## 5 Machine Learning and Feature Selection Enabled IDS
### Popular Datasets Adoption for ML/FS-Enabled IDS  
Datasets are of prime importance for training and testing classification models that can be used by IDS for identifying various kinds of cyber-attacks [39]. A variety of datasets are publicly available for adoption by the research community to build effective IDS classifiers, including KDDCup99, NSL-KDD, ADFA-LD, UNSW-NB15, AWID2, TON_IoT, CICD-DoS2019, WSN-DS, BoT-IoT, ADFA-LD [87], AWID3, and RoEDUNET. The same is also available to evaluate the fitness, capability, and effectiveness of the developed classification models in detecting and deterring variants of cyber-attacks. This section presents a detailed analysis of commonly used datasets for designing FS-based IDS, including lightweight intrusion detection solutions. Furthermore, the summary, including the total number of records, number of features, year of publication, and attack types, is presented in Table 5.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Categories** & **Methods** & **Description** \\ \hline \multirow{8}{*}{Wrapper} & \multirow{8}{*}{Forward Feature Selection (FFS)} & An approach that initiates itself by selecting a variable that is performing best by the target. Then it repeats the process by selecting another variable amongst the remaining variables to evaluate the performance in conjunction with the best-performing variable. The process is repeated till the testing of all combinations is completed [84]. \\  & \multirow{8}{*}{Backward Feature Elimination (BFE)} & The Working mechanism of BFE is inversed to FFS. It initiates itself by building a model with a complete feature set available. Then it searches the model variables that have the highest evaluation measure value [85]. \\  & \multirow{8}{*}{Exhaustive FS} & The exhaustive FS approach employs a brute force mechanism to extract the best feature subset by trying each possible combination of variables within the feature set [86]. \\  & & \\ \hline \hline \end{tabular}
\end{table}
Table 4: _Cont._  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Dataset** & **Year** & \begin{tabular}{c} **Total** \\ **Features** \\ \end{tabular} & **Total Instances** & **Types of Attacks** \\ \hline KDDCup99 & 1999 & 41 & 489,848 & Prob, DoS, U2R, R2L \\ \hline NSL-KDD & 1999 & 41 & 226,547 & Prob, DoS, U2R, R2L \\ \hline ADFA-LD & 2013 & 44 & 5206 & \begin{tabular}{c} Web-based exploitation, Social \\ engineering, Poisoned execution, brute \\ force, System manipulation \\ \end{tabular} \\ \hline UNSW-NB15 & 2015 & 49 & 2,540,044 & \begin{tabular}{c} Fuzzer, Analysis, Backdoor, DoS, \\ Exploit, Generic, Reconnaissance, \\ Shellcode, Worms \\ \end{tabular} \\ \hline AWID2 & 2015 & 155 & 1,927,652 & Injection, flooding, impersonation, and passive attacks \\ \hline WSN-DS & 2016 & 23 & 374,661 & DDoS, Blackhole, Grayhole, Flooding, Scheduling \\ \hline CICDDoS2019 & 2019 & 80 & NA & \begin{tabular}{c} DDoS. NTP, DNS, LDAP, MSSQL, \\ SNMP, SSDP, UDP, SYN, TFTP, Web \\ DDoS, NETBIOS \\ \end{tabular} \\ \hline BoT-IoT & 2019 & 46 & 72,000,000 & \
\begin{tabular}{c} DDoS, DoS, Service Scan, \\ Keylogging, Data exfiltration \\ \end{tabular} \\ \hline TON\_IoT & 2020 & 45 & 461,043 &
\begin{tabular}{c} Scanning, DoS, DDoS, Ransomware, \\ Backdoor, Data injection, XSS, Password \\ cracking, MITM \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table}
Table 5: Summary of the datasets widely used in IDS.