## 2 Related Work
However, their utilized dataset is not up-to-date (KDD-Cup99 dataset dates back to 1999), consists of a large number of duplicate samples, and does not fully represent the IoT cyberattacks [40]. Another noticeable work is presented in [50], where the authors propose a feature reduction method using correlation-based methods and Information Gain (IG) to classify the network traffic into normal or attack (abnormal). However, the major disadvantage here is represented in the manual preprocessing performed over the preprocessing phase to fit the information-gain and correlation-based approaches. In contrast, [PERSON] et al. [51] proposed a wrapper approach to select relevant features and remove irrelevant features from the whole feature set to achieve higher detection accuracy using the _neurotree_ method. They conducted their model as follows: (1) removing redundant features to make an unbiased detector composed of ML algorithms, (2) employing a wrapper-based feature selection algorithm to identify a suitable subset of features, and (3) combining neurotree with IDS to achieve better detection accuracy. These three phases of wrapper-based features selection have been used to achieve a lightweight IDS system and employ a _neural ensemble decision tree_ iterative procedure to select features and optimize performance. A total of six decision tree classifiers for the proposed model are used: random tree, decision stump, naive Bayes' tree, C4.5, random forest, and representative tree model have been performed to build the detection model of an anomalous network pattern. [PERSON] et al. [25] removed one feature at a time to represent their experiments on two selected ML algorithms (SVM and neural network). Then, they applied this process to the intrusion detection dataset of the Defense Advanced Research Projects Agency (DARPA-ID-1998 dataset) to evaluate their proposal. In terms of the five-class classification (target variables) in this dataset, it was found, experimentally, that using only 34 of the \"most important\" features, rather than the complete 41-feature set, resulted in a statistically insignificant change in performance (i.e., accuracy) for intrusion detection. While in [52], [PERSON] et al. presented a wrapper-based feature selection method to build a lightweight IDS (i.e., useful in the IoT ecosystem). They performed two strategies: the first strategy is a modified random mutation hill climbing (RMHC) as the search strategy and the second strategy is a modified linear SVM as an evaluation criterion. The proposal attempts to accelerate feature selection yielding reasonable detection rates which is generally the case. Additionally, [PERSON] et al. in [32] suggested a minimal-redundancy-maximal-relevance criterion (mRMR) for first-order incremental feature selection. This standard uses a feasible methodology for selecting features at a meager cost. Using three different classifiers, they have used maximal relevance standards to compare with their proposed approach. Their experiments showed that an mRMR feature selection could meaningfully improve the classification accuracy. The technique can be used in both continuous and discrete datasets. [PERSON] and [PERSON] [53] have presented anomaly detection techniques and characterized different attack categories. Moreover, they have generated a new IoT dataset (IoITD20). In [54], [PERSON] et al. presents an IDS proposal addressing the class imbalance that includes three stages (i.e., integrated clustering, classification, and oversampling techniques). Oversampling is used to tackle the lack of a minority class problem. However, they neglected to choose features carefully. In [55], [PERSON] and [PERSON] have proposed an optimized adaptive sliding windowing (OASW) approach to secure IoT data streams. However, they did not improve their feature selection approaches. [PERSON] et al.