# A Novel Intrusion Detection Approach Using Machine Learning Ensemble for IoT Environments
## 2 Literature Review
### Machine Learning Enabled Intrusion Detection for IoT Appliances  
#### 2.1.1 Intrusion Detection System  
An intrusion detection system (IDS) determines the blockage by reviewing the network against violation activities [4]. This model was identified [5] in the 1980s and it can be divided into a set of two classes. The initial two classes are based on the network and host separately, where the behavior of intrusion can be noted. Monitoring the network and analyzing the network traffic are the focused activities in a network-based IDS to serve network security. The host-based IDS monitors the malicious activities happening in the processes and the system events in the software-based environment [6; 7].  
Another category of IDS relies on the approach of data analytics, which has been used in all types of intrusions such as signature, anomaly, and hybrid-based intrusion. The signature-based approach searches for information from network packets or a specific system (for example, logs) to detect signatures or a similar pattern that support charac teristics of behavior for intrusive activity. Such a strategy is essentially more feasible as it uses recently named information from the dataset. Although it is described as a basic and effective technique, it cannot see ambiguous attacks and requires constant information base updates [3; 7; 8; 9].  
An approach based on anomaly intrusion examines the information to look for irregular situations that differ from the general network behavior and system practices. This capability can rely on the recently given information which was used to produce specific algorithms. The strategy depicted is promising as it can enable the search for zero-day attacks. Moreover, it includes a more vigorous adaption to a specific system or network. In such cases, a very significant downside is that these methods are more prone to false-positive alerts that contain a higher level of information, as they are not based on uniquely named information. Recently, some new instructions have been issued for their dependencies, which will search for the given information according to the terms of data discrepancies. However, this information is not enough to detect network security attacks [6; 7; 8; 10].  
The hybrid technique combines both signature and anomaly detection techniques. This kind of strategy was designed by [PERSON] and [PERSON] to limit the consequences of bogus precautions and further increase recognition for attacks that are known [7].  
[PERSON] et al. conducted a comprehensive survey that marked some additional techniques similar to the wireless-based analysis of network behavior, hybrid IDSs, and the analysis of the existing key protocols. Wireless-based IDSs closely resemble the network-based schemes which are capable of capturing wireless traffic flows. A system for analyzing the network behaviors is based on network traffic to search for malicious attacks along with expected flows of network traffic. Hybrid IDSs consolidate various advances to provide more intensive and accurate interrupt detections, while the stateful IDS protocol dissects the explicit conditions of the specific network so that examples of contraceptive harm can be searched [8] (Table 1).  
For modeling the IDS, other categories of machine learning and soft computing were introduced by [PERSON] et al. [6]. Four different groups of mechanisms based on machine learning and soft computing were depicted: supervised learning, unsupervised learning, statistical modeling, and ensemble-based approaches [11]. The dominant approach is used to identify the unique behavior intrusions, while single strategies work for novel intrusions. The statistical modeling-based approach is used to evaluate the behaviors of users and assess whether it is characterized as 'normal', while the ensemble-based approach joins some models to improve proficiency and accuracy.