# Machine Learning and Deep Learning Methods for Intrusion Detection Systems: A Survey
## 5 Challenges and Future Directions  
Table 5 lists papers on machine learning based IDSs which are introduced in this survey. It shows that deep learning methods have become a research hotspot (26 papers are listed, 14 papers adopt deep learning methods). KDD99 and NSL-KDD datasets are still widespread used. Although machine learning methods have made great strides in the field of intrusion detection, the following challenges still exist. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Methods** & **Papers** & **Data Sources** & **Machine Learning Algorithms** & **Datasets** \\ \hline \hline
**Packet parsing** & [PERSON] et al. [40] & Packet & SVM and K-means & Private dataset \\  & [PERSON] et al. [41] & Packet & Fuzzy C-means & DARPA 2000 \\ \hline
**Payload analysis** & [PERSON] et al. [43] & Packet & CNN & ISCX 2012 \\  & [PERSON] et al. [44] & Packet & CNN, LSTM, and autoencoder & ISCX 2012 \\  & [PERSON] et al. [45] & Packet & Autoencoder & CTU-UNB \\  & [PERSON] et al. [66] & Packet & GAN & Private dataset \\ \hline
**Statistic feature for flow** & [PERSON] et al. [47] & Flow & SVM, decision tree, and Naïve Bayes & KDD99 \\  & [PERSON] et al. [48] & Flow & KNN & KDD99 \\  & [PERSON] et al. [13] & Flow & K-means & KDD99 \\ \hline
**Deep learning for flow** & [PERSON] et al. [49] & Flow & CNN & NSL-KDD and USNN-NB15 \\  & [PERSON] et al. [50] & Flow & Autoencoder and XGBoost & NSL-KDD \\  & [PERSON] et al. [51] & Flow & GAN & KDD99 \\ \hline
**Traffic grouping** & [PERSON] et al. [52] & Flow & SVM & KDD99 \\  & [PERSON] et al. [53] & Flow & DNN & KDD99 and NSL-KDD \\ \hline
**Statistic feature for session** & [PERSON] et al. [54] & Session & Decision tree & CICIDS 2017 \\  & [PERSON] et al. [55] & Session & K-means & Private dataset \\ \hline
**Sequence feature for session** & [PERSON] et al. [56] & Session & CNN and LSTM & ISCX 2012 \\  & [PERSON] et al. [57] & Session & LSTM & ISCX IDS \\  & [PERSON] et al. [58] & Session & CNN & DARPA 1998 and ISCX 2012 \\ \hline
**Rule-based** & [PERSON] et al. [59] & Log & KNN & Private dataset \\  & [PERSON] et al. [60] & Log & DNN & Private dataset \\ \hline
**Log feature extraction with sliding window** & [PERSON] et al. [61] & Log & CNN & NGIDS-DS and ADFA-LD \\  & [PERSON] et al. [62] & Log & DNN and RNN & CERT Insider Threat \\  & [PERSON] et al. [63] & Log & K-means and DBSCAN & VAST 2011 Mini Challenge 2 \\ \hline
**Text analysis** & [PERSON] et al. [64] & Log & SVM & Private dataset \\  & [PERSON] et al. [65] & Log & Isolate forest & CSIC 2010 dataset \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Methods and papers on machine learning based IDSs. **(1) Lack of available datasets**. The most widespread dataset is currently KDD99, which has many problems, and new datasets are required. However, constructing new datasets depends on expert knowledge, and the labor cost is high. In addition, the variability of the Internet environment intensifies the dataset shortage. New types of attacks are emerging, and some existing datasets are too old to reflect these new attacks. Ideally, datasets should include most of the common attacks and correspond to current network environments. Moreover, the available datasets should be representative, balanced and have less redundancy and less noise. Systematic datasets construction and incremental learning may be solutions to this problem. **(2) Inferior detection accuracy in actual environments**. Machine learning methods have a certain ability to detect intrusions, but they often do not perform well on completely unfamiliar data. Most the existing studies were conducted using labeled datasets. Consequently, when the dataset does not cover all typical real-world samples, good performance in actual environments is not guaranteed--even if the models achieve high accuracy on test sets. **(3) Low efficiency**. Most studies emphasize the detection results; therefore, they usually employ complicated models and extensive data preprocessing methods, leading to low efficiency.