# A Study of Network Intrusion Detection Systems Using Artificial Intelligence/Machine Learning
## 6 Literature Review
\begin{table}
\begin{tabular}{l l l l} \hline \hline
**Dataset** & **Year** & **Attack Types** & **Attacks** \\ \hline KDDcup99 & 1999 & 4 & Probe, DoS, U2R, R2L \\ \hline Kyoto 2006 & 2006 & 2 & Known attacks, Unknown attacks \\ \hline NSL-KDD & 2009 & 4 & Probe, DoS, U2R, R2L \\ \hline UNSW-NB15 & 2015 & 7 & \
\begin{tabular}{l} Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcode, Worms \\ \end{tabular} \\ \hline CICIDS2017 & 2017 & 7 &
\begin{tabular}{l} Brute Force, DoS, HeartBleed, Web \\ attack, Infiltration, Botnet, DDoS \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Datasets summary. into Probe or Other. The third distinguishes the previous unknown traffic into User to Root attack (U2R) or Other, and, the fourth level distinguishes the previous unknown traffic into Remote to Local attacks (R2L) or Other. Finally, the previous unknown traffic is distinguished between normal or unknown traffic in the fifth level. R2L and U2R are placed at the bottom level because they are similar to normal connections. At each level, a classifier is used. Their model is composed of 4 SVM classifiers at levels 1, 3, 4, and 5 and of 1 ELM classifier at level 2. They choose to use an ELM classifier to detect Probe because ELM has shown better results than SVM. After pre-processing the training set from the KDD dataset, they performed a modified K-means for feature extraction to have the 5 different categories that their solution can detect. Using their solution, they obtained an accuracy of 95.75%, which is slightly better than if they only used multi-level SVM (95.57%). In addition their hybrid model has a lower false alarm rate, 1.87%, compared to multi-level SVM at 2.17%. [PERSON] et al. [21], proposed a solution using oppositional tunicate fuzzy C-mean for detecting cloud intrusions. In their model, they first pre-processed the data and performed a normalization to have two datasets, one for training and one for testing. They performed a feature selection using logistic regression to keep the more relevant features, and they used the OPTSA and FCM clustering model. The dataset is split into C clusters using the fuzzy C-means algorithm. Once the data is clustered, they performed a cluster expansion and integration to reduce redundant clusters. They tested their solution on different datasets such as CICIDS2017 and obtained an accuracy of 80%. [PERSON] et al. [22] created an intrusion detection system for wireless networks based on the random forest algorithm. They first created a signal detection model to catch the important features of signals, then, they created the model to detect malicious nonlinear scrambling intrusion signals. An improved random forest algorithm was used to extract the spectral features of the malicious signal, and then, optimal detection of malicious traffic in a wireless network was performed using a reinforcement learning method and static feature fusion. They obtained a mean accuracy of 96.93%. [PERSON] et al. [23] created a system using an outlier detection approach to detect unknown attacks. The outlier detection approach is based on identifying data points that are isolated from clustered points. This approach uses the neighbourhood outlier factor to detect points that are not close to each other. They trialled their solution on the KDDcup99 datasets. In addition, the main advantage of their solution is its execution time which is significantly better compared to other solutions such as back propagation neural network which requires a lot of computing resources. [PERSON] et al. [24] proposed an improved solution of Naive Bayes for intrusion detection systems. The Naive Bayes algorithm is based on the Bayes equation:  
\[P(H|U)=\frac{P(U|H)*P(H)}{P(U)}\]  
where:  
* \(U\) is the data with an unknown class
* \(H\) is the hypothesis class of \(U\)
* \(P()\) is the Probability  
The Naive Bayes algorithm has an issue when one of the probabilities is 0 [25]. This results in its low accuracy when used. In their solution, [PERSON] et al.