# A Study of Network Intrusion Detection Systems Using Artificial Intelligence/Machine Learning
## 9 Conclusions  
This paper provides a thorough study of Intrusion Detection Systems and how they could be improved using machine learning.  
Firstly, the concept of Intrusion Detection Systems was presented. There are three main types of IDS: Network Intrusion Detection System, Host Intrusion Detection System, and a Hybrid Intrusion Detection System. In addition, each type of IDS can either detect attacks by using a recorded signature or by comparing the behavior of the network with a baseline of the normal traffic or both. Then, the different metrics used to assess Intrusion Detection System by various researchers are presented. The most important metrics are the Accuracy, the Detection Rate (Recall) and the F-Measure. A general overview of what is machine learning, and a global taxonomy is also discussed. There are three types of machine learning techniques: Supervised, Semi-supervised and Unsupervised. Most of the machine learning techniques studied fall into one of these categories. A comprehensive review of recently published papers using machine learning for IDS was also discussed. Based on this study, the recent trends show that deep learning methods are more and more used to detect attacks. However, this increases the complexity of the models which requires more computing resources. In addition, it was shown that more and more solutions are using feature extraction with Auto-Encoder as one of the techniques used.  
This study also shows that 56% of the proposed IDSs were tested using KDDcup99 and NSL-KDD which are both old datasets. Therefore, these datasets by themselves are not enough to verify the effectiveness of their solution, and, an up-to-date dataset must be created. This new dataset should provide enough instances of minor classes, which have a very low detection rate, and recent attack instances in a real environment. Finally, this work highlights the main issue for IDS is their complexity and their low accuracy for minor classes. In addition, future research trends are presented with the idea presented of a NIDS framework that would continuously be improved using cloud computing.  
Future work proposed includes the development of a solution, that can address encrypted network traffic by extracting traffic features to facilitate abnormal instance detection while decreasing required computing resources.  
Conceptualization, P.V., T.N., L.L.D. and M.R.; methodology, P.V. and T.N.; validation, P.V., T.N., L.L.D. and M.R.; investigation, P.V.; resources, T.N., E.O., D.O. and B.L.; data curation, P.V., L.L.D. and M.R.; writing--original draft preparation, P.V. and M.R.; writing--review and editing, T.N., L.L.D. and M.R.; supervision, M.R. and T.N.; funding acquisition, T.N., E.O., D.O. and B.L. All authors have read and agreed to the published version of the manuscript.  
This work was supported, in part, by Science Foundation Ireland grant number 16/RC/3918 to the CONFIRM Science Foundation Ireland Research Centre for Smart Manufacturing and co-funded under the European Regional Development Fund. This work additionally received support from the Higher Education Authority (HEA) under the Human Capital Initiative-Pillar 3 project, Cyberskills.  
**Informed Consent Statement:** Not applicable.  
**Acknowledgments:** Thank you to the Department of Electronic and Computer Engineering at the University of Limerick for supporting this work as part of the Masters in Information and Network Security programme.  
**Conflicts of Interest:** The authors declare no conflict of interest.