# A Study of Network Intrusion Detection Systems Using Artificial Intelligence/Machine Learning
## 6 Literature Review
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Authors** & **Advantages** & **Disadvantages** \\ \hline [PERSON] et al. [23] (2015) & An outlier detection approach for IDS. The neighborhood outlier factor is used to detect isolated points. Compared to back propagation neural network the execution time is significantly better. & Old dataset KDDcup99 was used, and no information was given on the accuracy for the different types of attacks. \\ \hline [PERSON] et al. [20] (2017) & A Hybrid multi-level model merging SVM and ELM. The model is divided into 5 levels, with each level responsible to detect one categories of attack. In addition, they used Modified K-means for feature extraction. They achieved a better overall accuracy compared to multi-level SVM and ELM. & Old dataset used for the model. The accuracy for R2L and U2R attacks is very low. \\ \hline [PERSON] et al. [19] (2018) & An ensemble approach combining three algorithms: Naive Bayes, PART, and Adaptive Boost with an average voting result to decide the outcome. Feature extraction methods are used. & The dataset used, KDDcup99, is very old. There is no description on how well the model can classified the different categories of attacks. \\ \hline [PERSON] et al. [32] (2018) & Use of a multi-layer ensemble SVM to detect abnormal traffic. DBN was used for feature extraction before forwarding the result to the ensemble SVM and the voting algorithm. They tested their solution on old and recent datasets KDDCup99, NSL-KDD, UNSW-NB15, and CICIDS2017. & When more layers are used, the model is more time consuming. Lack of information on the different attacks classes that are identified. \\ \hline [PERSON] et al. [35] (2018) & A Non-symmetric Deep Auto-Encoder (NDAE) and random forest model to detect abnormal behavior. They used two NDAE that they stacked for feature extraction. Compared to a DBN solution they obtained good accuracy. & Their solution struggles to detect small classes such as R2L and U2R on old datasets. \\ \hline [PERSON] et al. [36] (2018) & A NIDS using Stacked Sparse Auto-Encoder (SSAE) for feature extraction and SVM as classifier. Their solution reduces significantly the time required for training and testing & Old dataset NSL-KDD is used, and their model has a low detection rate of U2R and R2L attacks. \\ \hline [PERSON] et al. [39] (2018) & Use of Fast Learning Network (FLN) and particle swarm optimization to detect abnormal traffic. & Model is tested on old KDDcup99 dataset and has low accuracy when identifying one of the small classes. \\ \hline [PERSON] et al. [28] (2019) & CNN model for IDS using PCA and Auto-Encoder for feature extraction. & Old dataset KDDcup99 is used, and their model has a low detection rate of U2R and R2L attacks. \\ \hline [PERSON] et al. [29] (2019) & A multi-layer model combining random forest technique with CNN. They achieved an outstanding accuracy of 99.24% on a combination of two recent datasets UNSW-NB15 and CICIDS2017 compared to the single algorithms. The accuracy on each attack class is given. & Lack of feature extraction method. \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Summary of Literature Review (IDS model advantages and disadvantages).