## 2 Background and Literature Review
\begin{table}
\begin{tabular}{c c c c} \hline
[18]/2021 & x & x &
\begin{tabular}{c} Proposes a Bayesian optimization framework for automatically turning hyperparameters of deep neural networks (DNNs) used in network intrusion detection systems. Evaluated on the NSL-KDD dataset, the framework significantly outperforms random search methods in terms of accuracy, precision, recall, and F1-score, providing an efficient and scalable solution for optimizing DNN-based intrusion detection. \\ \end{tabular} \\ \hline
[13]/2020 & x & x &
\begin{tabular}{c} Introduces a hybrid intrusion detection method named MGA-SVM-HGS-PSO-ANN. It uses a wrapper-based feature selection technique (MGA-SVM) and a neural network trained with a hybrid of gravitational search and particle swarm optimization. Using the NSL-KDD dataset, the model achieves 99.3\% accuracy, reduces features from 42 to 4, and trains in 3 s. \\ \end{tabular} \\ \hline
[19]/2023 & x & x &
\begin{tabular}{c} The study introduces an ensemble intrusion detection model using lightweight classifiers, Gaussian Naive Bayes, Logistic Regression, and Decision Tree, with Stochastic Gradient Descent as the meta-classifier. It employs Chi-square-based feature selection and demonstrates superior performance on KDD 1999, UNSW-NB15, and CIC-IDS2017 datasets for both binary and multiclass classifications. \\ \end{tabular} \\ \hline
[20]/2021 & x & x &
\begin{tabular}{c} This study presents an ensemble intrusion detection framework that ranks base classifiers by F1-score for each attack category, selecting the most effective one per class instead of relying on traditional voting. This targeted ensemble approach achieves 96.97\% accuracy and improves detection rates across diverse multi-attack classification environments. \\ \end{tabular} \\ \hline
[21]/2021 & x & x &
\begin{tabular}{c} This study introduces a binary classification model for IoT intrusion detection using a Gradient Boosting Machine ensemble. The model is trained on preprocessed packet data to detect anomalies, particularly zero-day attacks. It achieves high performance with 98.27\% accuracy, demonstrating its suitability for critical IoT applications. \\ \end{tabular} \\ \hline
[22]/2021 & x & x &
\begin{tabular}{c} This study proposes an ensemble-based intrusion detection system that integrates NNN, SVM, and Dempster-Shafer theory to manage uncertainty in classification. Deep learning is used for feature extraction, and ensemble margin-based sample selection improves training efficiency. The method outperforms existing models on UNSW-NB15, CICIDS2017, and NSL-KDD benchmark datasets. \\ \end{tabular} \\ \hline
[22]/2021 & x & x &
\begin{tabular}{c} The model is binary-only and tailored to static datasets, lacking support for multiclass attack detection, real-time operation, or interpretability. \\ \end{tabular} \\ \hline The model lacks real-time detection capability and does not incorporate explanationability features. Unlike our approach, it does not demonstrate live deployment or interpret model outputs using XAI, limiting transparency and real-world usability in critical network environments. \\ \end{tabular}
\end{table} 
Table 1: _Cont._Overall, unlike many of the referenced studies that either focus on static offline analysis, lack explainable AI integration, or omit real-time deployment, our study introduces a unified, cloud-enabled intrusion detection system that excels in adaptability, accuracy, and transparency where it excels in the following:  
* Real-time cloud-based detection: Our framework integrates live network traffic capture within a cloud environment (e.g., AWS), enabling continuous monitoring and immediate anomaly detection, a capability often missing in previous works. * Hybrid ensemble learning: By combining an ANN and SVM as base classifiers with an RF meta-classifier, our approach leverages the strengths of both DL and traditional ML. This hybrid model achieves superior performance over standalone models.