# A Deep Learning Approach for Intrusion Detection Systems in Cloud Computing Environments
## 2 Related Works  
This section discusses different academic papers that proposed an intrusion detection system with various machine learning and deep learning approaches. The field of intrusion detection systems is widely studied in the literature. Some research papers, such as [15; 16; 17], cover the use of ML and DL to improve the network security of cloud computing. [PERSON] et al. [15] proposed an approach to improving the network intrusion detection system (NIDS) by optimizing deep learning (DL) models and employing binary particle swarm optimization (BPSO) as a feature selection method that improves the level of accuracy and time required to check traffic behavior. They evaluated this approach using a new and real dataset, the CSE-CICIDS2018 dataset, that covered all \(11\) criteria that determine the characteristics of a reliable dataset. Deep neural networks (DNNs), the most common deep learning algorithms, were used for training in this approach. The proposed approach contains three phases: The first phase is data preprocessing, which includes data cleaning, data digitalization, and data transformation. The second phase is feature selection, which uses the binary POS algorithm to determine the most relevant features. The experimental results of this approach achieved an accuracy of 95%. In [16], the authors demonstrate a proposed real-time monitoring and detection \"RT-AMD\" of DDoS attacks on cloud computing using machine learning algorithms and an intrusion detection system, which uses anomaly-based detection. They selected machine learning classifiers of naive Bayes (NB), decision tree (DT), k-neighbors (KN), and random forest (RF) to build a predictive model and compare them by two primary criteria: accuracy and detection rate. In [17], the authors proposed a novel architecture that combines an autoencoder (AE) for feature learning with a deep neural network (DNN) for classifying network traffic into benign traffic or DDoS attack traffic. First, they performed data preprocessing to improve the quality of the input data and, subsequently, the quality and efficiency of the output, which includes label encoding, removing irrelevant features, and normalization. Then, the authors used a naive (baseline) model using AE for feature extraction and DNN to classify DDoS attacks based on random hyperparameter values. After that, an optimized AE and DNN model was produced by adding improvements to this baseline model. The enhancements to the basic AE, such as unit norm, sparsity, orthogonality, and hyperparameter optimization using grid search, resulted in an optimized AE that produced effective representation and improved the classification. These significant features were fed into an improved DNN for classification, which was enhanced using optimization methods such as hyperband tuning of hyperparameters and intelligent learning rate determination. Experiments were performed on the NSL-KDD and CICIDS2017 datasets for validation, giving an accuracy of 98.43% and 98.92%, respectively. The authors in [18] presented a hybrid IDS (HIDS) that combines signature-based intrusion detection (SIDS) and anomaly-based intrusion detection (AIDS) models based on machine learning algorithms. The NSL-KDD was used to evaluate this model. They developed a hybrid method using an ensemble of the C5.0 decision tree (signature) and one-class support vector machine (anomaly), which can result in a better detection rate than the single algorithms. As with the same hybrid deep learning [19], the authors in another study proposed a hybrid intrusion detection system (IDS) based on hybrid deep learning that detects network attacks. The model is a convolutional recurrent neural network (CRNN) that combines an RNN and a CNN. The first stage used a CNN to collect local features; the second used a deep-layered RNN to capture features. They conducted an experiment, evaluated it using CICID2018 datasets, and produced an accuracy of 98.90%.