## 2 Related Work
### Literature Review of Feature Selection Methods for Intrusion Detection Systems
The assessment of intrusion detection systems (IDSs) encompasses various parameters, with a primary focus on the chosen feature selection technique for distinguishing between malicious and legitimate activities [36]. The study was structured to identify an efficient feature selection method that enhances classifier accuracy for intrusion detection systems. First, they introduced a Hybrid Ant-Bee Colony Optimization (HABCO) approach, which transforms the feature selection challenge into an optimization task. Then, the performance of HABCO in conjunction with BHSVM, IDSML, DLIDS, HCRNNNIDS, ANNIDS, SVMTHIDS, and GAPSAIDS was evaluated. The findings demonstrated that HABCO outperformed the mentioned methods, yielding notably higher accuracy. [PERSON] and [PERSON] presented an intelligent intrusion detection system tailored for identifying intruders within IoT-based wireless sensor networks [37]. In developing this advanced IDS, the feature selection algorithm rooted in rules and Multi-Objective Particle Swarm Optimization (PSO) was introduced. Additionally, they put forth an intelligent rule-based approach that enhances the performance of Multi-Class Support Vector Machines for more precise intruder identification. An experimental test was performed on the KDD '99 Cup and CIDD datasets. The test results demonstrated that the suggested IDS considerably improves intruder detection accuracy while reducing false-positive rates. Evaluation of Feature Selection Methods in the Literature  
From the literature, different feature selection techniques have been summarized based on the main ideas, proposed methods, and obtained performances for intrusion detection systems. Filter as well as wrapper approaches are used in various studies to select the best subsets of features. In some studies, an embedded approach is performed as well. Even though most studies use the filter or wrapper approaches, the techniques that are used to specify the subset are varied. A summary of each feature selection method in the literature which uses different techniques can be seen in Table 1. Generally, each study tested their approach on only one or two datasets, which cannot be generalized and used for current IDSs, or the proposed methods were not good enough to detect and classify new attack types. During the feature selection process, some irrelevant features are chosen that increase the detection and accuracy rate while decreasing the false-positive and -negative rates (Table 1). However, most of the approaches were tested on old datasets that do not contain unknown attacks and they have not been performed on real network intrusions. It can be said that selecting the most significant subset of features before performing the learning process increases the model performance when distinguishing attack traffic from the normal one. This is because during the feature generation process, irrelevant, noisy, and unrelated features are being created. Furthermore, certain properties may be seen in intrusions as well as normal network traffic. Moreover, old intrusion detection datasets contain redundant features that decrease the detection and accuracy rates. Eliminating the redundant, irrelevant, or less-significant features enhances the learning process as well as the detection and accuracy rates while decreasing the false-negative rates. Our presented method, which consists of various techniques and algorithms, is designed to overcome the deficiencies that are mentioned in the literature and makes necessary contributions by selecting the best features for the classification process.