## 2 Review of Existing Work
### Intrusion Detection with CICIDS Dataset  
The study in [21] tried to enhance the classification rate and avoid FPs (False Positives). To accomplish this, ideal features were selected. An intrusion detection model has been suggested based on ML methods such as DTs (Decision Trees), SVM and RF (Random Forest). After the model's training, an ensemble method-based voting classifier was integrated, which attained a 96.25% accuracy rate. Further, the suggested system also incorporated explainable AI, which contributed to attaining better outcomes. Moreover, [PERSON]. [22] assessed the performance of the CICIDS-2017 dataset when employing various ML classifiers, such as CNN (Convolutional Neural Network), RF (Random Forest) and NB (Naive Bayes). Among these other classifiers, RF showed satisfactory performance. Unlike CICIDS-2017, some works have also used the CICIDS-2018 dataset [23]. Accordingly, the study in [24] employed an approach that improves time effectiveness and enables better intrusion detection. The LightGBM (Light Gradient Boosting Machine) has been utilized for constructing a model that accords with the considered dataset. The suggested system achieved 97.73% accuracy. As an enhancement, Ref. [25] integrated the NTLBO (New Teaching Learning Based Optimization Algorithm), ELM (Extreme Learning Machine), LR (Logistic Regression) and SVM to perform the selection of subsets of features. Experiments have been undertaken on identifying intrusion from ML datasets, such as CICIDS-2017, wherein significant improvements have been made, reaching 97% accuracy.  
Similarly, Ref. [26] used an enhanced intrusion detection system to perform binary classification. This work included various optimizers, such as Rao Optimization, SVM, LR and ELM, as well as hybrid Rao-SVM, with supervised ML methods for the selection of feature subset. The selection of fewer features without a loss of accuracy in selecting feature subsets has been regarded as the primary aim of optimization. The developed model showed a 97% accuracy rate when applied to the considered CICIDS dataset. Similarly, Ref. [27] used the CICIDS dataset. Duplicate information was eliminated. Subsequently, with the use of specific software, the dataset was reformatted into a compatible form with the WEKA tool. Subsequently, eight ML algorithms (AdaBoost, MLP (Multi-Layer Perceptron), NB, KNN (K-Nearest Neighbor), J48, QDA (Quadratic Discriminant Analysis), ID3 (Iterative Dichotomizer 3) and RF) were utilized. After assessing the efficacy of the suggested system, the j48 method was chosen. Furthermore, in accordance with the outcomes of the j48 classifier, expert rules were created that could respond to intrusions in the network.  
Furthermore, IDSs have been developed with embedded expert rules. These expert rules were executed in the snort-rule language. The snort operates via the network IDS method, and rules files were accessed as described in the snort configuration. This system achieved a better accuracy rate of 98%. Likewise, [PERSON]. [28] employed a bottleneck layer approach to the CICIDS-2107 dataset so as to confirm its better performance. This performance was achieved with the incorporation of DL algorithms, such DNN (Deep Neural Network) and ANN, and has been compared with those of conventional DNN, SVM and ANN. Experimentation revealed the 92.35% accuracy of DNN, while the accuracy rate was found to be 90.98% when using ANN. In addition, Ref. [29] utilized SVM. Two other methodologies have also been benchmarked--NB and DT. The results reveal that SVM reached 76.47% accuracy when applied to the CICIDS dataset, whereas DT reached 63.71% accuracy, while NB reached 41.58% accuracy.