# RDTIDS: Rules and Decision Tree-Based Intrusion Detection System for Internet-of-Things Networks
## 2 Relevant Work
\begin{table}
\begin{tabular}{c l l l l} \hline
**Year** & **Paper** & **Machine Learning and Data Mining Methods** & **Cyber Approach** & **Data Used** \\ \hline
2009 & [PERSON] et al. [9] & - Packet header anomaly detection & Hybrid IDS, which combing anomaly-based IDSs & IDEVAL \\  & - Network traffic anomaly detection & & & \\ \hline
2010 & [PERSON] et al. [10] & - Artificial neural networks & Hybrid IDS, which the fuzzy aggregation module & KDD CUP 1999 \\  & - Fuzzy clustering & & is employed to aggregate the results & \\ \hline
2011 & [PERSON] and - Multilayer perceptron neural network & Neural based hybrid IDS & UNM Send-Mail Data \\  & [PERSON] [11] & - Radial basis function neural network & & \\ \hline
2012 & Change and - Intelligent dynamic swarm & Hybrid IDS & KDD CUP 1999 \\  & [PERSON] [12] & - Simplified swarm optimization & & \\ \hline
2013 & [PERSON] et al. [13] & Random forests algorithm & Combining misuse and anomaly detection into a & KDD CUP 1999 \\  & - K-means clustering algorithm & hybrid framework & \\ \hline
2014 & [PERSON] et al. [14] & - C4S decision tree algorithm & Combining misuse and anomaly detection into a & NSL-KDD \\  & - Support vector machine model & hybrid framework & \\ \hline
2015 & [PERSON] et al. [15] & - N-Nearest Neighbor (A-NN) classifier & Combining cluster centers and nearest neighbors & KDD CUP 1999 \\ \hline
2016 & [PERSON] et al. [16] & - Support vector machine & Hybrid IDS & \\  & - Genetic algorithm & & & \\ \hline
2017 & [PERSON] et al. [17] & Random tree & Combining classifier model based on tree-based & NSL-KDD \\  & - C4S decision tree algorithm & algorithms & \\ \hline
2017 & [PERSON] et al. [18] & - Support vector machine & Hybrid IDS & KDD CUP 1999 \\  & - Extreme learning machine & & \\  & - K-means clustering algorithm & & & \\ \hline
2018 & [PERSON] et al. [5] & Repeated Incremental Pruning to Produce Error, Reduction (RIPPER), RBF Network & Combining probability predictions of a tree of & KDD CUP 1999 + \\  & (RNN), Riple-down rule learner (Ridor), and Random Forests & classifiers & NSL-KDD \\  & - Naive Bayes (NB) & & & \\ \hline
2018 & [PERSON] et al. [20] & 48, Meta Paging, RandomTree, RFPree, AdaBoostM1, DescriptorSum, and NaiveBayes & Hybrid IDS, which combing anomaly-based IDSs & NSL-KDD \\ \hline
2019 & [PERSON] et al. [21] & Recurrent neural networks & Hybrid IDS, which combing recurrent neural networks with blockchain & \\ \hline
2019 & [PERSON] et al. [22] & Random subspace learning & Hybrid IDS, which combing random subspace learning with blockchain & Power System dataset \\ \hline
2019 & [PERSON] et al. [23] & Deep learning techniques & Hybrid IDS, which combing deep learning & CSE-CIC-IDS2018 dataset \\ \hline RDTIDS & - RBF Tree & Hybrid IDS, which combing classifier model & CICIDS2017 \\  & - Rip algorithm & based on tree-based algorithms & \\ \hline IDEVAL: MIT Lincoln Laboratories network traffic data; KDD CUP 1999: The data set is based on DARPA 1998 TCP/IP data and has basic features captured by pcap (with about 4 million records of normal and attack traffic); UNM Send-Mail Data: The data set is based on an immune system developed at the University of New Mexico; NSL-KDD: A modified version of KDD’99 data set, which it does not include redundant records in the train set; CICIDS2017: The dataset contains benign and the most up-to-date common attacks, which resembles the true real-world data (PCAPs) developed at Canadian Institute for Cybersecurity (University of New Brunswick) [24]. \\ \hline \end{tabular}
\end{table} 
Table 1: Related works on hybrid intrusion detection systems. [PERSON] and [PERSON] [12] approach the problem of decision rules generation by employing intelligent dynamic swarm-based rough set (IDS-RS) for feature selection and simplified swarm optimization with weighted local search (SSO-WLS) strategy for data classification. The study provides a full system solution for improving the searching process in SSO rule mining by weighing three predetermined constants.