# A Systematic Review on Hybrid Intrusion Detection System

Authors: Elijah M. Maseno; Zenghui Wang; Hongyan Xing
Journal: Security and Communication Networks
 (2022)

---

## Abstract

As computer networks keep growing at a high rate, achieving confidentiality, integrity, and availability of the information system is essential. Intrusion detection systems (IDSs) have been widely used to monitor and secure networks. The two major limitations facing existing intrusion detection systems are high rates of false-positive alerts and low detection rates on zero-day attacks. To overcome these problems, we need intrusion detection techniques that can learn and effectively detect intrusions. Hybrid methods based on machine learning techniques have been proposed by different researchers. These methods take advantage of the single detection methods and leverage their weakness. Therefore, this paper reviews 111 related studies in the period between 2012 and 2022 focusing on hybrid detection systems. The review points out the existing gaps in the development of hybrid intrusion detection systems and the need for further research in this area.


---

## Body

## 1. Introduction

The Internet has thrived, hence an increase in information sharing, making network security a problem of concern. Attackers around the globe have their eyes on computer systems with the motive of deploying attacks. The security of an electronic device is breached when a successful attack occurs. Intrusion is defined as “any set of actions that attempt to compromise the integrity, confidentiality, or availability of a resource” [1]. The Integrity aspect of a given infrastructure serves to ensure information remains unaltered by unauthorized users. Availability incorporates all aspects of the infrastructure that makes information readily available to users in the system. Confidentiality implies that the information in a given system is protected from unauthorized access and viewing by external parties. Therefore, a computer network is considered to be fully secured when the core objectives of these three attributes are sufficiently met. To help achieve these objectives, intrusion detection systems have been developed with the primary intent of monitoring incoming traffic in computer networks for any potential malicious intrusions.An intrusion detection system (IDS) scans information system resources and reports any malicious activities in the system. More advanced IDSs have the capability of acting against the attacks. The action taken by this advanced IDS is to block the malicious users or activities from accessing the computer resources. We have two major categories of intrusion detection systems, which include misuse based and anomaly based. Misuse-based IDSs are developed to flag known attacks using patterns of the known attacks [2]. Misuse detection systems use patterns of well-known attacks or weak spots of the system to match and identify known intrusions. The positive side of misuse IDS is the ability to detect known attacks with great precision. The major challenge facing this type of IDS is their inability to flag new forms of attacks [3]. Misuse intrusion detection systems stand out because of their ability to flag many or all known attack patterns. The main problem facing misuse-based systems is the inability to flag emerging attacks or zero-day attacks. In general, they have a high rate of detection and low rate of false alarms compared to anomaly-based systems. The anomaly-based technique stores the normal behavior of a user in a database and compares it with the current behavior of the user [4]. If there is a substantial difference, then there is something wrong or abnormal. The major advantage of anomaly detection is that it does not require information of known attacks, and thus they can detect new forms of attacks. It has a high rate of false alarm compared to misuse-based IDS.Hybrid intelligent systems have been developed to solve the challenges of the existing intrusion detection systems, such as high rate of false-positive alerts and low detection rate of novel attacks. Hybrid is a technique that combines misuse-based and anomaly-based techniques [5]. The hybrid technique resolves the disadvantages of the two legacy IDSs. Research shows that hybrid detection systems have better performance compared to single IDS.Despite their proven performance, hybrid intrusion detection systems remain largely unexplored as seen from the few number of existing systematic literature reviews on the topic. This work, therefore, attempts to perform a comprehensive systematic literature review on hybrid intrusion detection systems between 2012 and 2022 with the objective of pointing out existing gaps in the development of these systems.This study is arranged as follows. Section2 introduces and discusses IDS. Section 3 provides a discussion on hybrid detection techniques. Section 4 discusses the methodology adopted in this paper. Section 5 discusses the findings. Section 6 points out the existing gaps in the reviewed literature and insights for future research. Table 1 summarizes all hybrid intrusion detection systems between the periods of 2012 and 2022. Finally, Table 2 lists all abbreviations in this study.Table 1
A summary of all hybrid intrusion detection systems between the periods of 2012 and 2022.
IDReferenceDatasetStrength/weaknessC1[34]Flow-based datasetThe model demonstrated high-speed intrusion detection in large network infrastructure through data reduction and processing time.C2[35]KDD′99 datasetAccording to the evaluation results, when choosing the optimum parameter like feature size reduction, the overall performance of the intrusion detection system improves.C3[36]KDD datasetThe proposed algorithms detect intrusion simultaneously and their output is combined using the rule-based method. The model is tested using the KDD dataset and records an outstanding performance.C4[37]Kyoto 2006 + datasetThe researchers proposed the use of K-medoids instead of K-means in data clustering. K-medoids performed better compared to K-means clustering. Naïve Bayes was used for classification.The researchers observed that with the use of K-medoids clustering, processing time increases as the data grow. How to manage time forms a future research gap.C5[38]Kyoto 2006 + datasetsThis model was developed to tackle the problems of a previous work in which the researchers combined K-medoids clustering and Naïve Bayes classification. To further improve the performance of intrusion detection on this model, the researchers combined support vector machine classification with K-medoids clustering. The model recorded better performance. Still, time management is an issue in this model as the previous one.C6[39]KDD Cup99 datasetThe model uses a double classifier based on AdaBoost with J48 base learner and Bayesian network classifier. The model performed better than J48 and Bayesian cascaded classifier.C7[40]KDD99 datasetThe model performed better compared to pure SVM in terms of detection rate, training time, and false negative and false positive. In addition, it performed better than pure CSOACN in terms of less training time with comparable detection rate and false alarm rates.In the future, further performance analysis can be conducted using other algorithms.C8[41]KDD99 datasetIn this model, GA and SOFM were used for feature extraction on the dataset. The goal was feature reduction on the dataset to be used in training SVM. In this study, SVM was deployed as a classification algorithm. The model performed better compared to SVM.C9[42]NSL-KDDAt the first stage of the model, PCA is used for feature reduction. The second stage of the model deploys genetic algorithms for the anomaly detection process by labeling the dataset as either normal or anomaly. The final stage uses different types of classifiers for confirmation if the datasets are labeled properly and give detailed information of the attacks.The model was able to demonstrate the importance of combining different machine learning algorithms for intrusion detection.C10[43]CAIDA UCSD 2007 datasetProposed a model to detect DDoS attacks, and the model combines GA and multilayer perceptron (MLP) of ANN. GA is used in feature selection while MLP is used for classification.C11[44]KDD Cup 1999The model recorded a true-positive value of 0.973 and false-positive value of 0.017, which was an outstanding performance. The model needs further evaluation using current datasets.C12[45]KDDcup’99The researchers report that the model achieved a high detection rate and low false-positive rate, but at the same time, they acknowledge the need for further evaluation of the model using different datasets in the future.C13[46]KDD CUP 99Particle swarm optimization has been used in this model to select optimal parameters for multiple criteria linear programming. The model recorded a better performance in terms of accuracy and running time compared with the MCLP model. The model should be further investigated using KDD CUP 99 for its capabilities of detecting different attacks simultaneously.C14[47]KDDCUP′99 datasetThe research demonstrated the importance of feature selection in intrusion detection. With reduced features, the model was able to improve accuracy rate and detection rate; at the same time, false alarm rate decreased. Evaluation of the model using only one dataset is not enough, and the model needs to be evaluated using another dataset in the future.C15[48]KDD CUP99 dataThe system provides advantages such as feature reduction on the training dataset which improves the performance of intrusion detection systems.C16[49]NSL-KDDProposed K-means and Naïve Bayes classifier for hybrid intrusion detection. K-means was used for data clustering to reduce dataset features, while Naïve Bayes classifier was deployed for classification of the features as normal or attack. The model recorded a better performance in the detection of probe, R2L, and U2R attacks.C17[50]NSL-KDD datasetIn this model, AGAAR is used for feature learning and reduction. The model uses GPLS for the classification of the dataset as normal or attack. The researchers used only a presentation of the dataset to train the model.C18[51]NSL-KDDThe researchers demonstrated that combining classifier algorithms using the sum rule approach has the potential of providing good results compared to single classifiers. The model outperformed a single classifier.C19[52]KDD CUP 99 datasetIn this research, the K-means algorithm was used for classification while J48 was used for feature selection. SOM increased the accuracy rate of the system.The system registered high computation and longer processing time which affected its performance.C20[53]KDDCUP 99 datasetThe dataset will be fed simultaneously into the parallel algorithms; if both algorithms define the data as normal, the data will be classified as normal. If both classifiers classify the data as an attack, ACO will further classify the data into a class of intrusion. The model outperforms individual SVM and ACO algorithms in intrusion detection.C21[54]ISCX 2012The model combined K-means clustering with discretization technique and Naïve Bayes classifier to create a hybrid intrusion detection system. KMC-D is used for clustering and NBC is used for classification. The model significantly reduced the false alarm rate.C22[55]NSL KDDThe important characteristic of active learning SVM is the ability to develop an intrusion detection system with small samples of datasets, hence reducing the training time and increasing the efficiency of the model.C23[56]KDD′99To reduce the number of features, the model uses the spatial correlation-based dimension reduction method. The new feature set is used to train the SVM classifier for intrusion detection.The model achieves high performance in training the classifier algorithm.C24[57]KDD′99 datasetThe mode consists of two levels. In level one, K-means is used for data dimensionality reduction, and in level two, RF is used for classification. The model was evaluated using an outdated dataset.C25[58]NSL-KDD datasetProposed combination of PCA and LSTM-RNN. PCA is deployed for feature reduction; on the other hand, LSTM-RNN is used for classification. The proposed model performs better compared to a single algorithm.C26[59]NSL-KDD datasetProposed K-means for clustering the dataset and SMO for feature classification in the second stage. The model outperforms individual algorithm K-mean clustering and sequential minimal optimization (SMO). In the future, the model can be evaluated using other datasets.C27[60]NSL_KDDThe model has two stages of classification using SOM and BPNN. The model uses SOM in the first stage for classification. The dataset flagged as the attack in the first stage is further classified in the second stage using BPNN into different forms of attacks. The model can be verified using other types of datasets in the future.C28[61]Wormhole datasetThe combination of K-means and decision tree has a high detection rate compared to single algorithms of K-means and decision tree. But the hybrid significantly reduces false positives suffered by the two single algorithms. In the future, research can be done on how to improve the detection rate of the hybrid.C29[62]NSL-KDD datasetThe model deployed two feature selection algorithms in a cascaded manner. The model outperformed the RNN-based deep neural network in terms of accuracy. In the future, the model can be evaluated using different datasets.C30[63]NSL-KDD datasetPlant growth optimization in this model is used for feature reduction and selection. SVM is used for classification. In the future, further investigation of the mode can be done using a different dataset.C31[64]Simulated attacksThe model implemented GMM, OCSVM, isolation forest, and SOM in parallel to improve the classification. In addition to this, they added a decision module to provide the final classification. The model reported low CPU and RAM usage with high accuracy.C32[65]NSL-KDDK-means clustering with random forest classifiers outperformed the Gaussian mixture clustering with random forest classifiers.C33[66]DARPA-KDD99In this model, fuzzy rules are generated and then inputted as a particle in PSO. In the future, more compact and intelligent fuzzy logic can be generated to enhance the detection of more attacks.C34[67]KDD CUPThe model proposed the optimization of ANN using MOA-PSO. The model performed better compared to other models. The model was evaluated using an old dataset.C35[68]NSL-KDDThe model recorded high accuracy and low FAR, but the model was tested using only one dataset. The model should be tested using other datasets for verification of its performance.C36[69]NSL-KDDThe model recorded high detection rates of DoS, R2L, and probe attacks. According to the researchers, the model performed poorly in the detection of the user to root (U2R) attacks.C37[70]NSL-KDDThis was the first model to combine rough set theory and random forest for intrusion detection. The model outperformed other models in terms of accuracy.The model was tested using only one dataset.C38[71]NSL-KDD and UNSW-NB15 datasetsThe model outperformed other models in detection rate and false-positive rates. The researchers proposed an investigation of the model using different datasets.C39[72]A novel datasetProposed a hybrid detection model based on K-means clustering and support vector machine (SVM) classification.The model was evaluated using a novel dataset retrieved from a wireless network packet traffic flow. The model recorded a low false-positive rate with an improved detection rate.C40[73]KDD′99 datasetProposed optimization of FCM using hybrid rice optimization algorithm. The model was evaluated using the KDD99 dataset. The model recorded better clustering performance.In the future, the model can be evaluated using modern datasets.C41[74]KDD 99K-means and K-nearest neighbors were used to reduce the time complexity of the system with great accuracy.C42[75]KDD 99The model training time of K-means and random tree algorithm-based intrusion detection system is more suitable than using a single random tree algorithm both in 10-fold cross-validation and 66–34 percent validation.C43[76]ISCX datasetProposed a hybrid model based on KM and RF. KM performs clustering of the best features in the first stage. RF performs the classification of the clusters.The accuracy of the model can be further improved by improving the clustering operation of the KMC44[77]KDD99The model deployed hybrid rice algorithm to optimize the extreme learning machine. HRO-ELM improves the accuracy of network intrusion detection. How to improve the structure of ELM using hybrid rice algorithm was proposed for future research.C45[78]Real large-scale datasetThe model deployed PCA, CCA, and ICA for dimensionality reduction, and the goal is to learn and maintain the key features. What follows is a classification of the key features using a Bloom filter to categorize the dataset as either abnormal or normal. The normal dataset is further classified using the KNN algorithm.In the future, the model can be evaluated using a different type of SCADA dataset.C46[79]UNSW-NB15 and ISCX2012The researchers used EBat to optimize MLP neural networks to increase the accuracy of classification. EBat algorithm was used in the selection of suitable weights and biases.KDD Cup 99 and NSL-KDDThe researchers used both current and classical datasets for the evaluation of the model.C47[80]MSU and ORNLThe researchers used WOA to obtain the optimal weights and biases for training ANN. The model recorded superior performance compared with other models.C48[81]NSL-KDDThe main purpose of the model was to increase the rate of precision in the detection of malicious activities in information systems through a selection of appropriate features. The researchers used NSL-KDD which does not capture new attacks.C49[82]NSL-KDD and CICIDS2017The researchers used double particle swarm optimization (PSO)-based algorithm for feature selection and hyperparameter selection. PSO was used to set the hyperparameters of a deep learning model automatically. The model was evaluated using NSL-KDD and CICIDS2017. CICIDS2017 is considered to be an up-to-date reliable NIDS dataset.C50[83]NSL-KDD datasetThe research proposes an incremental learning model for DDoS attack detection. When the divergence test fails to detect an attack, the output forms the input into the classifiers. The classifiers are arranged in parallel to speed the detection process and the cost of computation. Finally, the determiner flags the attack if any.The advantage of using more than one classifier is that algorithms select a different category of features.C51[84]NSL-KDD datasetThe model combines LSTM and decision tree; at the first level, LSTM is used to cluster data as normal or attack. On the second level of detection, the normal data from the first level are fed into the decision tree for further inspection.The model recorded a low detection rate to some attacks like U2R due to small samples. In the future, research can be done on how to balance the dataset.C52[85]CICIDS2017, UNSW-NB15, and NSL-KDDThe researchers developed a model known as MS-DHPN. The model combines multimode deep autoencoder and LSTM. Multimode deep autoencoder forms the first layer of the model. The goal of MDAE is to learn and process multifeature groups. At the second layer, LSTM is used for temporal feature extraction automatically.In the future, the model can be tested in a real-world environment.C53[86]NSL-KDDSMOTE-ENN is used for data balancing to increase the minority classes. The model uses CNN for feature selection. The model recorded low accuracy of 83.31%; in future, research can focus on how to improve this accuracy.C54[87]UNSW-NB15The model deploys PCA for feature reduction, to select only the relevant features. K-means is used for clustering and SVM is used for classification.The model reports a high false alarm rate compared with other models, which makes it risky to deploy the model in a production environment.C55[88]KDD Cup 99 datasetThe model integrates a genetic algorithm with improved feature selection with SVM. GA performs the initial feature selection. SVM classifies the selected features into either normal or abnormal (DOS, probe, R2L, and U2R). The model can be further evaluated using updated datasets.C56[89]CICIDS2017In this model, DBN is used to reduce the number of features in the dataset and keep only the important features. SVM on the other hand is used for the classification of attacks.In the future, research can be done on how to improve the accuracy and the efficiency of intrusion detection.C57[90]ISCX2012 and UNSW-NB15 and KDD Cup 99 and NSL-KDDThe model combines ABC and DA to form an optimization algorithm known as HAD. HAD is used in this model for optimizing the MLP neural network. The model was evaluated using two modern datasets, i.e., ISCX2012 and UNSW-NB15 and two old datasets, that is, KDD Cup 99 and NSL-KDD.In future, research can be done on how to reduce the features in the dataset.C58[91]NSL-KDDThe model applied XGBoost for feature selection and deep neural network (DNN) for the classification of network intrusion. The researchers used only one dataset for the validation of the model.C59[92]ISCX 2012, NSL-KDD and CIC-IDS2017In this research, ECAGOA is used to optimize SVM by selecting key SVM parameters to eliminate overfitting issues of SVM. When the model is evaluated using three types of datasets, it records superior performance compared with other models.C60[93]NSL-KDD, AWID, and CIC-IDS 2017In this model, MSAP-GOBA, a variety of GOA, is used to select relevant features in the dataset to improve the detection rate and reduce overfitting problems. Three forms of the dataset were used to validate the model and the result was outstanding compared to other models.C61[94]ADFA-LD datasetThe model uses VED on the first stage to reconstruct the dataset and the RNN is used for capacity memorization. The model recorded a low false-positive rate compared with other models.C62[95]NSL-KDD dataset, UNSW-NB15 dataset, and CIC-IDS2017The main objective was to reduce the number of features in the dataset to improve classification performance and computation time. NSGA-II id is used as a search strategy and LR is used as a learning algorithm.The model succeeded in reducing the number of features, hence increasing detection accuracy, but this reduced the detection rate of some of the attacks like U2R, backdoor, analysis, exploits, DoS, and web-attack-XSS. This was due to the underrepresentation of the attacks or missing information.C63[96]KDD CUP99The research showed that in dealing with data redundancy and class imbalance, we can solve the problem of high false-positive rate (FPR) for minority samples and improve F1.C64[97]NSL-KDD and UNSW-NB15The integration of the two algorithms enabled the learning of spatial and temporal features. The researchers recommended the optimization of the model to detect U2R and worm attacks.C65[98]CICIDS2017 and NSL-KDDThe researchers used both current and classical dataset to validate the model. The model recorded a very low false-positive rate and high accuracy, above 99% on each dataset.C66[99]KDD cup, database1, and database2The model outperformed other state-of-the-art algorithms in terms of accuracy, detection accuracy, precision, and recall. The major limitation of the model is that it registered high computational costs. Studies can be done on how to reduce the computational cost.C67[100]NSL-KDD and CICIDS2017The hybrid model of binary classification outperformed other models in precision and recall. In addition, the model significantly reduced the processing time compared to the KNN algorithm. The model focused on the first level of the two-stage detection method; in the future, research can be done on attack detection at the second level of detection.C68[101]NSL-KDD datasetThe method outperformed all the methods, such as GS-ANN, DT, GD-ANN, GA- ANN, PSO-ANN, and GSPSO-ANN. Further validation is needed in the future using different datasets.C69[102]Bot-IoT datasetThe researchers proposed a two-stage hybrid intrusion detection system. The deep autoencoders (DAEs) were deployed on the first stage for anomaly intrusion detection. In the second stage, the researchers deployed machine learning-based attack classifiers. The model performed better in the detection of both known and unknown attacks.C70[103]CICIDS2017The hybrid method was effective in the classification of anomaly detection compared to other classifications of DNN. The model was evaluated with an updated dataset named “CICIDS2017” which captures current intrusion.C71[104]Alibaba Tianchi datasetThe model combined CNN and LSTM to develop a hybrid detection model. The model outperformed other models in terms of accuracy and MSE. The model was evaluated using Alibaba Tianchi dataset which represents real-life malicious behaviors. In the future, the model needs to be evaluated using different datasets.C72[105]CICIDS2017 datasetsThe model outperformed other intrusion detection models in terms of detection rate, accuracy, and false-positive-rate. The model was evaluated using an up-to-date dataset.In the future, the model can be tested using other datasets.C73[106]KDD Cup 99 datasetThe model consists of three stages; in the first stage, the model deploys U-Net and LSTM for feature extraction. In stage two, global attention mechanism is used to learn and select critical information in the features. Finally, SVM is used to classify the information. The model was evaluated using an old dataset that does not capture current intrusion.C74[107]KDD CUPThe model had high performance compared to single algorithms, but the researchers used an old dataset that does not capture modern attacks.C75[108]KDDCUP99 and UNSW-NB15HNGFA outperforms other techniques in exploration, detection, and evolving rules for all small forms of intrusion with high accuracy and low FAR in different settings of the datasets.C76[109]CICIDS2017The model takes advantage of two classifiers, that is, long short-term memory and convolutional neural network. The model possesses the capability of detecting evolving cyber threats.C77[110]KDD 99CSO was used for feature reduction and RNN was used for classification. The researchers used an old dataset to test the model and they proposed the use of a modern dataset for future research.C78[111]KDD Cup99The research proposed a three-stage hybrid intrusion detection model. Snort was used to detect signature-based attacks in the first stage. In the second stage, three feature reduction techniques were applied for feature reduction. The techniques used were univariate, principal component analysis, and linear discriminant analysis. Finally, the model deployed four supervised machine learning algorithms for classification. The model was evaluated using KDD CUP99, and it was observed that RF outperformed other models in terms of accuracy. Currently, we have new forms of datasets that are up to date in terms of attacks. The model can be evaluated using this dataset.C79[112]UNSW-NB15The researchers compared the CART algorithm with other decision tree classifiers, namely, the J48 decision tree, fast decision tree, random tree, fine tree, medium tree, and coarse tree. CART recorded superior performance.C80[113]NSL-KDDThe model yielded better results compared with other models, but the researchers observed that the increase of neurons caused an increase in complexity and run times.C81[114]NSL-KDD, UNSW NB15, and Kyoto2006Information gain and principal component analysis are used for feature extraction and reduction. DBSCAN is used for clustering the dataset. WGAN-DIV was applied in the final stage for data generation. The researchers proposed stability improvement of the model in future work.C82[115]Microsoft Windows server event logsThe research showed the importance of user profile creation in the performance of misuse intrusion detection systems.C83[116]Real datasetThe model uses online incremental SVM for the detection of intrusion on IoT platforms. To make sure that new forms of attacks are detected, MLP is deployed as the second layer of IDS to filter any undetected attacks by the SVM module. The advantage of the model is that it evolves with new forms of attacks due to regular updates from the Internet.C84[117]NSL-KDD and UNSW-NB15The model combined CNN and BiLSTM for feature extraction. The model extracts spatial and temporal features of the dataset simultaneously. Application of the two algorithms in construction of a balanced dataset improves the learning capabilities of the model, hence reducing the time required to train the model.C85[118]NSL-KDD and CICIDS2017The researchers observed that deep learning models’ performance is highly dependent on the amount of data used for training. If a lot of data is used for training, the model will perform better.C86[119]NSL-KDDThe method aimed at feature reduction to improve the classification. NSL-KDD was used for evaluation which does not reflect new forms of attacks.C87[120]NSL-KDDThe model was superior compared to other clustering algorithms for unsupervised detection but with high computation time.C88[121]CAN-intrusion-dataset and CICIDS2017 datasetDecision tree (DT), random forest (RF), extra trees (ET), and extreme gradient boosting (XGBoost) algorithms are applied in this model to develop a signature-based IDS. The second phase of the model deploys a cluster labeling (CL) K-means (CL-K-means) algorithm to develop anomaly-based IDS, and this will detect unknown attacks.For future work, model performance can be improved by investigating other unsupervised learning and online learning methods to be used in the anomaly-based IDS framework.C89[122]CICIDS2017 and UNSW-NB15Proposed a two-stage intrusion detection system based on DT and RF to improve detection. The first stage extracts some selected features for classification. The second stage deals with the extraction of features that were not classified in the first stage. The model was evaluated using two modern datasets.C90[123]NSL-KDD and CIC-IDS2017The model combined K-means, deep learning algorithm, and RF. K-means and RF are deployed to classify the event as either normal or attacks, while deep learning algorithms are used to learn the hidden features of attack events. The model recorded better processing speed and less training time.C91[124]ICS datasetThe model combines PSO and ANN to create a hybrid detection model. In this model, the PSO search method is used in the ICS dataset to enhance the classification performance of the ANN model. In the future, further investigation can be done on various optimization techniques to increase detection accuracy.C92[125]KDD CUP 99The outcome shows that PSO + KNN outperformed PSO + DT in network anomaly detection. In the future, the model should be evaluated with current datasets.C93[126]NSL-KDD datasetProposed a two-level intrusion detection model; at level one, the model used Naïve Bayes classifier to detect DoS and probe, and at level two, the model deployed SVM to distinguish R2L and U2R from normal instances. In the future, the model can be tested against other forms of intrusion.C94[127]DARPA 1998The model proposed the optimization of ANN using GWO. The goal was to solve the limitations of using the backpropagation algorithm, which include local minimum limitations.The model took a longer time to train; in the future, research can be done on how to reduce the training time. In addition, the model can be evaluated using the current dataset.C95[128]NSL-KDDThe researchers used a new algorithm known as slime mould optimization algorithm to optimize the weighted extreme learning machine. The model reduces training time, and the real-time performance of intrusion detection is improved.C96[129]NSL-KDD and CICIDS2017 datasetIn this model, WOA is used to optimize the kernel parameters of the RVM and the weight coefficients of the hybrid kernel.The model was evaluated using two types of datasets, NSL-KDD representing the old dataset and CICIDS2017 dataset representing an updated dataset.C97[130]CICIDS2017 and ISCXIDS2012The model consists of two major components, packet-based early detectors (PEDs) and hybrid lazy detectors (HLDs). PED performs fist level classification by classifying every packet received. Any packet that does not meet the minimum score in the first level is further classified in the second level using the HLD classifier. PED can be constructed by selecting between RF and DT while HLD can be constructed by selecting between RF and ADT.The model has a high implementation complexity and cost than existing IDSs composed of a simple classifier. Research can be done on how to improve implementation complexity and cost.C98[131]NSL KDDProposed hybrid model by combining supervised algorithm Light GBM and unsupervised algorithm K-means.The model recorded superior performance than other models, but it requires higher training time.C99[132]CSE-CIC-IDS2018The model performed multiclass classification based on multilayer perceptron and LSTM.C100[133]KDD′99 datasetProposed a model combining serial-based IDS (SIDS) and parallel-based IDS (PIDS). PIDS is deployed to detect known intrusion and SIDS is deployed to detect unknown intrusion.The model can be evaluated using an updated dataset.C101[134]UNSWNB15 dataset and the CICIDS2018 datasetThe researchers combined OCSVM and LOF to develop a hybrid detection model. OCSVM was deployed on the first phase of the model to detect the flow of the traffic. If the flow of the traffic is abnormal, it forms the input to the second phase of the model which consists of the LOF component. The model proved that it can effectively detect intrusion while maintaining privacy. In the future, the model can be further investigated using real data.C102[135]KDD Cup 99 and NSL-KDDIn this study, the researchers combined SCAE and SVM to develop a hybrid intrusion detection model. In this model, SCAE is used in the first phase for feature extraction and SVM is deployed in the second phase for classification purposes. The hybrid model recorded a better accuracy in detection compared to single SVM and long short-term memory (LSTM). In the future, research can be done on how to reduce the computational time for the hybrid model.C103[136]NSL-KDDThe model uses GA for feature selection. The output of GA forms the input to SVM, DT, and ensemble for classification. The combination of GA and ensemble classifier records the highest detection accuracy. The model can be evaluated using different datasets.C104[137]NSL-KDD and UNSW-NB15The researchers developed a hybrid semantic deep learning (HSDL) intrusion detection model in the cloud. To develop the model, the study integrated LSTM, CNN, and SVM. LSTM and CNN in this model were used for feature extraction while SVM was used for classification.The model was evaluated using NSL-KDD and UNSW-NB15 datasets. The model recorded high accuracy on both datasets: 99.98% for the NSL-KDD dataset and 98.47% for the UNSW-NB15 dataset.C105[138]Laboratory setup datasetThe researchers proposed a hybrid detection model based on LSTM and transformer for detection of malware system calls. The model consists of a component of LSTM on the first stage and the second phase is made up of two layers of transformers. The model recorded 92.6% precision and a recall of 93.8%. In the future, this performance can be improved.C106[139]CICIDS2017 datasetThe researchers developed a hybrid detection model based on convolutional neural network and network. The goal was to solve the issue of feature selection. To achieve this, the researchers applied the forward feature selection technique. The model was tested using the CICIDS2017 dataset and the result showed that forward feature selection is a promising technique in feature selection. The model can be tested using a different dataset in the future.C107[140]NSL KDDCup 99The researchers used dragonfly algorithm to optimize multilayer perceptron. OSVM was used for the classification of data as either normal or intrusive.C108[141]KDD′99 and UNSW-NB15 datasetsIn the first stage, the researchers improved on feature selection. In the second stage of the model, the researchers combined signature and anomaly-based attack detection techniques. The model recorded a very high rate of accuracy of 99.69%.C109[142]NSLKDD datasetThe model consists of two main components. The first component is made of machine learning algorithms. The second component is made of the inference detection model. The model was evaluated using NSLKDD dataset. The results showed that the inference detection model improves the accuracy of the ML algorithms.C110[122]CICIDS2017The first component of the model is a signature-based model. In this stage, RF is used to detect known attacks. The second component of the model uses an anomaly intrusion detection mechanism. Weighted K-means is used in this stage for the detection of unknown attacks. The model was evaluated using up-to-date dataset.C111[143]Controller area network (CAN) dataThe model combines rule-based technique and machine learning algorithm. The rule-based intrusion detection technique was used in the first stage to increase the speed of detection and reduce false alarms. DNN was deployed in the second stage of the model to increase the overall accuracy of the model by lagging any undetected intrusion from the first phase. The evaluation results showed that the model can detect intrusions in different vehicle models.Table 2
List of abbreviations.
AbbreviationExplanationNBNaïve BayesKNNK-nearest neighborNBNSNetBIOS name serviceMDNSMulticast DNSIPFIXInternet Protocol Flow Information ExportCNNConvolutional neural networkRNNRecurrent neural networkPSOParticle swarm optimizationIRELMRegularized extreme learning machineLSTMLong short-term memoryCSOACNSelf-organized ant colony networkGA-SOFMGenetic algorithm-self-organized feature mapMCLPMultiple criteria linear programmingAGAARAccelerated genetic algorithm and rough set theoryGPLSGenetic programming with local searchACOAnt colony optimizationKMC-DK-means clustering with discretizationPCAPrincipal component analysisSMOSequential minimal optimizationSOMSelf-organization mapBPNNBackpropagation neural networkFCMFuzzy C-meansKMK-meansCCACanonical correlation analysisICAIndependent componentWOAWhale optimization algorithmMDAEMultimode deep autoencoderDBNDeep belief networkABCArtificial bee colonySMOTE-ENNSynthetic minority oversampling technique combined with edited nearest neighborsCSOCrow swarm optimizationCARTClassification and regression treesDBSCANDensity-based algorithm for discovering clusters in large spatial databases with noiseWGAN-DIVWasserstein GAN divergenceBiLSTMBi-directional long short-term memory


## 2. Intrusion Detection Systems

Denning introduced the technique of detecting intrusion, and since then researchers have worked hard to automatically detect intrusions in network systems [6]. Intrusion detection systems have been defined as the technique of using artificial intelligence, machine learning, and database systems to uncover malicious patterns in large datasets [2]. IDS can be broadly classified into two major categories, anomaly-based IDS and misuse-based IDS. Recently, other methods have emerged through the integration of anomaly and misuse intrusion IDSs to yield more categorizes.


### 2.1. Anomaly-Based Intrusion Detection Systems

Anomaly intrusion detection systems profile the normal behavior of a system. They monitor the normal operations of the system, and if they detect an anomaly, a flag is raised. Instead of keeping all patterns of well-known malicious dataset and updating as new patterns emerge, anomaly detection systems outline “normal” operations of a system and flag anything that deviates from the outline [2]. According to [7], anomaly IDS contains three stages: parameterization, training stage, and detection stage. In the parametrization stage, the data are formatted to capture the normal behavior of the device. After parameterization, the model is trained to represent the normal behavior. The detection stage is where the model detects and flags any deviation from the normal behavior based on the parameterized data [7].Different intrusion detection mechanisms have been used in the development of the anomaly IDS. Mishra and Yadav [8] outlined the following techniques: data mining techniques, machine learning-based techniques, and statistical approaches. In these techniques, some researchers have used single algorithms while others have opted to integrate algorithms to improve the performance of the IDS [8].Atefi et al. [9] developed anomaly detection based on profile signature using genetic algorithm and support vector machine algorithms. SVM outperformed GA in terms of precision rate. The researchers combined the two algorithms to form a hybrid IDS. The evaluation of the hybrid IDS produced better performance compared to the single algorithms.Khoei et al. [10] investigated the application of three types of ensemble learning techniques for anomaly IDS. The three techniques applied were bagging, boosting, and stacking. The performance of the three techniques was compared with that of decision tree (DT), Naïve Bayes (NB), and K-nearest neighbor (KNN). The results showed that stacking-based ensemble learning techniques outperformed the traditional learning techniques in terms of detection rate, false alarm rate, miss detection rate, and accuracy rate.Rakshe and Gonjari [11] developed an intrusion detection model based on SVM and random forest algorithms. The two algorithms were used for classification purposes. The models were evaluated using NSL-KDD. The models recorded detection accuracy of more than 95%. The performance of the two models was compared, and the random forest algorithm performed better than SVM in the classification of traffic.Kumar et al. [12] developed an anomaly intrusion detection system based on four algorithms, namely, Naïve Bayes, ID3, MLP, and ensemble learning. The models were evaluated using CICIDS2017 dataset. The ensemble model was developed by combining NB, ID3, and MLP. The metrics used in the evaluation of the models were precision, recall, accuracy, and F1 score. ID3 (decision tree) performed better compared to the other models.Once anomaly intrusion detection systems have been developed, they do not need regular updates unless a major user or system change has been done. Anomaly IDS can flag new forms of attacks, unlike the misuse IDS. Due to the above-mentioned characteristic of anomaly intrusion detection systems, they are considered to be more effective compared to their counterpart misuse intrusion detection system whose performance highly depends on stored patterns that require regular updates.Profile creation is the main issue in anomaly intrusion detection because there is no fixed normal action or behavior of the user, and different users use computer systems differently. Capturing the profile of different users as normal has proven to be difficult, hence creating the main limitation of anomaly IDS. With the limitation arises the issue of high false-positive alerts because any abnormal action by the user is considered an attack. Research in this area is focused on how to profile normal action and how to reduce high false-positive rates.


### 2.2. Misuse/Signature Intrusion Detection System

Misuse intrusion detection systems depend on well-known attack signatures to capture attacks and to flag intrusions using well-known patterns. The well-known signatures are captured and labeled to assist in intrusion detection. The labeled patterns are stored in a database that needs regular updates when new patterns are captured. For detection of attacks, misuse-based IDS compares the received traffic with the stored signatures in the database; if the patterns are similar, the traffic is marked as an intrusion; else, the traffic will be marked as normal.Unlike anomaly-based IDSs, misuse IDSs are easy to create as the pattern of malicious code is known. The code of the malicious malware is analyzed for a unique pattern, and this pattern is used to create the baseline signature to be used for detection. This makes misuse-based IDSs have a high positive detection rate as they depend on well-known information. Users must keep updating the corresponding databases for new signatures.Over the years, research has been done on this area of misuse intrusion detection. Zhang et al. [13] proposed a misuse intrusion detection system for defending LAN users using the XGBoost algorithm. To develop and evaluate the model, the researchers used real-time data collected from LAN of 10 different Asian countries. The model was evaluated using collected data from 45 networks. The model recorded 97.5% in overall precision and 97.5% in the overall recall. In addition, the researchers observed that LAN intrusion detection is affected by ARP, MDNS, and NBNS protocols. The main advantage of this model is that it was evaluated using real-time network data which means that the model can be deployed in the existing LANs as it is or with minor changes.Taher et al. [14] used the artificial neural network (ANN) and support vector machine (SVM) technique to develop a signature-based intrusion detection model. The two algorithms were to find the algorithm with the best performance in terms of classification. NSL-KDD dataset was used for the evaluation of the models. According to the researchers, the ANN-based model outperformed the SVM model in classification. The ANN-based model recorded a detection rate of 94.02%. The model can be further investigated using an updated dataset.Erlacher and Dressler [15] proposed Internet Protocol Flow Information Export (IPFIX) signature-based intrusion detection known as FIXIDS. The model uses the newly added HTTP-related flow information elements (IEs) to detect intrusion in high-speed networks. The model outperformed Snort in general. This technique can be investigated further in future for standard flow.Tug et al. [16], using blockchain technology, proposed collaborative signature-based intrusion detection system referred to as CBSigIDS. The model uses blockchain technology to incrementally update and distribute secure signatures database in a collaborative network. Evaluation of the model shows that blockchain technology can be used to improve the performance of signature-based IDS in secure manure. In future, research can be done on the application of blockchain technology in anomaly IDS.The main limitation with misuse intrusion detection systems is that they cannot detect zero-day attacks or new forms of attacks. At the point of realization of a new form of attack and the creation of the signature of the attack, most of the computer systems are already left vulnerable. Misuse intrusion detection systems also require large storage memory to store the signature library.The focus area of research on this type of intrusion detection system is on how to reduce the volume consumed by the database. Another potential area of research is how to make this IDS able to detect zero-day attacks.


## 2.1. Anomaly-Based Intrusion Detection Systems

Anomaly intrusion detection systems profile the normal behavior of a system. They monitor the normal operations of the system, and if they detect an anomaly, a flag is raised. Instead of keeping all patterns of well-known malicious dataset and updating as new patterns emerge, anomaly detection systems outline “normal” operations of a system and flag anything that deviates from the outline [2]. According to [7], anomaly IDS contains three stages: parameterization, training stage, and detection stage. In the parametrization stage, the data are formatted to capture the normal behavior of the device. After parameterization, the model is trained to represent the normal behavior. The detection stage is where the model detects and flags any deviation from the normal behavior based on the parameterized data [7].Different intrusion detection mechanisms have been used in the development of the anomaly IDS. Mishra and Yadav [8] outlined the following techniques: data mining techniques, machine learning-based techniques, and statistical approaches. In these techniques, some researchers have used single algorithms while others have opted to integrate algorithms to improve the performance of the IDS [8].Atefi et al. [9] developed anomaly detection based on profile signature using genetic algorithm and support vector machine algorithms. SVM outperformed GA in terms of precision rate. The researchers combined the two algorithms to form a hybrid IDS. The evaluation of the hybrid IDS produced better performance compared to the single algorithms.Khoei et al. [10] investigated the application of three types of ensemble learning techniques for anomaly IDS. The three techniques applied were bagging, boosting, and stacking. The performance of the three techniques was compared with that of decision tree (DT), Naïve Bayes (NB), and K-nearest neighbor (KNN). The results showed that stacking-based ensemble learning techniques outperformed the traditional learning techniques in terms of detection rate, false alarm rate, miss detection rate, and accuracy rate.Rakshe and Gonjari [11] developed an intrusion detection model based on SVM and random forest algorithms. The two algorithms were used for classification purposes. The models were evaluated using NSL-KDD. The models recorded detection accuracy of more than 95%. The performance of the two models was compared, and the random forest algorithm performed better than SVM in the classification of traffic.Kumar et al. [12] developed an anomaly intrusion detection system based on four algorithms, namely, Naïve Bayes, ID3, MLP, and ensemble learning. The models were evaluated using CICIDS2017 dataset. The ensemble model was developed by combining NB, ID3, and MLP. The metrics used in the evaluation of the models were precision, recall, accuracy, and F1 score. ID3 (decision tree) performed better compared to the other models.Once anomaly intrusion detection systems have been developed, they do not need regular updates unless a major user or system change has been done. Anomaly IDS can flag new forms of attacks, unlike the misuse IDS. Due to the above-mentioned characteristic of anomaly intrusion detection systems, they are considered to be more effective compared to their counterpart misuse intrusion detection system whose performance highly depends on stored patterns that require regular updates.Profile creation is the main issue in anomaly intrusion detection because there is no fixed normal action or behavior of the user, and different users use computer systems differently. Capturing the profile of different users as normal has proven to be difficult, hence creating the main limitation of anomaly IDS. With the limitation arises the issue of high false-positive alerts because any abnormal action by the user is considered an attack. Research in this area is focused on how to profile normal action and how to reduce high false-positive rates.


## 2.2. Misuse/Signature Intrusion Detection System

Misuse intrusion detection systems depend on well-known attack signatures to capture attacks and to flag intrusions using well-known patterns. The well-known signatures are captured and labeled to assist in intrusion detection. The labeled patterns are stored in a database that needs regular updates when new patterns are captured. For detection of attacks, misuse-based IDS compares the received traffic with the stored signatures in the database; if the patterns are similar, the traffic is marked as an intrusion; else, the traffic will be marked as normal.Unlike anomaly-based IDSs, misuse IDSs are easy to create as the pattern of malicious code is known. The code of the malicious malware is analyzed for a unique pattern, and this pattern is used to create the baseline signature to be used for detection. This makes misuse-based IDSs have a high positive detection rate as they depend on well-known information. Users must keep updating the corresponding databases for new signatures.Over the years, research has been done on this area of misuse intrusion detection. Zhang et al. [13] proposed a misuse intrusion detection system for defending LAN users using the XGBoost algorithm. To develop and evaluate the model, the researchers used real-time data collected from LAN of 10 different Asian countries. The model was evaluated using collected data from 45 networks. The model recorded 97.5% in overall precision and 97.5% in the overall recall. In addition, the researchers observed that LAN intrusion detection is affected by ARP, MDNS, and NBNS protocols. The main advantage of this model is that it was evaluated using real-time network data which means that the model can be deployed in the existing LANs as it is or with minor changes.Taher et al. [14] used the artificial neural network (ANN) and support vector machine (SVM) technique to develop a signature-based intrusion detection model. The two algorithms were to find the algorithm with the best performance in terms of classification. NSL-KDD dataset was used for the evaluation of the models. According to the researchers, the ANN-based model outperformed the SVM model in classification. The ANN-based model recorded a detection rate of 94.02%. The model can be further investigated using an updated dataset.Erlacher and Dressler [15] proposed Internet Protocol Flow Information Export (IPFIX) signature-based intrusion detection known as FIXIDS. The model uses the newly added HTTP-related flow information elements (IEs) to detect intrusion in high-speed networks. The model outperformed Snort in general. This technique can be investigated further in future for standard flow.Tug et al. [16], using blockchain technology, proposed collaborative signature-based intrusion detection system referred to as CBSigIDS. The model uses blockchain technology to incrementally update and distribute secure signatures database in a collaborative network. Evaluation of the model shows that blockchain technology can be used to improve the performance of signature-based IDS in secure manure. In future, research can be done on the application of blockchain technology in anomaly IDS.The main limitation with misuse intrusion detection systems is that they cannot detect zero-day attacks or new forms of attacks. At the point of realization of a new form of attack and the creation of the signature of the attack, most of the computer systems are already left vulnerable. Misuse intrusion detection systems also require large storage memory to store the signature library.The focus area of research on this type of intrusion detection system is on how to reduce the volume consumed by the database. Another potential area of research is how to make this IDS able to detect zero-day attacks.


## 3. Hybrid Intrusion Detection System

With the evolving variety of attacks, the two classical IDSs mentioned above cannot protect our information systems effectively. New methods of combining different intrusion detection systems to improve their effectiveness have been proposed. Research has shown that combined algorithms perform better than single algorithms [17].The goal of hybrid intrusion detection systems is to combine several detection models to achieve better results. A hybrid intrusion detection system consists of two components. The first component processes the unclassified data. The second component takes the processed data and scans it to flag out intrusion activities [18].Hybrid intrusion detection systems are based on combining two learning algorithms. Each learning algorithm possesses unique features, which assist in improving the performance of the hybrid [19]. Hybrid IDSs can be broadly categorized into cascaded hybrid, integrated-based hybrid, and cluster + single hybrid.In [5], Kim et al. proposed a hybrid intrusion detection system based on signature-based and anomaly detection components. In the first stage of the model, a misuse detection component was applied to detect known attacks based on the captured patterns. This component was based on the C4.5 decision tree algorithm. The second stage consisted of an anomaly detection component to leverage the shortcomings of the misuse detection component. To develop the second component of the model, multiple one-class SVM algorithms were used. The performance of the model was tested using the KDD Cup 99 dataset. The model performed better than the single traditional IDS.In [20], the researchers combined feature extraction techniques and classification techniques to increase detection rate while at the same time reducing false alarm rate. In the first stage of the hybrid, chi-square was used for feature selection. The goal of this stage was to reduce the number of features in the dataset but maintaining the important features that capture the attacks. In the second stage, a multiclass support vector machine (SVM) algorithm was used for classification. Multiclass support vector machine was used in this model to improve classification rate. The model was evaluated using the NSL-KDD dataset, with the results showing that the model recorded a high detection rate with a low false alarm rate.In [21], Khraisat et al. developed a hybrid detection model based on a C5 decision tree classifier and one-class support vector machine (OC-SVM). The model consisted of two major components. A C5.0 decision tree classifier was used to develop the first component of the model for misuse detection. The second component was developed using OC-SVM for anomaly detection. The researchers tested the performance of the model using the NSL-KDD and Australian Defence Force Academy (ADFA) datasets, and the results showed that the hybrid model was superior to single-based models.Khan proposed a hybrid intrusion detection model based on convolutional neural network (CNN) and recurrent neural network (RNN). The research aimed to improve feature extraction, which is fundamental in the performance of intrusion detection systems. CNN was used in the first phase to extract local features in the dataset, with the RNN being used in the second phase to extract temporal features in the dataset. This technique resolved the issue of data imbalance on the available dataset. To test the performance of the model, the CSE-CIC-DS2018 dataset was used, which is the updated dataset. The model outperformed other intrusion detection models, with an intrusion detection accuracy of 97.75% [22].In [23], the researchers proposed a hybrid model intrusion detection model for smart home security. The model consisted of two components. The first component applied machine learning algorithms to real-time intrusion detection. Algorithms used in this component included random forest, XGBoost, decision tree, and K-nearest neighbors. The second component applied the misuse intrusion detection technique for detection of known attacks. To test the performance of the model, the CSE-CIC-IDS2018 and NSL-KDD datasets were used. The model recorded an outstanding performance for detection of both network intrusion and user-based anomalies in smart homes.In [24], the authors proposed a hybrid intrusion detection system for online network intrusion detection. The researchers integrated improved particle swarm optimization and regularized extreme learning machine (IPSO-IRELM). In this study, IPSO was used to optimize IRELM. The model was tested using UCI balance dataset, NSL-KDD dataset, and UNSWNB15 dataset. The model recorded a high accuracy rate as well as capabilities to classify the minority features.In [25], a hybrid detection model based on Spark ML and the convolutional-LSTM (Conv-LSTM) network was proposed. The model consists of two components: the first component uses Spark ML to detect anomaly intrusion while the second component deploys Conv-LSTM for misuse detection. To investigate the performance of the model, the researchers used ISCX-UNB dataset. The model recorded an outstanding performance of 97.29% accuracy in detection. The researchers proposed that the model can be evaluated further using a different dataset as a way of attempting to reproduce the results.In [26], the authors developed an intrusion detection system by combining firefly and Hopfield neural network (HNN) algorithms. The researchers used Firefly algorithm to detect denial-of-sleep attacks through node clustering and authentication.In [27], the researchers proposed a hybrid detection system for VANET (vehicular ad hoc network). The model consisted of two components. The researchers deployed a classification algorithm on the first component and a clustering algorithm on the second component. In the first stage, they used random forest to detect known attacks through classification. For the second stage, they deployed weighted K-means algorithm for the detection of anomaly intrusion. The model was evaluated using the current dataset, CICIDS2017 dataset. The researchers proposed further evaluation of the model in real-world environments. In another work [28], the researchers integrated random forest algorithm with unsupervised clustering algorithm based on coresets. This model was used for detection of real-time intrusions in VANET. Compared with other models, the model recorded better performance in terms of accuracy, computational time, and detection rate.Barani [29] proposed a hybrid detection model based on genetic algorithm and artificial immune system (AIS) (GAAIS) for intrusion detection on ad hoc on-demand distance vector-based mobile ad hoc network (AODV-based MANET). The model was evaluated using different routing attacks. Compared with other models, the model improved detection rate and decreased the false alarm rate.In [30], the researchers used integrated firefly algorithm with a genetic algorithm for feature selection MANET. To classify the selected features in the first stage of the model as either intrusion or normal, the researchers used replicator neural network for classification. The model performance was compared to that of fuzzy-based IDS. The model outperformed fuzzy-based IDS in accuracy as well as precision and recall.


## 4. Methodology

The methodology used consists of three primary phases: planning, conducting, and reporting as outlined by Kitchenham and Charters [31]. The three steps can be explained as follows:(a)
Planning: the main goal of this phase is to define the research goals and the review protocol. Review protocol defines how the review will be done. It consists of all the elements of review.(b)
Conducting: once the protocol has been defined, the review process can start. The main stages in this phase include identifying relevant research, selecting primary studies, and extracting required data and synthesis data.(c)
Report: finally, in reporting the review, data extraction strategies are defined and the steps to be used in data synthesis are outlined.


## 5. Review Process

### 5.1. Research Questions (RQs)

The main objective of this paper was to analyze the hybrid intrusion detection system techniques that were developed from 2012 to 2022. The following research questions were developed in line with the main objective:(a)
RQ1: which hybrid techniques have been used in intrusion detection systems? Objective: to identify techniques used in the development of hybrid IDS.(b)
RQ2: which classical algorithms were used in the integration of the hybrid? Objective: to identify commonly used algorithms in hybrid IDS.(c)
RQ3: which evaluation metrics are used in the hybrid intrusion detection systems? Objective: to identify commonly used metrics in the evaluation of IDS.(d)
RQ4: which datasets are used in hybrid intrusion detection system research? Objective: to identify commonly used datasets in hybrid IDS.


### 5.2. Search Strategy

Research shows that it is important to be guided by a search strategy in the systematic review [31]. In defining our search strategy, we were guided by the steps outlined by Thyago et al. [32]. The main two steps in this process are defining keywords and the sources of the study. The keywords were derived from the research questions. The keywords and synonyms used are as follows:(1)
Hybrid OR Integrated OR Cascaded.(2)
Intrusion detection System OR IDS(3)
Artificial Intelligence OR Machine LearningWe used the Boolean operators (OR) and (AND) to define the search string. The operator (OR) was used between synonyms, while (AND) was used between the keywords. The following search strings were defined:(1)
“Hybrid” OR “Integrated” OR “Cascaded”(2)
“Intrusion detection System” OR “IDS”(3)
“Artificial Intelligence” OR “Machine Learning”Finally, the search strings were combined as follows: ((1) AND (2) OR (1) AND (2) AND (3)).The researchers used the following digital libraries that are recognized in publishing research in the area of intrusion detection systems [33].(i)
The Institute of Electrical and Electronics Engineers (IEEE) Library (https://ieeexplore.ieee.org/)(ii)
The Association for Computing Machinery (ACM) Digital Library (https://dl.acm.org/)(iii)
Springer Link (https://link.springer.com/)(iv)
Science Direct (https://www.sciencedirect.com)Several searches were done on the above listed libraries but the search strings that yielded better result on each database are as follows:(i)
IEEE: ((“Hybrid” OR “Integrated” OR “Cascaded”) AND (“Intrusion detection System” OR “IDS”) AND (Artificial Intelligence OR Machine Learning))(ii)
ACM: [All: [[all: “hybrid”]] OR [All: [all: “integrated”]] OR [[All: [all: “cascaded”]]] AND [[All: [[all:] OR [All: “intrusion detection system”] OR [All:]]]] OR [[All: [all: “ids”]]] AND [[All: [publication] OR [All:]]]](iii)
Springer Link: ((“Hybrid” OR “Integrated” OR “Cascaded”) AND (“Intrusion detection System” OR “IDS”) AND (Artificial Intelligence OR Machine Learning))(iv)
Science Direct: ((“Hybrid” OR “Integrated” OR “Cascaded”) AND (“Intrusion detection System” OR “IDS”))The initial search obtained 2,084 articles. Table3 shows the number of articles obtained from the digital database.Table 3
Number of articles obtained from each digital database.
Digital databaseNumber of articlesIEEE563ACM337Springer Link123Science Direct1,025


### 5.3. Publication Selection Criteria

For inclusion criteria, all primary studies that have reviewed hybrid intrusion detection systems and articles published between January 2012 and February 2022 were included in the study. Single algorithm studies, secondary studies, short papers, duplicated studies, non-English studies, and incomplete papers were excluded. In addition, all studies that were not relevant to the research questions were excluded from the research. Table4 summarizes the inclusion/exclusion criteria.Table 4
Inclusion/exclusion criteria.
NumberTypeDescription1InclusionPrimary studies2.InclusionStudies published between January 2012 and February 20223InclusionStudies that propose hybrid/integrated/cascaded intrusion detection system4ExclusionStudies that propose single algorithm studies5.ExclusionGrey studies6.ExclusionShort papers (less than 5 pages)7.ExclusionDuplicated studies8.ExclusionNon-English studies9.ExclusionIncomplete papers


### 5.4. Study Selection Process

To conduct the selection process, the papers were selected according to the established strings, and papers were also selected based on the title, abstract, and keywords on this stage. The selected papers from the first selection process were subjected through the second selection process, which was based on reading the entire text of the paper.The primary reviewer conducted the selection process. The secondary reviewer conducted an inter-rater reliability test on the selected papers. This was done to make sure that there was no bias in the selection process from the primary reviewer. In the first step, 1875 studies were excluded by the reviewers as they did not satisfy the inclusion criteria. Of those excluded, 1786 were out of scope, 8 were grey studies, 27 were single algorithm studies, 53 were short papers, and 1 was duplicate paper. In the second step, 98 studies were excluded by the reviewers as they did not satisfy the inclusion criteria. Of those excluded, 78 were out of scope, 2 were single algorithm studies, 17 were short papers, 1 was non-English paper, and 1 was incomplete paper. In this research 111 papers were selected for the review as shown in Table5.Table 5
Selected papers per digital database.
Digital databaseNumber of articlesIEEE81ACM06Springer Link11Science Direct13


### 5.5. Data Extraction Process

The objective of this step is to provide an answer to the research questions for each paper in a semi-structured way. To avoid bias in the data extraction process, a data extraction form was developed. The data extraction form captured key elements to answer the research questions as shown in Table6.Table 6
Data extraction form.
ElementDescriptionIDUnique identifier for the studyExtractorAuthors, year, title, and countryJournal/conference nameResearch question 1Research question 2Research question 3Research question 4


## 5.1. Research Questions (RQs)

The main objective of this paper was to analyze the hybrid intrusion detection system techniques that were developed from 2012 to 2022. The following research questions were developed in line with the main objective:(a)
RQ1: which hybrid techniques have been used in intrusion detection systems? Objective: to identify techniques used in the development of hybrid IDS.(b)
RQ2: which classical algorithms were used in the integration of the hybrid? Objective: to identify commonly used algorithms in hybrid IDS.(c)
RQ3: which evaluation metrics are used in the hybrid intrusion detection systems? Objective: to identify commonly used metrics in the evaluation of IDS.(d)
RQ4: which datasets are used in hybrid intrusion detection system research? Objective: to identify commonly used datasets in hybrid IDS.


## 5.2. Search Strategy

Research shows that it is important to be guided by a search strategy in the systematic review [31]. In defining our search strategy, we were guided by the steps outlined by Thyago et al. [32]. The main two steps in this process are defining keywords and the sources of the study. The keywords were derived from the research questions. The keywords and synonyms used are as follows:(1)
Hybrid OR Integrated OR Cascaded.(2)
Intrusion detection System OR IDS(3)
Artificial Intelligence OR Machine LearningWe used the Boolean operators (OR) and (AND) to define the search string. The operator (OR) was used between synonyms, while (AND) was used between the keywords. The following search strings were defined:(1)
“Hybrid” OR “Integrated” OR “Cascaded”(2)
“Intrusion detection System” OR “IDS”(3)
“Artificial Intelligence” OR “Machine Learning”Finally, the search strings were combined as follows: ((1) AND (2) OR (1) AND (2) AND (3)).The researchers used the following digital libraries that are recognized in publishing research in the area of intrusion detection systems [33].(i)
The Institute of Electrical and Electronics Engineers (IEEE) Library (https://ieeexplore.ieee.org/)(ii)
The Association for Computing Machinery (ACM) Digital Library (https://dl.acm.org/)(iii)
Springer Link (https://link.springer.com/)(iv)
Science Direct (https://www.sciencedirect.com)Several searches were done on the above listed libraries but the search strings that yielded better result on each database are as follows:(i)
IEEE: ((“Hybrid” OR “Integrated” OR “Cascaded”) AND (“Intrusion detection System” OR “IDS”) AND (Artificial Intelligence OR Machine Learning))(ii)
ACM: [All: [[all: “hybrid”]] OR [All: [all: “integrated”]] OR [[All: [all: “cascaded”]]] AND [[All: [[all:] OR [All: “intrusion detection system”] OR [All:]]]] OR [[All: [all: “ids”]]] AND [[All: [publication] OR [All:]]]](iii)
Springer Link: ((“Hybrid” OR “Integrated” OR “Cascaded”) AND (“Intrusion detection System” OR “IDS”) AND (Artificial Intelligence OR Machine Learning))(iv)
Science Direct: ((“Hybrid” OR “Integrated” OR “Cascaded”) AND (“Intrusion detection System” OR “IDS”))The initial search obtained 2,084 articles. Table3 shows the number of articles obtained from the digital database.Table 3
Number of articles obtained from each digital database.
Digital databaseNumber of articlesIEEE563ACM337Springer Link123Science Direct1,025


## 5.3. Publication Selection Criteria

For inclusion criteria, all primary studies that have reviewed hybrid intrusion detection systems and articles published between January 2012 and February 2022 were included in the study. Single algorithm studies, secondary studies, short papers, duplicated studies, non-English studies, and incomplete papers were excluded. In addition, all studies that were not relevant to the research questions were excluded from the research. Table4 summarizes the inclusion/exclusion criteria.Table 4
Inclusion/exclusion criteria.
NumberTypeDescription1InclusionPrimary studies2.InclusionStudies published between January 2012 and February 20223InclusionStudies that propose hybrid/integrated/cascaded intrusion detection system4ExclusionStudies that propose single algorithm studies5.ExclusionGrey studies6.ExclusionShort papers (less than 5 pages)7.ExclusionDuplicated studies8.ExclusionNon-English studies9.ExclusionIncomplete papers


## 5.4. Study Selection Process

To conduct the selection process, the papers were selected according to the established strings, and papers were also selected based on the title, abstract, and keywords on this stage. The selected papers from the first selection process were subjected through the second selection process, which was based on reading the entire text of the paper.The primary reviewer conducted the selection process. The secondary reviewer conducted an inter-rater reliability test on the selected papers. This was done to make sure that there was no bias in the selection process from the primary reviewer. In the first step, 1875 studies were excluded by the reviewers as they did not satisfy the inclusion criteria. Of those excluded, 1786 were out of scope, 8 were grey studies, 27 were single algorithm studies, 53 were short papers, and 1 was duplicate paper. In the second step, 98 studies were excluded by the reviewers as they did not satisfy the inclusion criteria. Of those excluded, 78 were out of scope, 2 were single algorithm studies, 17 were short papers, 1 was non-English paper, and 1 was incomplete paper. In this research 111 papers were selected for the review as shown in Table5.Table 5
Selected papers per digital database.
Digital databaseNumber of articlesIEEE81ACM06Springer Link11Science Direct13


## 5.5. Data Extraction Process

The objective of this step is to provide an answer to the research questions for each paper in a semi-structured way. To avoid bias in the data extraction process, a data extraction form was developed. The data extraction form captured key elements to answer the research questions as shown in Table6.Table 6
Data extraction form.
ElementDescriptionIDUnique identifier for the studyExtractorAuthors, year, title, and countryJournal/conference nameResearch question 1Research question 2Research question 3Research question 4


## 6. Results and Discussion

### 6.1. Year of Publication

Figure1 shows the number of publications per year. The year with the most publication is 2020. The graph indicates a continuous increase in research in the field of hybrid IDS. This can be attributed to the desire of improving the efficiency and effectiveness of IDS.Figure 1
Number of publications per year.


### 6.2. Research Questions (RQs)

In this section, the outcome of the literature review will be analyzed and discussed as per the research questions.RQ1: which hybrid techniques have been used in intrusion detection systems?In this question, the research sought to understand which techniques were used in the development of the hybrid IDS. Research shows that hybrid approaches can be broadly categorized into three: cascaded hybrid, integrated-based hybrid, and cluster + single hybrid.As shown in Table7, the most used hybrid technique was the cascaded hybrid technique (72 papers), the integrated-based hybrid technique (36 papers), and the cluster + single technique (3 papers).Table 7
Hybrid techniques used in the intrusion detection system.
Hybrid techniqueNo. of articlesCascaded hybrid technique72Integrated-based hybrid technique36Cluster + single technique3RQ2: which classical algorithms were used in the integration of the hybrid?In this question, the researcher sought to understand the classical algorithms applied to hybrid techniques. It was established that the most used algorithms in hybrid detection systems were SVM, DT, K-means, Naïve Bayes, KNN, GA, and PSO as shown in Table8. The rest of algorithms appeared less than 5 times in the selected papers.Table 8
Classical algorithms used in hybrid IDS.
AlgorithmNo. of papersPaper IDANN47C1, C2, C3, C9, C10, C14, C25, C27, C34, C46, C47, C49, C50, C51, C52, C53, C56, C57, C58, C61, C64, C66, C67, C68, C69, C70, C71, C72, C73, C76, C77, C78, C80, C83, C84, C85, C86, C90, C91, C94, C99, C100, C104, C105, C106, C107, C111SVM33C3, C5, C7, C8, C11, C12, C14, C20, C22, C23, C30, C31, C39, C54, C55, C56, C59, C60, C61, C68, C73, C74, C78, C82, C83, C87, C93, C101, C102, C103, C104, C107, C109DT33C6, C9, C18, C19, C24, C28, C29, C31, C32, C35, C36, C37, C42, C43, C50, C51, C58, C61, C76, C65, C69, C74, C78, C79, C88, C89, C90, C92, C97, C98, C103, C109, C110K-means20C4, C5, C14, C16, C19, C21, C24, C26, C28, C29, C32, C39, C41, C42, C43, C54, C88, C90, C98, C110GA12C8, C9, C10, C11, C15, C17, C55, C61, C62, C74, C80, C103Naïve Bayes11C4, C6, C9, C16, C21, C50, C61, C69, C82, C93, C109KNN10C15, C36, C41, C45, C50, C53, C65, C67, C92, C109PSO8C13, C33, C34, C48, C49, C68, C91, C92RQ3: which are the evaluation metrics used in the hybrid intrusion detection system?Metric is the measure of the performance of ML algorithm on a given dataset. Metrics are used mostly to compare the performance of different models and determine the most effective one.Accuracy is a frequently applied metric. The purpose of this metric is to compare the correctly detected outcomes against the total detected outcomes.True-positive rate (TPR), also known as either recall, sensitivity, or detection rate, is the fraction of correctly detected positive outcomes compared to positive observation.False-positive rate (FPR), which is referred to as false alarm rate (FAR) or fall-out, is the fraction of wrongly predicted positive outcomes compared to actual negative observations.True-negative rate (TNR) is also called specificity. This metric is the ratio of correctly predicted negative outcomes compared to actually negative observations.False-negative rate (FNR) is also called miss rate. This metric is the ratio of wrongly predicted negative outcomes compared to positive observations.F-score/F-measure is a measure that combines a model’s precision and recall into an overall accuracy figure. F1 scores range from 0 to 1 with 1 being perfect and 0 indicating poor performance.Precision is the ratio of correctly predicted positive outcome compared to positive prediction.Time is a metric used to measure the efficiency of a model. This can be done either during the training stage or during the evaluation stage.This study found that three metrics were used in more than 50% of the research as shown in Figure2. These are accuracy, detection rate, and false alarm rate. Accuracy tests the performance of a model in terms of the number of correctly predicted results. The higher the accuracy, the better the model. This explains why the metric has been used in most of the studies. TPR or detection rate measures the capabilities of a model to flag attacks. This is a very important metric as the objective of any intrusion detection system is to flag attacks. Lastly, false alarm rate (FAR) is the measure of false alarms produced by the model. The more the false alarms, the poor the model. The metric can be used by the designers to improve the performance of the model by reducing or eliminating false alarms.Figure 2
Metrics used for evaluation.The above three metrics form the key evaluation metrics for any detection model. With the three metrics, it is possible to determine the overall performance of a model.RQ4: which datasets were used in hybrid intrusion detection system research?Figure3 depicts datasets used in hybrid intrusion detection system research. Dataset used is one of the most important elements in the development of anomaly-based intrusion detection systems. Despite that, the conducted review indicates that researchers are using old datasets in developing hybrid intrusion detection systems. The two most commonly used datasets are KDDCup99 and NSL-KDD. Research shows that these two datasets were developed in 1999. With the ever-changing digital landscape, these datasets cannot be used to develop effective models to combat current cyber threats. The analysis of SLR has shown that we have very few updated datasets to be used in the existing network infrastructure. The pie chart is the representation of our results.Figure 3
Dataset being used in IDS research from 2012 to 2022.


## 6.1. Year of Publication

Figure1 shows the number of publications per year. The year with the most publication is 2020. The graph indicates a continuous increase in research in the field of hybrid IDS. This can be attributed to the desire of improving the efficiency and effectiveness of IDS.Figure 1
Number of publications per year.


## 6.2. Research Questions (RQs)

In this section, the outcome of the literature review will be analyzed and discussed as per the research questions.RQ1: which hybrid techniques have been used in intrusion detection systems?In this question, the research sought to understand which techniques were used in the development of the hybrid IDS. Research shows that hybrid approaches can be broadly categorized into three: cascaded hybrid, integrated-based hybrid, and cluster + single hybrid.As shown in Table7, the most used hybrid technique was the cascaded hybrid technique (72 papers), the integrated-based hybrid technique (36 papers), and the cluster + single technique (3 papers).Table 7
Hybrid techniques used in the intrusion detection system.
Hybrid techniqueNo. of articlesCascaded hybrid technique72Integrated-based hybrid technique36Cluster + single technique3RQ2: which classical algorithms were used in the integration of the hybrid?In this question, the researcher sought to understand the classical algorithms applied to hybrid techniques. It was established that the most used algorithms in hybrid detection systems were SVM, DT, K-means, Naïve Bayes, KNN, GA, and PSO as shown in Table8. The rest of algorithms appeared less than 5 times in the selected papers.Table 8
Classical algorithms used in hybrid IDS.
AlgorithmNo. of papersPaper IDANN47C1, C2, C3, C9, C10, C14, C25, C27, C34, C46, C47, C49, C50, C51, C52, C53, C56, C57, C58, C61, C64, C66, C67, C68, C69, C70, C71, C72, C73, C76, C77, C78, C80, C83, C84, C85, C86, C90, C91, C94, C99, C100, C104, C105, C106, C107, C111SVM33C3, C5, C7, C8, C11, C12, C14, C20, C22, C23, C30, C31, C39, C54, C55, C56, C59, C60, C61, C68, C73, C74, C78, C82, C83, C87, C93, C101, C102, C103, C104, C107, C109DT33C6, C9, C18, C19, C24, C28, C29, C31, C32, C35, C36, C37, C42, C43, C50, C51, C58, C61, C76, C65, C69, C74, C78, C79, C88, C89, C90, C92, C97, C98, C103, C109, C110K-means20C4, C5, C14, C16, C19, C21, C24, C26, C28, C29, C32, C39, C41, C42, C43, C54, C88, C90, C98, C110GA12C8, C9, C10, C11, C15, C17, C55, C61, C62, C74, C80, C103Naïve Bayes11C4, C6, C9, C16, C21, C50, C61, C69, C82, C93, C109KNN10C15, C36, C41, C45, C50, C53, C65, C67, C92, C109PSO8C13, C33, C34, C48, C49, C68, C91, C92RQ3: which are the evaluation metrics used in the hybrid intrusion detection system?Metric is the measure of the performance of ML algorithm on a given dataset. Metrics are used mostly to compare the performance of different models and determine the most effective one.Accuracy is a frequently applied metric. The purpose of this metric is to compare the correctly detected outcomes against the total detected outcomes.True-positive rate (TPR), also known as either recall, sensitivity, or detection rate, is the fraction of correctly detected positive outcomes compared to positive observation.False-positive rate (FPR), which is referred to as false alarm rate (FAR) or fall-out, is the fraction of wrongly predicted positive outcomes compared to actual negative observations.True-negative rate (TNR) is also called specificity. This metric is the ratio of correctly predicted negative outcomes compared to actually negative observations.False-negative rate (FNR) is also called miss rate. This metric is the ratio of wrongly predicted negative outcomes compared to positive observations.F-score/F-measure is a measure that combines a model’s precision and recall into an overall accuracy figure. F1 scores range from 0 to 1 with 1 being perfect and 0 indicating poor performance.Precision is the ratio of correctly predicted positive outcome compared to positive prediction.Time is a metric used to measure the efficiency of a model. This can be done either during the training stage or during the evaluation stage.This study found that three metrics were used in more than 50% of the research as shown in Figure2. These are accuracy, detection rate, and false alarm rate. Accuracy tests the performance of a model in terms of the number of correctly predicted results. The higher the accuracy, the better the model. This explains why the metric has been used in most of the studies. TPR or detection rate measures the capabilities of a model to flag attacks. This is a very important metric as the objective of any intrusion detection system is to flag attacks. Lastly, false alarm rate (FAR) is the measure of false alarms produced by the model. The more the false alarms, the poor the model. The metric can be used by the designers to improve the performance of the model by reducing or eliminating false alarms.Figure 2
Metrics used for evaluation.The above three metrics form the key evaluation metrics for any detection model. With the three metrics, it is possible to determine the overall performance of a model.RQ4: which datasets were used in hybrid intrusion detection system research?Figure3 depicts datasets used in hybrid intrusion detection system research. Dataset used is one of the most important elements in the development of anomaly-based intrusion detection systems. Despite that, the conducted review indicates that researchers are using old datasets in developing hybrid intrusion detection systems. The two most commonly used datasets are KDDCup99 and NSL-KDD. Research shows that these two datasets were developed in 1999. With the ever-changing digital landscape, these datasets cannot be used to develop effective models to combat current cyber threats. The analysis of SLR has shown that we have very few updated datasets to be used in the existing network infrastructure. The pie chart is the representation of our results.Figure 3
Dataset being used in IDS research from 2012 to 2022.


## 7. Conclusion

This study has filled the gap that exists in the current body of knowledge on systematic literature review on hybrid intrusion detection systems. This systematic analysis on hybrid IDS points out the existing gaps in the development of hybrid intrusion detection systems and the need for further research on this area. The analysis of SLR indicates that the field of hybrid intrusion detection techniques is an area of focus for many researchers due to its potential of solving the issue of intrusion because this technique increases the performance and efficiency of intrusion detection systems compared to a single algorithm. Investigation on how well to integrate the existing algorithms is of the essence in this field. Most of the hybrid intrusion detection systems are based on three major categories: cascaded hybrid technique, integrated-based hybrid technique, and cluster + single technique. Based on this work, most of the studies focused on cascaded hybrid technique (65%) This method combines the classical algorithms either parallel or in serial format. The second most widely used technique according to the conducted analysis is the integrated-based hybrid technique (35%). This technique aims at optimizing the classical algorithms. Integrated-based hybrids are more efficient and give better results compared to other forms of hybrid techniques. Thus, to develop an efficient and effective IDS, integrated-based hybrid should be adopted in developing the IDS. Lastly, cluster + single technique was the least used technique (3%). The literature review has shown that the existing algorithms have the potential to solve the problem of intrusion but cannot still evolve with the ever-changing digital environment. Most of the models rely on human intervention to update them. There is a need for models which can learn their environment and update themselves without human input.According to the conducted study, researchers have deployed different types of algorithms in the development of hybrid intrusion detection. The commonly used algorithm includes ANN, SVM, DT, K-means, Naïve Bayes, KNN, GA, and PSO.For evaluation of the models, fifteen types of datasets were used in the analyzed studies. The datasets that recorded high utilization in the analyzed studies include KDDCup99 and NSL-KDD. Despite their high recorded popularity, these datasets have received criticism from researchers. Most researchers point out that these datasets were developed years ago, and hence they are outdated and ineffective in developing modern intrusion detection systems. In addition, researchers have observed that these datasets do not capture the current forms of detection, and hence they lack the capabilities of defending modern network infrastructure. To resolve this challenge, the analyzed literature review observed emerging datasets which capture current intrusions. These include CICIDS2017, UNSW-NB15, CSE-CIC-IDS2018, and Bot-IoT datasets. The problem is that most of the studies are still using old datasets. For effective IDS, researchers in this field of intrusion detection systems need to embrace the updated datasets.The three most commonly used metrics for performance evaluation of IDS are accuracy, TPR, and FPR. Future studies should consider also including CPU utilization and detection time as performance metrics. The detection of intrusion should be done on a real-time basis before any damage is caused, and hence the detection time should be as low as possible. In the development of intrusion detection systems, resource utilization should be considered. In this review, only a few papers included CPU utilization as a performance metric.



---

*Source: 9663052-2022-05-10.xml*