# A Study of Network Intrusion Detection Systems Using Artificial Intelligence/Machine Learning
## 8 Discussion
### Observations
We can also see that many researchers are using SVM as their classifier because it has great performance when detecting minor classes. Thus, they often combine it with other machine learning methods in a multi-layer manner. Additionally, ensemble methods are frequently used as it allows the use of different methods together to improve the efficiency of the IDS. The advent of these new powerful techniques is possible, thanks to the improvement in GPU utilization and cloud computing platforms. Finally, old traditional machine learning methods such as K nearest neighbourhood, K-mean clustering, and genetic algorithms are less used as compared to CNN and DNN. In Section 6, it is shown that more and more researchers are using feature extraction in their solutions. Indeed, as shown in Figure 5, 60% of the reviewed articles in Section 6 used feature extraction. It was clearly shown that feature extraction greatly helps to improve the accuracy of the system. In addition, it helps to improve the structure of the dataset so that the amount of computing resources needed is decreased. In most cases, the feature extraction methods were based on neural network techniques such as Auto-Encoder techniques. However, many solutions also used traditional machine learning methods for feature extraction such as Naive Bayes or Correlation method. Thus, it was shown that old machine learning techniques and new deep learning methods can be combined, with one of them used for feature selection and the other one used for classifying traffic. The analysis of the metrics used to assess the various solutions studied is shown in Figure 6. The most used metrics are the Accuracy and the Detection rate (Recall). Those metrics are indeed the most important to assess the quality of a solution. Thus, they should always be used when assessing the efficiency of an IDS. Nevertheless, we consider that the F-measure should also be used more when assessing an IDS because it shows if the solution is efficient to detect samples that are indeed attacks even from minor classes. Figure 4: Frequency of Classifier used (Section 6). Datasets are a key component of IDSs. The analysis of which public datasets is used for testing is shown in Figure 7. It is shown that the KDDcup99 and NSL-DD were used 56% of the time for testing. Those datasets are old but still very popular with researchers since many studies have been made using them. However, the network structure and architecture have changed compared to 20 years ago. Indeed, nowadays IoT devices and wireless device usage has significantly increased. Thus, the amount of data exchanged in the world is incomparable with what existed 20 years ago, in addition, many novel and powerful attacks have since been created. If a new IDS solution is trained on an old dataset only, it is likely that the solution will not be efficient when utilised in a real-world environment. Thus, this study shows the need of using recent datasets to have better trained models that will be efficient in real-world modern networks. Figure 5: Feature extraction distribution (from Section 6). Figure 6: Metrics used (Section 6).