# Applications of Machine Learning in Cyber Security: A Review
## 5 Intrusion Detection System Evaluation
Additionally, the authors deal with bias only partially by taking into account the correlation of different features but not the inherent class imbalance. Finally, the work does not focus on explainability or efficiency. The use of Convolutional Neural Networks (CNNs) in IDS is a growing research area [70, 76, 77]. CNNs can process significant amounts of data in parallel, enabling efficient real-time analysis of network traffic [78]. This ability to process large amounts of data means costly feature engineering is not conducted. However, they are currently limited in practical use due to computational requirements [76]. In [74], the team worked towards explainability with SHAP local and global explanations. The authors used a range of more interpretable ML models such as naive Bayes, SVM linear, SVM RBF, decision trees, quadratic discriminant analysis, and logistic regression, as well as less interpretable models such deep learning DNN. They concluded that the use of SHAP on the less-interpretable models would not give adequate explainability. They attempted to address bias by removing missing values and encoding categorical data as numerical. Further, they removed features which only contained one unique value, a variance of 0.1, or Pearson correlation of 0.9. Additionally, they performed recursive feature elimination and sequential feature selection. The data were scaled from a range of 0-1, except for the DL methods, which were standardized by removing the mean and scaling to unit variance. Similarly, a range of AI/ML approaches was used, including CNN, DNN, auto encoders, logistic regression, and random forest XGBoost in [60]. Both works conclude that in order to achieve better performance, feature selection is the best approach. This finding also aligns with the observations of wider literature reviews [59]. The literature is now starting to focus on frameworks that involve feature selection as part of their design. However, those lack statistical certainty, as they most often do not test for dependencies within the dataset. The research papers often focus on data, selection showing they are aware of the importance of feature selection based on feature importance, but they do not reveal how their systems score the importance [71]. Additionally, often, feature importance analysis lumps all attack types into one, which is not necessarily the most appropriate approach, as attacks can have widely different signatures. This has been shown in the literature when trying to generalize dispersed data. Some recent papers for IDS with ML on the UNSW-NB 15 dataset [56, 58] focus on feature extraction due to its demonstrated effectiveness [59]. However, they do not reveal which attributes of the data their feature extraction algorithm picked. This lack of explainability makes it hard to make use of the results more generally in feature engineering and causes uncertainty in black box results. When exploring the feature importance of the UNSW-NB 15 dataset, the research also does not discuss feature importance [71], or in [58, 73], or it treats all attacks as one when calculating feature importance, so the unique feature importance of different attack types may be lost. This is exacerbated with the known imbalance of data per attack type in this dataset. Additionally, ref. [67] specifically visualizes the distinctions between the attack types, showing that treating them as one would have limitations. In the IDS with the ML literature, it has been proven that creating models for each attack type produces better results [59]. As the recent papers do not discuss the statistical use of the dataset, we assume no major changes have been applied. Most prominently, when selecting the important features, there is a lack of evaluation towards multicollinearity [67, 73]. On the other hand, due to the rapidly evolving nature of security threats, IDS datasets quickly become outdated. To combat this, the generation of new datasets has become an area of research [69, 79].