# A Study of Network Intrusion Detection Systems Using Artificial Intelligence/Machine Learning
## 6 Literature Review
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline
**Authors** & **Advantages** & **Disadvantages** \\ \hline [PERSON] et al. [31] (2019) & An ensemble machine learning IDS combining Decision Tree, Random Forest, KNN, DNN and MultiTree. Weights are used to have a better accuracy during the voting process. PCA was used for feature extraction. & Model lacks in efficiency when analyzing attack that are not in large quantity. Old-fashioned dataset NSL-KDD was used. \\ \hline [PERSON] et al. [33] (2019) & An improved DBN model using a combination of Particle Swarm, Fish Swarm and Genetic algorithm. & Model is tested on old NSL-KDD dataset. Lack of feature extraction method. \\ \hline [PERSON] et al. [34] (2019) & A hybrid IDS using DNN. They used old and new datasets to test their model. & Lack of feature extraction method. In addition, the model is complex and has low detection rate for weaker attack classes. \\ \hline [PERSON] et al. [37] (2019) & A two-stage deep learning model (TSDL) using a DNN approach to detect abnormal traffic. The first stage is used to classify the traffic with a given probability. The second stage used this probability as an additional feature to improve the classification results. & They tested their solution on KDDcup99 and UNSW-NB15 datasets. However, even if they achieved a 99.996\% on the old dataset there is a 10\% gap compared to the accuracy with the recent dataset. Thus, the model still needs to be improved to reduce this gap. \\ \hline [PERSON] et al. [40] (2019) & Hybrid solution combining clustering with SVM. K-means is used to divide the data in different subsets and SVM method is performed on each of those subsets. Their solution requires less time processing compared to SVM algorithms using different parameters. \\ \hline [PERSON] et al. [18] (2020) & A NIDS using CNN which achieves excellent results on one of the most recent datasets, the CICIDS2017. \\ \hline [PERSON] et al. [30] (2020) & IDS based on Few-Shot Learning which gives good accuracy results using only a small portion of the datasets. DNN and CNN were used to perform feature extraction. Their solution was tested on an old dataset NSL-KDD and a recent dataset & Although the detection rates for U2R and R2L is not bad compared to other methods, there is still a lot of room for improvement. \\ \hline [PERSON] et al. [38] (2020) & An IDS based on two auto-encoders for feature extraction and using a soft-max classifier to detect intrusions. The model is tested on an old and a recent dataset. & The solution does not provided details about the different types of attacks. \\ \hline [PERSON] et al. [17] (2012) & A NIDS based on CNN with multi-layer perceptron that achieves good accuracy on recent dataset. & The model is complex and requires a high training time. \\ \hline [PERSON] et al. [21] (2021) & An innovative method using oppositional tunicate fuzzy C-mean for cloud intrusion. Logistic regression is used for feature selection to improve the accuracy. The model is tested on a recent dataset, the CICIDS2017. \\ \hline [PERSON] et al. [24] (2021) & A NIDS using a modified Naïve Bayes model. Feature selection is used to improve the model. & Old dataset NSL-KDD used. No detailed accuracy for the different classes of attacks is given. \\ \hline \end{tabular}
\end{table} 
Table 5: _Cont._