## 2 Literature Review
### Related Work
#### 2.3.5 Hybrid Models  
[PERSON] and [PERSON] [33] has developed a new IDS model using RFE feature selection and CNN algorithms. The model uses three layers of CNNs and multiclass classification, with accuracy determined on the MQTT-IoT-IDS2020 dataset. They used only CNNs in their research study. The model was trained on the CICIDS2018 and Edge IIoT datasets, with 100% accuracy rates with and without GPUs. In Edge IIoT datasets with a GPU, the accuracy rates was 99.46%, and without a GPU, it was 99.62%. However, the model requires considerable training time and has limitations due to the costs associated with computationally expensive training data, as well as the quality of the data used in training. With the increasing sophistication and number of attacks, anomaly-based NIDSs may become more difficult to use when handling a large number of data, making them an alternative for IoT networks. [PERSON] et al. 's [34] research work aimed to integrate deep learning and ML to improve detection rates while maintaining reliability. They tested various algorithms, including KNN, RF, DT, CNN, ANN, MLP, and deep learning. According to the SMOT algorithm's balance of data and XGBoost, the RF model was the most accurate. They used two datasets to evaluate their model: KDDCUP'99 and CIC-MalMem-2022. It is recommended that the proposed model consider environmental factors such as network traffic and bandwidth. Also, [PERSON] et al. [35] developed a hybrid NIDS model that uses improved Random Forest techniques (IRF), genetic algorithms, and particle swarm optimization (EGA-PSO) techniques. By using a multi-objective function, the model reduces dimensions, identifies key features, enhances the GA, selects the best feature, and improves fitness results. Iterative training removes less critical features, incorporates decision trees, and monitors classification accuracy to avoid overfitting. The HNIDS approach achieves 98.97% accuracy in BCC and 88.14% accuracy in MCC, outperforming SVM, RF, LR, NB, and LDA on the NSL-KDD datasets. The study measured four parameters, accuracy, TPR, precision, and FPR, without considering CPU utilization and time. [PERSON] et al. [36] used deep learning techniques in ImmuneNet to recognize attacks. The framework achieved high performance and accuracy through the use of multiple feature engineering processes, oversampling methods, and hyperparameter optimization. Data from CIC IDS 2017, CIC IDS 2018, and CIC Bell DNS 2021 were compared by using XGB, Random Forest, Decision Trees, and Logistic Regression. On the CIC Bell DNS 2021 dataset, ImmuneNet achieved an accuracy rate of 99.19%. However, the model cannot learn independently, requiring significant time and effort. The study by [PERSON] et al. [37] used RF, SVM, DT, and an ensemble Voting classifier to create an IDS with 96.25% accuracy on the CICIDS-2017 dataset. It highlighted the importance of trust in human-machine interaction success. The Learnable Machine Interface made predictions easily understood, facilitating model selection, trust assessment, and the improvement of models. However, the study used a single dataset, which may not reflect real-world scenarios or data distributions, and did not address privacy, accountability, or trust issues in intrusion detection. Also, [PERSON] and [PERSON] [38] explored ML techniques for analyzing assaults. They proposed CAPPER, which uses high-accuracy algorithms with low false positive rates to select the best feature subsets for hybrid NID-Shield NIDSs. The algorithm uses CFS and Wrappers to select feature subsets, ensuring a free-from-duplicate set. Filtering and wrapping approaches are combined to produce accurate and high-quality feature sets. The hybrid CAPPER algorithm achieved a performance accuracy of 99.89% on the UNSW NB15 and NSL-KDD20% datasets. However, the model was not evaluated against a recent dataset to determine if it reflects the latest attack trends.