayes (NB), Multi-layer Perceptron (MLP), RF, DT, and ET. Study results were evaluated on four subsets of the NSL-KDD dataset, and an accuracy of over 99% was achieved using random forest classifiers, Extra Trees, and decision tree in all four feature subsets. To reduce features from the dataset and eliminate noise, [PERSON] et al. used PCA and Fisher Discriminant Ratio (FDR) [17]. The authors developed a probabilistic self-organizing map model to model feature space and identify normal patterns from anomalous ones. The accuracy, specificity, and sensitivity results were 90%, 93%, and 97%, respectively. Moreover, the clustering method combines several basic models to reduce false positive rates and produce more accurate solutions. Several studies have been conducted using ensemble methods to utilize the advantages of more than individual classifiers in one model. The authors in [18] demonstrated how ensemble machine learning, NN, and kernel methods can detect abnormal behavior in an IoT IDS. In this study, ensemble methods outperformed NN and kernels in accuracy by 99.1%. The study was evaluated using the Kitsune and NSL-KDD datasets. In [19], cyberattacks using cluster methods for IoT-based smart cities were revealed. The authors evaluated their new model using the UNSW-NB15 and CICIDS2017 datasets, and in this study, the proposed method was found to be consistent with LR, SVM, DT, RF, ANN, and KNN with an accuracy of 99.91%. [PERSON] et al.