## 2 Literature Review
### Machine Learning  
The significance of integrating ML into the field of cybersecurity has escalated due to its ability to rapidly assess and detect various forms of threats from a vast number of events [15]. Moreover, ML is a methodology used to automate the procedure of constructing analytical models by using data, whereby the models acquire the ability to make judgments via learning [16]. There are two primary categories of ML algorithms, with the first category consisting of shallow models. The second approach under consideration is deep learning, as mentioned by [17]. According to [18], the categorization of learning algorithms is based on the manner in which data are used, resulting in four distinct types: unsupervised, semi-supervised, supervised, and reinforcement learning. In contrast, there exist four distinct categories of ML that possess independent learning characteristics. These categories include information-based learning techniques, similarity-based learning techniques, probability-based learning techniques, and error-based learning techniques. Collectively, these categories are commonly referred to as the ML family [19; 20]. Table 1 presents a comprehensive overview of the ML family and its corresponding algorithms. Table 2 presents the advantages and disadvantages of ML.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**ML Family** & **Description** & **Algorithms** \\ \hline Information-based learning & Building models based on information theory concepts. & Random Tree, Random Forest, J48, HoeffdingTree, REPTree, and DecisionStump \\ \hline Similarity-based learning & Comparing known and unknown things or measuring the degree of similarity between past and future events. & k-NN and k-means (Simple k-means, Canopy, and Hierarchical) \\ \hline Probability-based learning & Developing a model based on measuring the probability of an event occurring. & Naive Bayes \\ \hline Error-based learning & Building a model that minimizes the total error by using a set of training instances. & SVM, Logistic Regression, Perceptron, Winnow, and deep learning \\ \hline \hline \end{tabular}
\end{table}
Table 1: Overview of ML families and algorithms.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**ML Family** & **Advantages** & **Disadvantages** \\ \hline Information-based learning & \(\bullet\) & Interpretable and straightforward. & \(\bullet\) \\ \(\bullet\) & Captures interaction between descriptive and defining features. & \(\bullet\) \\ \(\bullet\) & Easy to interpret. & \(\bullet\) \\ \(\bullet\) & Handles a wide range of descriptive features. & \(\bullet\) \\ \(\bullet\) & Fast and efficient. & \(\bullet\) \\ \(\bullet\) & Suitable for categorical input variables. & \(\bullet\) \\ \(\bullet\) & \(\bullet\) & \(\bullet\) \\ \(\bullet\) & \(ML has made restorative diagnosis, cancer detection, computer vision, social media marketing, smart transportation, and gaming possible [21]. ML techniques are preferred over traditional rules-based learning algorithms for human intervention in various industries. As a result, ML has a significant role in cybersecurity [21]. In addition to identifying malicious activities and vulnerabilities in real time, it also enhances the overall security posture of the system [21].