## 2 Related Work
[PERSON] [25], on the other hand, employed stacked autoencoders to process raw network traffic data directly, resulting in a reduction in features from 41 to 22. The accuracy in this case reached 97.85%, although with a slightly higher FAR of 2.15%. [PERSON] and his colleagues [26] introduced a novel two-stage deep learning (TSDL) model that utilizes a stacked autoencoder with a softmax classifier. The model consists of two decision stages: (1) an initial stage that classifies network traffic as normal or abnormal using a probability score; and (2) a final decision stage that differentiates between the normal state and other attack classes. By employing this approach, the required number of network features is reduced from 41 to 10. Comparative simulation results reveal that our TSDL model achieves high detection rates reaches to 99.996% and decreases the false alarm rate to a mere 0.0001. [PERSON] et al. [7] proposed a novel ensemble for feature selection using a DNN (EFS-DNN) to handle high-volume traffic data. A light gradient boosting machine (LightGBM) was used to specify the optimal set of features. In addition, these researchers employed DNNs, batch normalization, and embedded techniques as classifiers to improve the detection accuracy, which reached 99.92% upon reducing the number of network features from 41 to 14. [PERSON] et al. [27] utilized an autoencoder (AE) to diminish interference features and employed a convolutional neural network (CNN) for ID. [PERSON] [28] introduced long short-term memory (LSTM) to examine the correlation of intrusion information, which ultimately reduced false alarms. [PERSON] et al. [29] proposed an ID model based on genetic algorithms (GA) and extreme learning machine (ELM) to determine the optimal set of model parameters. In addition, the researchers in [30] have presented a model for ID by combining very deep convolutional neural networks (VDCNN) and Gated Recurrent Unit (GRU). Within this model, the data are processed using One-Hot encoding and normalization. Subsequently, the VDCNN and GRU models are employed to extract data features. Eventually, these two types of features are combined to form new data features, which are then passed to the Softmax classifier. The experiment was conducted using KDD99. The results of the experiment demonstrate that the accuracy of detection was 98.73%. Moreover, researchers [31] proposed an IDS that applies an ensemble feature selection (EFS) technique and an SVM (SVM-IDS). After conducting experiments on the KDD99 dataset, the number of network features was reduced to 20, and the proposed SVM-IDS achieved an AC of 98.95%. Furthermore, the researchers in [32] have proposed the IFMN model as a deep learning architecture for ID in IoT networks, which focuses on using a feature selection model and a decision tree classification method. The model for selecting features utilizes a Hybrid Yellow saddle goatfish algorithm and a particle swarm optimization algorithm (HYFSPSO) in order to discern the most advantageous features. The efficacy of the chosen features is evaluated via performance matrices, and the proposedHYSGPSO-DL based IDS approach achieves high accuracy reaches 99.53% on benchmark datasets such as KDD-CUP99. These researchers have made significant contributions in the field of ID, particularly by demonstrating the suitability of the KDD99 dataset for evaluating various ID methods. However, there is often an overemphasis on detection accuracy without sufficient consideration of false alarms. To improve the efficiency and effectiveness of detection systems, it is crucial to select relevant features that accurately indicate potential intrusions. In addition, optimization techniques such as genetic algorithms (GA) combined with novel selection methods like cuckoo selection can be employed to fine-tune the entire detection process using the XCS. In the present study, the XCS has been implemented, tested, and evaluated using the KDD99 dataset since no standard dataset is available.