# Machine Learning-Based Adaptive Synthetic Sampling Technique for Intrusion Detection
## 2 Literature Review  
IoT network security researchers have created a revolutionary technique for managing and quickly identifying erroneous connections. IDS has been shown to be one of the most successful and promising tactics. By keeping an eye on computer system traffic data, it can identify recognized dangers and malicious activity, and, when this happens, notifications are sent out [12; 13; 14; 15]. The following are the primary types of intrusion detection systems:  
* An NIDS can comprise software (a console) and hardware (sensors) to regulate and watch over network traffic packets sent to and from various places in case of an intrusion or other anomaly;
* Only activity on the host system, a particular computer or server, is tracked by HIDS. It is more capable than NIDS while restricted to a single system, since it can access encrypted information transmitted across a network, such as configuration management databases, configuration files, and file attributes;
* The host, network, and fog layers make up a cloud IDS. Secure authorization for demand-based accessibility to a collaborative effort or API is offered via the cloud layer. Similarly, it builds a link between current IDS and hypervisors. There are two methods for keeping an eye out for bad behavior. The first is comparable to antivirus software's signature-based detection, whereas the second is a heuristic diagnosis, which requires comparison with conventional traffic to obtain a conclusion. Before gathering intrusion features, characterization is necessary. R2L, DoS, U2R, and probing attacks were the four categories into which [PERSON] et al. subdivided network attacks in the KDD99 dataset [15; 16; 17]. Many academics advise combining ML and IDS to recognize IoT network dangers by creating precise models. In [17], the authors evaluated naive Bayes and decision trees to determine anomalous networks. By utilizing SVM and the evolutionary technique to optimize the sampling, variables, and model parameters of SVM attributes, the authors in [18] boosted the precision of network attack identification. The authors of [19] developed a multi-level RF model to identify IoT network irregularities. The researchers in [20] combined the KNN classifier and K-MEANS clustering to enhance detection precision. The performance of the existing KNN classifier was boosted by doing this. The researchers of [21] proposed a new IDS technique that first divided the data on the IoT network into more controllable subsets for the algorithm of decision trees, and then generated multiple SVM algorithms for the subsets. As the rate of detecting unidentified attacks rises, temporal complexity is reduced [22]. The focus of Classic ML algorithms, on the other hand, is primarily on feature engineering, which uses a lot of processing power and typically only learns surface-level features, producing detection results that are less satisfactory. Many researchers have focused on the current deep learning trend to skip the feature selection step and directly input IoT network traffic data into the model. The authors of one study [23] suggested a model structure based on DBNs and PNNs to categorize the data using PNNs, which are superior to traditional PNNs, and to employ DBNs to decrease the dimension of the data. Other researchers [24] suggested an identification method based on CNNs which eliminated the requirement for explicitly defining characteristics by transforming traffic data into images. Another study [25; 26] by researchers utilized the performance of RNN networks on spectral parameters to detect botnet irregularities, effectively increasing classification accuracy. On the subject of IDS using deep learning and ML approaches, there are numerous research trends. Several of these related works are explained below. A paradigm that has sensors that pull the necessary data from the data source was suggested by [PERSON] et al. [18]. The analysis was performed using a detector. The model was constructed using many sensors and detectors.