## 2 Related Work
### Literature Review of Feature Selection Methods for Intrusion Detection Systems  
In the studies in the literature, each detection method used different feature selection techniques for intrusion detection systems. Some studies performed a filter approach to select the best subsets of the features, while others used wrapper or embedded approaches. A few studies utilized both filter and wrapper approaches together to specify the optimum subset of features. In this study, we reviewed the current state-of-the-art methods for intrusion detection systems in the literature for feature selection. Each study is evaluated based on the main idea, used techniques, and performances on applied datasets. The deficiencies of each study are also discussed, and how to improve each method is also given as a suggestion. [PERSON] et al. [21] proposed a new feature reduction technique for the KDD '99 dataset. The paper emphasized that selecting more relevant features leads to faster and more appropriate results for network attack detection. First, they used a rough set to remove the redundant properties in the dataset. Then, to obtain the most discriminant properties, the dependency ratio was determined for each class. The information gain was performed to split attributes. The test results confirmed that the performance was increased with fewer features. Figure 1: Relations between feature selection and classification processes on intrusion detection system. [PERSON] et al. [11] proposed a feature selection method based on a mutual information measure. For feature selection, they used both a linear correlation coefficient and a modified mutual information measure. The modified mutual information selection method was performed with minimum redundancy and maximum appropriateness. Feature goodness and the evaluation function were improved by forward feature selection, linear correlation, and the mutual information measure. They also used a Least Squares Support Vector Machine (LSSVM) for classification. The Least Squares Support Vector Machine was a modification of the standard Support Vector Machine. A linear equation must be unnoped in the optimization phase, which is important when avoiding local minima in SVM problems. The experiment was carried out on the KDD cup 99 datasets with high accuracy, specifically for user-to-remote (U2R) and remote-to-login (R2L) attacks. The suggested feature selection method does not include the preprocessing stage and has not been compared with other feature selection methods; thus, these deficiencies have to be avoided for better classification. Feature selection for wireless IDS, which utilizes filter and wrapper techniques, is proposed in [22]. In the feature selection phase, the information gain ratio measure and K-means algorithm were used. A neural network, which used a backpropagation algorithm, was performed for the learning and testing phases. The suggested system was designed for Wireless LAN environments. According to the paper, the number of features was reduced from 38 to 8. In addition, the accuracy of the system was improved while the learning time was reduced. The proposed approach had not been tested on new datasets or novel attacks. Furthermore, the effectiveness of the suggested system was not compared to leading techniques in the literature. To show the proposed system is suitable for current IDSs, these deficiencies need to be eliminated. [PERSON] and [PERSON] [23] suggested a hybrid feature selection method that uses binary gravitational search and mutual information techniques. The proposed method utilized the wrapper feature selection approach, which performed global search. To select the optimal feature sets and decrease the number of features further, the mutual information was integrated with binary gravitational search, which was used as a filter feature selection approach. The proposed hybrid method was tested on the NSL-KDD dataset.