## 2 Related Work
### Literature Review of Feature Selection Methods for Intrusion Detection Systems
According to the paper, the suggested technique increased both the detection as well as accuracy rates while decreasing the false-positive rate as well as feature space drastically. The paper also emphasized that using the wrapper and filter feature selection approaches together allows the best subset of features to be selected. The proposed method was only tested on the NSL-KDD dataset, which is not enough to correctly evaluate the proposed method's performance. [PERSON] et al. [24] proposed a Wi-Fi IDS that utilizes a weighted feature selection technique and neural network algorithm. The feature selection method used an ANN (Artificial Neural Network) and C4.5 to calculate each feature weight. The most significant features were chosen based on the corresponding weights, which represent the importance of each feature. A neural network classifier was performed for classification. The proposed approach was performed on the AWID (Aegean Wi-Fi Intrusion Dataset) dataset. According to the experimental results, a 99.9% detection rate, 99.7% F1 score, and 0.4 false-alarm rate were obtained, which outperformed the state-of-the-art methods for IDSs that use the filter approach. Additionally, the suggested system could handle both known and unknown attacks. The suggested method was performed only on the AWID dataset, and the authors did not mention how they handled unknown attacks or specify the most important features that represent the indication of the intrusion. To make the suggested method more clear, these deficiencies must be eliminated. [PERSON] et al. [25] investigated various machine learning techniques for intrusion detection systems. For each attack, associated features were given. Problems with low-frequency attacks were examined and necessary contributions were applied for benchmark datasets. For different attack categories, various machine learning techniques as well as algorithms were employed, and results were compared to identify efficient ML techniquesfor attack categories. According to the paper, the performance of standard ML algorithms such as decision trees, C4.5, SVM, neural networks, and fuzzy association rules was fairly high. However, they found that deep learning and reinforcement learning face several difficulties when detecting intrusion in network attacks. [PERSON] et al. [26] presented a new intrusion detection system. The model presented works by employing a combination of feature selection as well as clustering algorithms, utilizing both wrapper and filter approaches. The proposed model conducted feature grouping by using linear correlation coefficient and cuttlefish algorithms. After relevant features were selected, classification was performed. A decision tree classifier was employed on the KDD Cup dataset for classification. The experimental test results showed that the proposed method produced higher detection and accuracy rates than leading methods in the literature. [PERSON] et al. [27] presented feature grouping and selection techniques that used deep learning auto-encoder with random forest. The suggested method selected the most significant features from the datasets. An AP (Affinity Propagation) algorithm was performed in order to identify the features that had a strong correlation. To reduce the time complexity and accelerate the learning phase, a traditional unsupervised clustering algorithm and a three-layer shallow auto-encoder neural network were combined together. According to the authors, the presented method outperformed the state-of-the-art methods in terms of detection accuracy, ease of training, and adaptability. These days, normal and attack traffic can be mixed, and the attack traffic can be encrypted, which results in misclassification. Because of that, feature selection alone is not enough to correctly separate intrusions from normal network traffic. Moreover, using only the self-learning three-layer auto-encoder is not guaranteed to assist in increasing the accuracy of unsupervised Affinity Propagation clustering algorithms.