## 2 Related Work
[19] explored the possibility of using a deep neural network (DNN) to develop a flexible and effective IDS for detecting unexpected and unpredictable attacks. In addition, they compared multiple layers of DNN with six classifiers: DT, RF, LR, NB, KNN, and SVM-rbfto. Furthermore, they tested three subsets of the KDD99 dataset containing four, eight, and eleven features. The experimental results revealed that the proposed system performed better with eleven- and eight-feature subsets than with the four-feature subset. Additionally, this system demonstrated slightly better performance with the eleven-feature subset than with the eight-feature subset, as evidenced by the finding that the average detection accuracy was approximately 93.2% in both cases. In addition, a new deep neural network intrusion detection model (NDNN) developed with four hidden layers [20] depending on 41 features. The test results revealed that this system had a detection accuracy of 99.9%, a DR of 99.95% and a FAR of 0.03%. [PERSON] et al. [21] proposed an IDS that performs ID using three main processes: data preprocessing, feature selection, and rule-based JRip classification. Data preprocessing is aimed at removing noise, network traffic, and features that provide the same information in text format (.txt). In this system, the missing and NaN values of the features are set to zero. Then, two new reduced feature subsets (RFSs), RFS-1 and RFS-2, perform intersection and union operations. Subsequently, the RFS-1 and RFS-2 subsets were introduced into the classifier system using Jrip rule-based classification. This IDS was evaluated using the KDD99 and IoT-BoT datasets. The testing results indicated that the same detection accuracy (99.99%) could be achieved by this system when applied to the KDD99 and IoT-BoT datasets and that the best subset of features, which they labeled RFS-1, contains 16 features. [PERSON] and [PERSON] [22] proposed an ID model based on an autoencoder (BP) and improved GA (IGA-BP). The BP autoencoder was used in this model to eliminate redundant network feature information, whereas IGP-BP was employed to breed the system with a new population after selecting the best parents to perform crossover and mutation and replace the worst parent. All the experiments were conducted on 41 network features of the KDD99 dataset. The experimental results indicated the effectiveness of the IGP-BP model in detecting attacks, as the detection accuracy reached 98.27% and the FAR was 0.87. [PERSON] et al. [14] proposed a new feature selection approach (FSAP) that reduces the number of KDD99 features to process from 41 to 10 features. The FSAP performs two processes: feature selection and ID. For feature selection, the most appropriate features were selected based on the threshold values. Subsequently, all features greater than the threshold value were selected. For ID, this approach uses a signature-based method to recognize anomalous or suspicious behavior. As a result, this approach demonstrated high detection performance, corresponding to a detection accuracy of 99.81% and a FAR of 0.056. Researchers [23] have developed a framework that depends on deep learning and metaheuristic (MH) optimization algorithms for extracting and selecting network features. A CNN is then used to extract the most appropriate network features. A new MH optimization algorithm called the Reptile Search Algorithm (RSA), which can select the most important network features, was used. The proposed framework then used 10 features from the KDD99 dataset. Testing revealed that the detection accuracy of this framework was 92.344%. Also, in [24], two novel deep learning methodologies for network intrusion detection were presented. [PERSON] et al. [24] introduced a self-taught learning (STL) approach, successfully reducing feature count from 41 to 5, while achieving a high accuracy of 97.9% and a low false alarm rate (FAR) of 0.5%.