# A Study of Network Intrusion Detection Systems Using Artificial Intelligence/Machine Learning
## 8 Discussion  
### Observations  
This study shows that the impact of machine learning is significant to improve the efficiency of IDSs, and that the quality of the dataset is an important factor that determines how efficient an IDS will be. Using well-constructed datasets is necessary and in many of the research papers reviewed here, they used labelled data to improve the training of the model. However, nowadays the size of datasets is growing and previous research shows that machine learning models are often not suitable when the dataset size grows too large. Thus, deep learning models, such as CNN are being adopted more and more by researchers to develop new solutions. These new methods learn and extract useful features from raw datasets to make NIDS efficient against zero-day attacks. In addition, NIDS need to be trained frequently with up-to-date data from real networks. However, these new solutions have a cost. They require more powerful computing resources and more time processing to train an efficient model. Table 5 shows the main advantages and weaknesses from the different reviewed solutions. The first observation that can be done is that traditional machine learning techniques such as clustering are less popular compared to deep learning techniques. Indeed, it was shown that in most cases using deep learning techniques such as neural networks significantly improved the accuracy of the IDS. In addition, to tackle the need for more computing power, the researchers use GPUs and cloud-based platforms as they help to implement more powerful deep learning methods. One of the main drawbacks that was observed in this study, is that most of the existing solutions used old datasets such as KDDcup99 and NSL-KDD to test their model. Those datasets can be out of date and not accurate with regard to real-world network traffic. In addition, it was observed that for some solutions, when recent data sets were used the accuracy of the system decreased compared to older datasets where the accuracy was excellent. Another point of concern related to most of the solutions studied is their inefficiency to detect specific attack classes that have fewer samples in their dataset. This is mainly due to a class imbalance in the dataset, which results in a lower detection rate for those classes. This is a serious issue as those minor classes could be zero-day attacks. We also observed that there is a trade-off between the complexity of the model and the number of layers used in deep learning models. The more layers used in the algorithm the more complex the model will be, and therefore, the model will require more computing resources and time. Efficient filtering \begin{table}
\begin{tabular}{l l l l l l l l} \hline \hline
**Authors** & \multicolumn{3}{l}{**Evaluation Metrics**} & & & & & \\ \hline  & **Accuracy** & **Precision** & **Detection Rate** & **F-Measure** & **False Alarm Rate** & **ROC Curves** & **Others** \\ \hline [PERSON] et al. [18] & ✓ & & & & & & \\ \hline [PERSON] et al. [30] & ✓ & ✓ & ✓ & ✓ & ✓ & & \\ \hline [PERSON] et al. [38] & ✓ & & & & ✓ & & \\ \hline [PERSON] et al. [42] & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & \\ \hline [PERSON] et al. [17] & ✓ & & & ✓ & & & \\ \hline [PERSON] et al. [21] & ✓ & & & ✓ & & ✓ & \\ \hline [PERSON] et al. [24] & ✓ & ✓ & ✓ & & & & \\ \hline [PERSON] et al. [26] & ✓ & & ✓ & & & ✓ & \\ \hline [PERSON] et al. [27] & ✓ & & ✓ & & & ✓ & ✓ \\ \hline [PERSON] et al. [41] & ✓ & ✓ & ✓ & ✓ & ✓ & & \\ \hline [PERSON] et al. [22] & ✓ & & & & & & ✓ \\ \hline \hline \end{tabular} Metrics included in previously published papers are marked as ✓.  
\end{table} 
Table 7: _Cont._and selection of the important features for the model training helps to decrease the amount of time and resources needed. Figure 4 shows the number of times each classifier was used in the literature review given in Section 6. It can clearly be seen that the researchers are using more and more deep learning techniques such as CNN or DNN.