Comparative Analysis of Intrusion Detection Systems and Machine Learning Based Model Analysis through Decision Tree

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Even a minor departure from a pattern may go unnoticed, and insignificant variations in typical behaviour may trigger false alarms.

“Even a minor departure from a pattern may go unnoticed, and insignificant variations in typical behaviour may trigger false alarms.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

IDSs that use inflexible criteria and depend on quantitative data often produce numerous false alerts.

“IDSs that use inflexible criteria and depend on quantitative data often produce numerous false alerts.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Murray et al., 2014 used genetic algorithms to develop simple rules for network traffic.

“Murray et al., 2014 [174] used genetic algorithms (GA) to develop simple rules for network traffic.”

• cites [174] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

A statistical analysis of the cup99 dataset revealed significant issues that negatively impacted the accuracy of intrusion detection and resulted in an incorrect evaluation of the system.

“A statistical analysis of the cup99 dataset revealed significant issues that negatively impacted the accuracy of intrusion detection and resulted in an incorrect evaluation of the system.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Current research in cybersecurity is focused on achieving rapid detection, enhancing detection accuracy, and uncovering data characteristics.

“Current research in this field is focused on achieving rapid detection, enhancing detection accuracy, and uncovering data characteristics.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Feature selection preserves the original physical meaning of the features.

“In contrast to feature extraction, feature selection preserves the original physical meaning of the features.”

• cites Mitra et al. 2002Not checked yet

  Not checked in the free run.

• cites [168] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Despite its widespread use, the KDD98 dataset has limitations in terms of its reflection on real-world scenarios.

“Despite its widespread use, it has limitations in terms of its reflection on real-world scenarios.(Creech & Hu, 2014b) [70].”

• cites [70] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Feature extraction alters the inherent meaning of the features, which can complicate subsequent analysis of these features.

“However, it should be noted that feature extraction alters the inherent meaning of the features, which can complicate subsequent analysis of these features.(Carrasquilla 2010) [63].”

• cites Carrasquilla 2010Not checked yet

  Not checked in the free run.

• cites [63] Chemburkar, 2023Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The CAIDA data collected does not capture characteristics from the entire network, making it difficult to differentiate between normal and abnormal traffic patterns.

“Additionally, the data collected does not capture characteristics from the entire network, making it difficult to differentiate between normal and abnormal traffic patterns.”

May combine two claims.

Farid and his team proposed a hybrid intrusion detection system that uses a combination of Naive Bayes and decision tree algorithms, and it results in the detection rate of 99.63 % on the KDD'99 dataset.

“Farid and his team proposed a hybrid intrusion detection system that uses a combination of Naive Bayes and decision tree algorithms, and it results in the detection rate of 99.63 % on the KDD'99 dataset [79].”

• cites [79] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

A method was proposed using an SVM classifier with a radial basis function (RBF) kernel to categorize the KDD 1999 dataset into predetermined classes.

“A method was proposed using an SVM classifier with a radial basis function (RBF) kernel to categorize the KDD 1999 dataset into predetermined classes [142].”

• cites [142] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Feature extraction retains the essential characteristics of the original features and can be seen as a combination of linear or non-linear features.

“This transformation retains the essential characteristics of the original features and can be seen as a combination of linear or non-linear features.”

• cites Potluri et al. 2017Not checked yet

  Not checked in the free run.

• cites [195] Rath, 2017, A prototype multiview approach for reduction of false alarm rate in network intrusion detection system, Int. J. Comput. Netw. Commun. Secur.Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Certain studies employ specialized evaluation methods tailored to specific problems, such as response time and ROC curve.

“Additionally, certain studies employ specialized evaluation methods tailored to address specific problems, such as response time (e.g.Lu et al. 2020) [151], receiver operating characteristic (ROC) curve (e.g.Zhang et al. 2019) [275] etc.”

• cites Lu et al. 2020Not checked yet

  Not checked in the free run.

• cites [151] sourceNot checked yet

  Not checked in the free run.

• cites Zhang et al. 2019Not checked yet

  Not checked in the free run.

May combine two claims.

Studies have demonstrated that using semi-supervised learning in intrusion detection systems can improve classifier performance, requiring less effort and cost.

“Studies have demonstrated that using semi-supervised learning in intrusion detection systems can improve classifier performance, requiring less effort and cost.”

• cites [39] Axelsson, 2000Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Attackers often use techniques such as spoofing real UDP and ICMP to induce flooding.

“The attacker often uses techniques such as spoofing real User Datagram Protocol (UDP) [54] and Internet Control Message Protocol (ICMP) [97] to induce flooding.”

• cites [54] sourceNot checked yet

  Not checked in the free run.

• cites [97] sourceNot checked yet

  Not checked in the free run.

May combine two claims.

Encrypted traffic, such as HTTPS, cannot be interpreted by an Intrusion Detection System (IDS), making it difficult for the detector to compare it to the signatures stored in its database.

“Encrypted traffic, such as HTTPS, cannot be interpreted by an Intrusion Detection System (IDS) (Metke & Ekl, 2010) [165], making it difficult for the detector to compare it to the signatures stored in its database.”

• cites Metke & Ekl, 2010Not checked yet

  Not checked in the free run.

• cites [165] sourceNot checked yet

  Not checked in the free run.

• AssumptionRests on an assumption: IDSs primarily rely on inspecting the content of network packets to identify anomalies, signatures of known attacks, or suspicious behaviour.

Probably not a substantial claim: may not pass S3 (load-bearing).

The resultant feature space exhibits properties similar to the original features.

“The resultant feature space exhibits properties similar to the original features.(Potluri et al. 2017) [195].”

• cites Potluri et al. 2017Not checked yet

  Not checked in the free run.

• cites [195] Rath, 2017, A prototype multiview approach for reduction of false alarm rate in network intrusion detection system, Int. J. Comput. Netw. Commun. Secur.Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

The size of the problem domain increases proportionally with the number of features.

“The size of the problem domain increases proportionally with the number of features, and the issue of feature selection is widely considered to be NP-hard (Novaković 2016) [185].”

• cites Novaković 2016Not checked yet

  Not checked in the free run.

• cites [185] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Feature selection offers advantages including cost reduction in data acquisition and classification model training, decreased model size, enhanced classification performance, and potentially improved interpretability.

“As discussed earlier, feature selection offers several advantages, including cost reduction in data acquisition and classification model training, decreased model size, enhanced classification performance, and potentially improved inter- [53]].”

• cites [53] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

In a flooding attack, an attacker intentionally generates many network packets or events, often exceeding the system's processing capacity.

“In a flooding attack, an attacker intentionally generates many network packets or events, often exceeding the system's processing capacity.”

May combine two claims.

Jabbar and his team proposed an ensemble classifier that combines Random Forest and Average One-Dependence Estimator (AODE) algorithms to tackle the problem of attribute dependence in Naive Bayes, and the use of Random Forest improves accuracy and decreases false positive results.

“Jabbar and his team proposed an ensemble classifier that combines Random Forest and Average One-Dependence Estimator (AODE) algorithms to tackle the problem of attribute dependence in Naive Bayes.The use of Random Forest (RF) improves accuracy and decreases false positive results( [112].”

• cites [112] sourceNot checked yet

  Not checked in the free run.

• AssumptionRests on an assumption: Multiple machine learning algorithms might be employed to achieve greater prediction performance than any of the individual learning algorithms.

Probably not a substantial claim: may not pass S3 (load-bearing).

Elhag et al. showed that the rate of false alarms in identifying invasive acts might be reduced by using fuzzy logic.

“Elhag et al. showed that the rate of false alarms in identifying invasive acts might be reduced by using fuzzy logic.”

• cites [77] Farid, 2010, Combining naive Bayes and decision tree for adaptive intrusion detection, arXiv:1005.4496Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

In the clustering process of records, anomalies are labelled as intrusions because they appear in small clusters, while normal occurrences tend to form larger clusters.

“In the clustering process of records, anomalies are labelled as intrusions because they appear in small clusters, while normal occurrences tend to form larger clusters.”

Probably not a substantial claim: may not pass S3 (load-bearing).

One method utilized the K-means clustering algorithm to distinguish various profiles of host behaviour.

“One method Utilized the K-means clustering algorithm to distinguish various profiles of host behaviour [176].”

• cites [176] Nigam, 2000, Text classification from labeled and unlabeled documents using EM, Mach. Learn. sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

IP address spoofing is commonly used in several attacks, including distributed denial-of-service (DDoS) attacks, IP hijacking, session hijacking, and network scanning.

“IP address spoofing is commonly used in several attacks, including distributed denial-of-service (DDoS) attacks, IP hijacking, session hijacking, and network scanning.”

May combine two claims.

Encrypted traffic presents a challenge for the IDS to detect attacks, even though encrypted traffic can still be analyzed for certain behaviours.

“As a result, encrypted traffic presents a challenge for the IDS to detect attacks, even though encrypted traffic can still be analyzed for certain behaviours [59].”

• cites [59] sourceNot checked yet

  Not checked in the free run.

• AssumptionRests on an assumption: IDSs primarily rely on inspecting the content of network packets to identify anomalies, signatures of known attacks, or suspicious behaviour.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Training GANs can be challenging, requiring balancing the training of the generator and discriminator networks and avoiding issues such as mode collapse and training instability.

“However, training GANs can be challenging.It requires balancing the training of the generator and discriminator networks, avoiding issues such as mode collapse (where the generator only produces limited types of samples) and training instability.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

GANs have been used for tasks such as image translation, data augmentation, and even generating deepfake videos.

“They have been used for tasks such as image translation, data augmentation, and even generating deepfake videos [20].”

• cites [20] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

DBMs are designed to capture complex patterns and dependencies in high-dimensional data by learning a hierarchical representation of the input.

“DBMs are designed to capture complex patterns and dependencies in high-dimensional data by learning a hierarchical representation of the input.”

Classified as probably not a substantial claim.

The review adopted a systematic literature review approach.

“To collect and evaluate relevant information on the topic, a systematic literature review approach is adopted [122].”

• cites [122] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Various techniques, such as different loss functions, regularization methods, and architectural modifications, have been developed to address GAN training challenges and improve stability and quality.

“Various techniques, such as different loss functions, regularization methods, and architectural modifications, have been developed to address these challenges and improve the stability and quality of GAN training.”

Probably not a substantial claim: may not pass S3 (load-bearing).

RBMs are widely used in machine and deep learning for tasks such as dimensionality reduction, feature learning, and collaborative filtering.

“RBMs are widely used in machine and deep learning for tasks such as dimensionality reduction, feature learning, and collaborative filtering.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

FCNNs have been successfully applied to various tasks, such as image classification, natural language processing, and time series analysis.

“They have been successfully applied to various tasks, such as image classification, natural language processing, and time series analysis.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The restricted Boltzmann machine (RBM) is a generative model used in the training of deep neural networks through greedy layer-by-layer feature learning.

“The restricted Boltzmann machine (RBM) is a generative model (Fischer & Igel, 2014) [80], (Hinton & Sejnowski, 1986) [101] used in the training of deep neural networks through greedy layer-by-layer feature learning.”

• cites Fischer & Igel, 2014Not checked yet

  Not checked in the free run.

• cites [80] sourceNot checked yet

  Not checked in the free run.

• cites Hinton & Sejnowski, 1986Not checked yet

  Not checked in the free run.

May combine two claims.

The main drawback of HIDS is that every host requiring intrusion protection must be installed with it, leading to added processing burden on each node and inefficiency in overall IDS performance.

“The main drawback of HIDS is that every host has to be installed that requires intrusion protection, leading to added processing burden on each node, resulting in inefficiency in overall IDS performance [118].”

• cites [118] Keele, 2007, Guidelines for performing systematic literature reviews in software engineeringNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

IDS can be categorized in terms of how it deploys or detects.

“IDS can be categorized in terms of how it deploys or detects.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Regularization techniques, such as dropout or L2 regularization, are often employed to mitigate overfitting.

“Regularization techniques, such as dropout or L2 regularization, are often employed to mitigate overfitting.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

RBMs can be stacked together to form deep belief networks (DBNs) or used in generative models to generate new samples that resemble the training data.

“RBMs can also be stacked together to form deep belief networks (DBNs) or used in generative models to generate new samples that resemble the training data.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

DBMs are known for capturing complex dependencies and generating realistic samples from the learned distribution.

“DBMs are known for capturing complex dependencies and generating realistic samples from the learned distribution.”

Probably not a substantial claim: may not pass S4 (based).

ML and DL techniques show potential in efficiently detecting intruders across networks.

“Machine learning (ML) and deep learning (DL) techniques are adopted in IDS systems, showing potential in efficiently detecting intruders across networks.”

Probably not a substantial claim: may not pass S3 (load-bearing).

From a deployment perspective, IDS can be divided into two categories: Host-based IDS and Network-based IDS.

“From a deployment perspective, IDS can be divided into two categories: Host-based IDS and Network-based IDS [173] [239].”

• cites [173] sourceNot checked yet

  Not checked in the free run.

• cites [239] Vojinovic, 2023Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Various approximation techniques and learning algorithms, such as Contrastive Divergence, have been developed to overcome DBM training challenges and make training DBMs feasible.

“As a result, various approximation techniques and learning algorithms, such as Contrastive Divergence, have been developed to overcome these challenges and make training DBMs feasible.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Training DBMs can be computationally challenging due to the intractability of computing the partition function, which is required for efficient learning.

“However, training DBMs can be computationally challenging due to the intractability of computing the partition function, which is required for efficient learning.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Overfitting can be a challenge as the number of parameters in FCNNs grows with the number of neurons and layers.

“However, overfitting can be a challenge as the number of parameters in FCNNs grows with the number of neurons and layers.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

GANs are used for unsupervised learning and are particularly powerful in generating realistic synthetic data, such as images, text, and audio.

“GANs are used for unsupervised learning and are particularly powerful in generating realistic synthetic data, such as images, text, and audio.”

Probably not a substantial claim: may not pass S3 (load-bearing).

David Bau and Jun-Yan Zhu present an analytical framework to visualize and comprehend GANs at the unit, object, and scene levels.

“David Bau and Jun-Yan Zhu present an analytical framework [43] to visualize and comprehend GANs at the unit, object, and scene levels.”

• cites [43] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

FCNNs are powerful models capable of learning complex non-linear relationships in data.

“FCNNs are powerful models capable of learning complex non-linear relationships in data.”

Probably not a substantial claim: may not pass S2 (checkable). May combine two claims.

There is a need for a more recent analysis/update of intrusion detection surveys because earlier surveys have not thoroughly reviewed dataset issues, evasion techniques, and various attack forms, and new IDS designs have been developed.

“There is a requirement for a more recent analysis, as earlier surveys on intrusion detection have not thoroughly reviewed dataset issues, evasion techniques, and various attack forms.”

• Also stated in: § I. INTRODUCTION · plain

  “There is a need for an update because various other intrusion-detection system designs have been developed in the meantime due to the evolution of these systems.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The feedforward architecture is commonly used for feature extraction.

“This architecture is commonly used for feature extraction [255].”

• cites [255] Yadav, 2021Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

According to Sung and Mukkamala (2003), attack types can be divided into four categories.

“According to Sung and Mukkamala (2003) [231], attack types can be divided into four categories.”

• cites Sung and Mukkamala (2003) [231]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

GANs have been successful in various domains, including image generation, text generation, and video synthesis.

“GANs have been successful in various domains, including image generation, text generation, and video synthesis.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

RBMs provide a powerful tool for unsupervised learning, enabling the discovery of hidden patterns and learning useful data representations.

“Overall, RBMs provide a powerful tool for unsupervised learning, enabling the discovery of hidden patterns and learning useful data representations.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Deep Boltzmann Machine (DBM) has hidden layers with undirected connections throughout the network.

“A generative model called Deep Boltzmann Machine (DBM) (Salakhutdinov & Hinton,2009) [211] (Salakhutdinov & Larochelle, 2010) [212] has hidden layers with undirected connections throughout the network.”

• cites Salakhutdinov & Hinton,2009Not checked yet

  Not checked in the free run.

• cites [211] sourceNot checked yet

  Not checked in the free run.

• cites Salakhutdinov & Larochelle, 2010Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

The adversarial training between the generator and discriminator networks allows the GAN to learn the underlying distribution of the training data and generate new samples that follow a similar distribution.

“The adversarial training between the generator and discriminator networks allows the GAN to learn the underlying distribution of the training data and generate new samples that follow a similar distribution.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Sparse coding has been successfully applied in several domains, including computer vision, natural language processing, and signal processing.

“Sparse coding has been successfully applied in several domains, including computer vision, natural language processing, and signal processing.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Olshausen & Field (1997) introduced sparse coding for the first time as a machine learning technique for learning over-complete basis to create effective data representation reducing the dimensionality of data and dynamically represent the data as a linear combination of basis vectors.

“Olshausen & Field (1997) [186] introduced sparse coding for the first time as a machine learning technique for learning over-complete basis to create effective data representation reducing the dimensional of data and dynamically represent the data as a linear combination of basis vectors.”

• cites Olshausen & Field (1997)Not checked yet

  Not checked in the free run.

• cites [186] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

The Wireless Sensor Network (WSN), composed of multiple sensor nodes for gathering data, is a crucial technology in building an Internet of Things (IoT) network.

“The Wireless Sensor Network (WSN), composed of multiple sensor nodes for gathering data, is a crucial technology in building an Internet of Things (IoT) network [161].”

• cites [161] Mishra, 2023Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Multivariate statistical IDs face their biggest hurdle due to the difficulty in estimating distributions for high-dimensional data.

“Due to the difficulty in estimating distributions for high-dimensional data, multivariate statistical IDs face their biggest hurdle.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Expert systems are typically limited to the knowledge and rules explicitly defined within them.

“However, it's important to note that expert systems are typically limited to the knowledge and rules explicitly defined within them.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

The DBM model uses Markov random fields for layer-by-layer pretraining on large amounts of unlabeled data and provides feedback using a bottom-up approach similar to Deep Belief Networks (DBN).

“The model uses Markov random fields for layer-by-layer pretraining on large amounts of unlabeled data and provides feedback using a bottom-up approach similar to Deep Belief Networks (DBN).”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

The goal of utilizing machine learning is to develop intrusion detection systems (IDS) that are more precise and rely less on human expertise in identifying patterns.

“The goal of utilizing machine learning is to develop intrusion detection systems (IDS) that are more precise and rely less on human expertise in identifying patterns.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

IoT sensor devices gather a significant amount of important data and then distribute it online.

“Here IoT sensor devices gather a significant amount of important data and then distribute it online [217].”

• cites [217] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Time series models can detect anomalies or deviations from the expected behaviour by analysing historical data.

“Time series models can detect anomalies or deviations from the expected behaviour by analysing historical data.”

• AssumptionThe authors state this as an assumption: Time series models assume that the observed data points are not independent but depend on the previous observations sequentially.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

A finite state machine (FSM) is employed to monitor deviations from the expected behaviour, and any deviation from this FSM is considered an attack.

“A finite state machine (FSM) is employed to monitor deviations from the expected behaviour, and any deviation from this FSM is considered an attack.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

This sparse representation can benefit various tasks, such as denoising, compression, feature selection, and anomaly detection.

“This sparse representation can benefit various tasks, such as denoising, compression, feature selection, and anomaly detection.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The expert system approach requires constructing a comprehensive knowledge base that accurately represents the traffic pattern.

“The method in question is referred to as the expert system approach and requires constructing a comprehensive knowledge base that accurately represents the traffic pattern [94].”

• cites [94] Harshita, 2017, Detection and prevention of ICMP flood DDOS attack, Int. J. New Technol. Res.Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

DBMs have been used in various applications, including image generation, feature learning, and collaborative filtering.

“DBMs have been used in various applications, including image generation, feature learning, and collaborative filtering.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Univariate analysis alone may not capture complex relationships or interactions among variables, as it treats each variable independently.

“However, it is important to note that univariate analysis alone may not capture complex relationships or interactions among variables, as it treats each variable independently.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Trust-based IDS detects malicious nodes by regularly scanning network traffic for unusual behaviour and assessing the nodes' trustworthiness.

“A trust-based IDS detects malicious nodes by regularly scanning network traffic for unusual behaviour and assessing the nodes' trustworthiness.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The C4.5, ID3, and CART algorithms are among the well-known decision tree algorithms used for intrusion detection.

“The C4.5 algorithm [200], the ID3 algorithm [199], and the CART algorithm [55] are among the well-known decision tree algorithms used for intrusion detection.”

• cites [200] sourceNot checked yet

  Not checked in the free run.

• cites [199] sourceNot checked yet

  Not checked in the free run.

• cites [55] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

Obtaining information about all typical behaviours can be challenging.

“Obtaining information about all typical behaviours can be challenging.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

When combined with one or more hidden layers, ANN can create highly nonlinear models that capture complex relationships between input variables and classification outcomes.

“When combined with one or more hidden layers, ANN can create highly nonlinear models that capture complex relationships between input variables and classification outcomes, which is considered an advantage of this machinelearning technique.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Signature analysis effectively detects well-known and documented attacks because it relies on matching against a predefined set of signatures.

“Signature analysis effectively detects well-known and documented attacks because it relies on matching against a predefined set of signatures.”

Probably not a substantial claim: may not pass S3 (load-bearing).

There are security challenges for the IoT network because of the complex structure of WSN, which is composed of resource-constrained sensor nodes.

“There are security challenges for the IoT network because of the complex structure of WSN, which is composed of resource-constrained sensor nodes [139] [98].”

• cites [139] sourceNot checked yet

  Not checked in the free run.

• cites [98] Hinton, 1986, Learning and relearning in Boltzmann machines, Parallel Distrib. Process., Explor. Microstructure CognitionNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

The adoption of IoT devices has increased exponentially due to the popularity of the IoT device and the development of network technology.

“The adoption of IoT devices has increased exponentially due to the popularity of the IoT device and the development of network technology [22] [23].”

• cites [22] sourceNot checked yet

  Not checked in the free run.

• cites [23] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

The selection of an appropriate time series model depends on the characteristics of the data, the level of complexity desired, and the specific objectives of the IDS.

“It is important to note that the selection of an appropriate time series model depends on the characteristics of the data, the level of complexity desired, and the specific objectives of the IDS.”

• AssumptionThe authors state this as an assumption: Time series models assume that the observed data points are not independent but depend on the previous observations sequentially.

Probably not a substantial claim: may not pass S3 (load-bearing).

Updating the knowledge base with the expected normal behaviour is a difficult and time-consuming task, especially in a computing environment that is constantly evolving.

“Updating the knowledge base with the expected normal behaviour is a difficult and time-consuming task, especially in a computing environment that is constantly evolving.”

Probably not a substantial claim: may not pass S3 (load-bearing).

A technique was suggested by Qingtao et al. for identifying network irregularities by analyzing sudden changes in time series data.

“A technique was suggested by Qingtao et al. [131] for identifying network irregularities by analyzing sudden changes in time series data.”

• cites Qingtao et al.Not checked yet

  Not checked in the free run.

• cites [131] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Time series models can capture temporal dependencies and patterns in network traffic data, system logs, or other time-varying data sources.

“Time series models are particularly relevant for IDSs as they can capture temporal dependencies and patterns in network traffic data, system logs, or other time-varying data sources.”

• AssumptionThe authors state this as an assumption: Time series models assume that the observed data points are not independent but depend on the previous observations sequentially.

Probably not a substantial claim: may not pass S3 (load-bearing).

These decision tree algorithms employ various techniques for attribute selection, pruning, and handling missing values to construct accurate and robust decision trees for classifying network traffic or system events as usual or intrusive.

“These algorithms employ various techniques for attribute selection, pruning, and handling missing values to construct accurate and robust decision trees for classifying network traffic or system events as usual or intrusive.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Multiple techniques have been employed to uncover meaningful information from intrusion datasets, such as clustering, neural networks, association rules, decision trees, genetic algorithms, and nearest-neighbour methods.

“Multiple techniques have been employed to uncover meaningful information from intrusion datasets, such as clustering, neural networks, association rules, decision trees, genetic algorithms, and nearest-neighbour methods [136] evaluate the importance of features in IDS [77].”

• cites [136] sourceNot checked yet

  Not checked in the free run.

• cites [77] Farid, 2010, Combining naive Bayes and decision tree for adaptive intrusion detection, arXiv:1005.4496Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Multivariate statistical IDS can provide a more comprehensive and accurate assessment of system security by considering multiple variables simultaneously.

“Multivariate statistical IDS can provide a more comprehensive and accurate assessment of system security by considering multiple variables simultaneously.”

Probably not a substantial claim: may not pass S3 (load-bearing).

IDS sees the game between attackers and defenders for IoT and WSN as being simulated either via their interaction or the use of an attacker's forecasting approach.

“IDS sees the game between attackers and defenders for IoT and WSN as being simulated either via their interaction or the use of an attacker's forecasting approach [13] [12] [14] [15].”

• cites [13] sourceNot checked yet

  Not checked in the free run.

• cites [12] sourceNot checked yet

  Not checked in the free run.

• cites [14] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

The normal activity profile in AIDS is tailored to specific networks and applications.

“and the fact that the normal activity profile is tailored to specific networks and applications [91].”

• cites [91] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

The sparsity constraint in sparse coding encourages the coefficients to be mostly zero, resulting in a sparse representation.

“The sparsity constraint in sparse coding encourages the coefficients to be mostly zero, resulting in a sparse representation.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Recent studies to learn data representation, particularly in human activity recognition, including the shift in variant method and sparse fusion, reduce computational complexities for implementation of human activity recognition system using a mobile phone and wearable devices.

“Recent studies to learn data representation, particularly in human activity recognition, including the shift in variant method (Vollmer, Gross & Eggert, 2013b) [250] and sparse fusion (Ding, Lei, & Rao, 2016) [74] reducing computational complexities for implementation of human activity recognition system using a mobile phone and wearable devices.”

• cites Vollmer, Gross & Eggert, 2013bNot checked yet

  Not checked in the free run.

• cites [250] Wise, 2023Not checked yet

  Not checked in the free run.

• cites Ding, Lei, & Rao, 2016Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The main disadvantage of AIDS is the false alarm rate (FAR), making it difficult to distinguish between normal and abnormal intrusion detection patterns.

“The main disadvantage of AIDS is the false alarm rate (FAR), making it difficult to distinguish between normal and abnormal intrusion detection patterns [197].”

• cites [197] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Any deviation from typical behaviour is considered an anomaly and will be detected as an attack.

“Any deviation from this typical behaviour is considered an anomaly and will be detected as an attack [180] [153].”

• cites [180] sourceNot checked yet

  Not checked in the free run.

• cites [153] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

DBMs are particularly effective when dealing with high-dimensional and complex data, as they can learn hierarchical representations that capture local and global patterns.

“They are particularly effective when dealing with highdimensional and complex data, as they can learn hierarchical representations that capture local and global patterns.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The data structure is captured by this efficient sparse coding model, which also finds correlations between different input vectors.

“The data structure is captured by this efficient sparse coding model, which also finds correlations between different input vectors [92].”

• cites [92] Guyon, 2002, Gene selection for cancer classification using support vector machines, Mach. Learn. sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Game theory is commonly utilized in the design of IDS to improve its effectiveness.

“Game theory is commonly utilized in the design of IDS to improve its effectiveness.”

Probably not a substantial claim: may not pass S3 (load-bearing).

SIDS efficiently detects known attacks since their signatures are easily accessible.

“One advantage is that it efficiently detects known attacks since their signatures are easily accessible.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

In the field of AIDS, machine learning is widely used to analyze data.

“In the field of AIDS, machine learning is widely used to analyze data.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

In machine learning and deep learning, sparse coding has been used as a component in models such as sparse autoencoders and sparse coding neural networks.

“In machine learning and deep learning, sparse coding has been used as a component in models such as sparse autoencoders and sparse coding neural networks.”

Probably not a substantial claim: may not pass S3 (load-bearing).

FSM-based techniques in AIDS provide a rule-based approach to anomaly detection, where the expected behavior is explicitly defined in the FSM model.

“FSM-based techniques in AIDS provide a rule-based approach to anomaly detection, where the expected behavior is explicitly defined in the FSM model.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

These models leverage sparse coding to learn more compact and meaningful data representations, which can improve generalization, reduce overfitting, and provide interpretable features.

“These models leverage sparse coding to learn more compact and meaningful data representations, which can improve generalization, reduce overfitting, and provide interpretable features.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

IDS is recognized as one of the most effective WSN and IoT security solutions.

“IDS is therefore recognized as one of the most effective WSN and IoT security solutions.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Multivariate analysis can help reduce false positives and enhance the overall performance of intrusion detection systems.

“Additionally, multivariate analysis can help reduce false positives and enhance the overall performance of intrusion detection systems.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The k-NN algorithm is often considered a benchmark for other classifiers due to its superior classification results in many intrusion detection systems.

“The k-NN algorithm is often considered a benchmark for other classifiers due to its superior classification results in many intrusion detection systems [148].”

• cites [148] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Obfuscation techniques are continually evolving as attackers adapt to new defense mechanisms.

“Obfuscation techniques are continually evolving as attackers adapt to new defense mechanisms.”

Probably not a substantial claim: may not pass S3 (load-bearing).

HMMs can be utilized to categorize specific types of malware.

“HMMs can be utilized to categorize specific types of malware [176].”

• cites [176] Nigam, 2000, Text classification from labeled and unlabeled documents using EM, Mach. Learn. sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Analyzing large datasets demands increased memory capacity and computational resources due to their size.

“Analyzing large datasets demands increased memory capacity and computational resources due to their size.(Carrasquilla2010) [63].”

• cites [63] Chemburkar, 2023Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Obfuscation aims to make the malicious behaviour or payload less recognizable or understandable to the IDS, thus reducing the chances of triggering an alarm or raising suspicion.

“Obfuscation aims to make the malicious behaviour or payload less recognizable or understandable to the IDS, thus reducing the chances of triggering an alarm or raising suspicion.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The K-means algorithm does not require computing the distances between all possible pairs of data points, which makes it computationally efficient.

“Unlike other clustering techniques, the K-means algorithm does not require computing the distances between all possible pairs of data points, which makes it computationally efficient.”

Probably not a substantial claim: may not pass S3 (load-bearing).

When an attacker wants to evade detection by an IDS, they can employ encryption to protect the payload of their network traffic.

“When an attacker wants to evade detection by an IDS, they can employ encryption to protect the payload of their network traffic.”

• AssumptionRests on an assumption: IDSs primarily rely on inspecting the content of network packets to identify anomalies, signatures of known attacks, or suspicious behaviour.

Probably not a substantial claim: may not pass S3 (load-bearing).

SVD is particularly useful when dealing with high-dimensional or noisy data, as it provides a compact representation of the data while preserving the most relevant information.

“It is particularly useful when dealing with high-dimensional or noisy data, as it provides a compact representation of the data while preserving the most relevant information.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Singular Value Decomposition can help identify the best set of features for anticipating detection by selecting the most important singular vectors that capture the meaningful structure of the data.

“In the context mentioned, Singular Value Decomposition can help identify the best set of features for anticipating detection by selecting the most important singular vectors that capture the meaningful structure of the data [42].”

• cites [42] Bau, 2018, GAN dissection: Visualizing and understanding generative adversarial networks, arXiv:1811.10597Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Hybrid IDS combine AIDS and SIDS and address the drawbacks of both SIDS and AIDS.

“Hybrid IDS combine AIDS and SIDS.It addresses the drawbacks of both SIDS and AIDS.”

• AssumptionRests on an assumption: Traditional IDSs have drawbacks such as difficulty in modification, inability to recognize new malicious threats, poor accuracy, and a high rate of false alerts.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

PCA may not always be suitable for all datasets or analysis goals, and its effectiveness depends on the underlying structure of the data.

“However, it is important to note that PCA may not always be suitable for all datasets or analysis goals, and its effectiveness depends on the underlying structure of the data [17] [56].”

• cites [17] sourceNot checked yet

  Not checked in the free run.

• cites [56] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Flooding attacks can exploit network protocol vulnerabilities or target specific IDS components.

“Flooding attacks can exploit network protocol vulnerabilities or target specific IDS components.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The issue of feature selection is widely considered to be NP-hard.

“The size of the problem domain increases proportionally with the number of features, and the issue of feature selection is widely considered to be NP-hard (Novaković 2016) [185].”

• cites Novaković 2016Not checked yet

  Not checked in the free run.

• cites [185] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Feature engineering has emerged as a valuable solution for managing high-dimensional data.

“In this context, feature engineering has emerged as a valuable solution for managing high-dimensional data.”

• AssumptionRests on an assumption: Feature selection aids in reducing computational complexity, removing redundant data, enhancing the accuracy of machine learning methods, simplifying data, and decreasing false alarm rates.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The ADFA-LD dataset is appropriate for illustrating the contrasts between SID and AIDS methods for intrusion detection because it includes attack instances that originated from new zero-day malware.

“The ADFA-LD dataset is appropriate for illustrating the contrasts between SID and AIDS methods for intrusion detection because it includes attack instances that originated from new zero-day malware.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Normal and intrusion instances are different, so they do not fall into an identical cluster.

“Normal and intrusion instances are different, so they do not fall into an identical cluster.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

By fragmenting a packet, an attacker may distribute the malicious payload across multiple fragments, making it difficult for the IDS to detect the full extent of the malicious content.

“By fragmenting the packet, the attacker may distribute the malicious payload across multiple fragments, making it difficult for the IDS to detect the full extent of the malicious content.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Hierarchical clustering can be computationally expensive, especially for large datasets, and its performance heavily depends on the choice of distance metric and linkage criterion.

“However, hierarchical clustering can be computationally expensive, especially for large datasets, and its performance heavily depends on the choice of distance metric and linkage criterion [181] [175].”

• cites [181] sourceNot checked yet

  Not checked in the free run.

• cites [175] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

The suitability of obtained features is assessed using evaluation criteria that encompass measures such as distance, information, dependence, and consistency.

“The suitability of the obtained features is assessed using evaluation criteria that encompass measures such as distance, information, dependence, and consistency (Liu and Motoda 2012; Jović et al. 2015; Ambusaidi et al. 2016) [11] [237] [36].”

• cites Liu and Motoda 2012Not checked yet

  Not checked in the free run.

• cites Jović et al. 2015Not checked yet

  Not checked in the free run.

• cites Ambusaidi et al. 2016Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

DL-based approaches tend to outperform ML-based methods because they automatically learn features and have stronger modelling capabilities.

“DL-based approaches tend to outperform ML-based methods because they automatically learn features and have stronger modelling capabilities.”

Probably not a substantial claim: may not pass S3 (load-bearing).

A variety of data augmentation techniques, including shifting sensor locations, arbitrary rotations, permuting sensor event locations, time warping, and scaling, will significantly improve the performance of deep learning-based human activity recognition.

“A variety of data augmentation techniques, including shifting the locations of sensors, arbitrary rotations, permuting the locations where sensor events occurred, time warping, and scaling, will significantly improve the performance of deep learning-based human activity recognition [242].”

• cites [242] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Using proxy servers adds additional complexity and indirection to the attacker's activities, making it challenging for IDS systems to accurately attribute and detect malicious behaviour.

“Using proxy servers adds additional complexity and indirection to the attacker's activities, making it challenging for IDS systems to accurately attribute and detect malicious behaviour.”

May combine two claims.

Testing IDS using outdated benchmark datasets does not provide an accurate evaluation and may lead to incorrect claims about their effectiveness.

“Therefore, testing IDS using these datasets does not provide an accurate evaluation and may lead to incorrect claims about their effectiveness.”

• AssumptionRests on an assumption: Current machine learning techniques heavily rely on outdated datasets because publicly available datasets are the only acceptable options.
• AssumptionRests on an assumption: Widely used benchmark datasets no longer reflect contemporary zero-day attacks.
• AssumptionRests on an assumption: Some new datasets contain many new attacks but are still inadequate.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

IP address spoofing conceals the true identity or origin of the attacker, making it challenging for the IDS to identify and trace the source of the malicious activity accurately.

“The primary objective of IP address spoofing is to conceal the true identity or origin of the attacker, making it challenging for the IDS to identify and trace the source of the malicious activity accurately.”

May combine two claims.

A hybrid model comprising a C4.5 decision tree and Multilayer Perceptron (MCP) was trained and tested on three features of the IS-CXIDS2012 dataset, achieving a detection accuracy of 99% [96], which shows a detection accuracy of 99.50% and a false alarm rate as low as 0.03%.

“A hybrid model comprising a C4.5 decision tree and Multilayer Perceptron (MCP) was trained and tested on three features of the IS-CXIDS2012 dataset, achieving a detection accuracy of 99 % [96], which shows a detection accuracy of 99.50% and a false alarm rate as low as 0.03%.”

• cites [96] Healey, 2016, The U.S. government and zero-day vulnerabilities, J. Int. AffairsNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

These techniques can be challenging to implement in real-time NIDS and improve the overall performance of NIDS due to their high complexity and requirement for significant computational resources such as processing power and storage.

“These techniques can be challenging to implement in real-time NIDS and improve the overall performance of NIDS due to their high complexity and requirement for significant computational resources such as processing power and storage.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Improving high computational resources will also aid in the real-time and online implementation of ML/DL on mobile and wearable devices.

“Improving high computational resources will also aid in the real-time and online implementation of ML/DL on mobile and wearable devices.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

By utilizing Source Routing techniques, attackers can attempt to circumvent network-based security controls, such as IDS systems that rely on monitoring network traffic or analyzing packet metadata.

“By utilizing Source Routing techniques, attackers can attempt to circumvent network-based security controls, such as IDS systems that rely on monitoring network traffic or analyzing packet metadata.”

May combine two claims.

The XGBoost-based IDS model has a detection rate of 99.60% and an accuracy rate of 99.65% while maintaining a low false alarm rate of 0.302%.

“The aforementioned model has a detection rate of 99.60% and an accuracy rate of 99.65% while maintaining a low false alarm rate of 0.302%.”

• cites [225] 2017Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

A systematic approach was taken in selecting relevant articles.

“A systematic approach was taken in selecting relevant articles.”

May combine two claims.

In mobile and wearable-based human activity recognition, class imbalance can be caused by distortions in the dataset or inaccuracies in sensor data calibration, reducing the generalizability of the model's performance.

“In the case of mobile and wearable-based human activity recognition, the class imbalance can be caused by distortions in the dataset or inaccuracies in sensor data calibration, reducing the generalizability of the model's performance (Edel & Köppe, 2016) [76].”

• cites Edel & Köppe, 2016Not checked yet

  Not checked in the free run.

• cites [76] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The primary objective of Stuxnet was likely aimed at ICSs, and the Iranian atomic program was probably Stuxnet's main target.

“Unlike typical attacks, the primary objective of Stuxnet was likely aimed at ICSs.In contrast to a typical attack, the Iranian atomic program was probably Stuxnet's main target (Nourian & Madnick, 2018) [184].”

• cites Nourian & Madnick, 2018Not checked yet

  Not checked in the free run.

• cites [184] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Many studies classify feature selection methods into three categories: filter-based techniques, wrapper techniques, and embed techniques.

“Many studies classify feature selection methods into three categories: filter-based techniques, wrapper techniques, and embed techniques”

• cites [210] sourceNot checked yet

  Not checked in the free run.

• cites [52] sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Anonymizers aim to hide the true identity or origin of network traffic or malicious payloads, making it difficult for IDS systems to detect and analyze the attacks accurately.

“Anonymisers aim to hide the true identity or origin of network traffic or malicious payloads, making it difficult for IDS systems to detect and analyze the attacks accurately.”

• AssumptionRests on an assumption: IDS evasion techniques pose a challenge for intrusion detection systems.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

By utilizing proxy servers, attackers can attempt to hide their malicious activities and bypass or deceive intrusion detection systems.

“By utilizing proxy servers, attackers can attempt to hide their malicious activities and bypass or deceive intrusion detection systems.”

Probably not a substantial claim: may not pass S3 (load-bearing).

By shuffling the order of hosts, an attacker can make it more challenging for the IDS to correlate network events accurately.

“By shuffling the order of hosts, an attacker can make it more challenging for the IDS to correlate network events accurately.”

• AssumptionRests on an assumption: IDSs often rely on analyzing predictable patterns of network traffic to detect anomalies or suspicious activities.

Probably not a substantial claim: may not pass S3 (load-bearing).

Source Routing techniques make it challenging for IDS systems to detect and analyze malicious activities or anomalous behaviour accurately.

“These techniques make it challenging for IDS systems to detect and analyze malicious activities or anomalous behaviour accurately.”

Classified as probably not a substantial claim.

In IoT networks, a lightweight IDS model is required for sensor nodes with limited resources.

“However, in the second scenario, a lightweight IDS model is required for sensor nodes with limited resources.”

• AssumptionRests on an assumption: In IoT networks, sensor nodes have limited computational power, storage capacity, and battery life.

Probably not a substantial claim: may not pass S3 (load-bearing).

If the source port is manipulated to mimic legitimate traffic, it becomes more challenging for the IDS to differentiate between malicious and legitimate communication.

“However, if the source port is manipulated to mimic legitimate traffic, it becomes more challenging for the IDS to differentiate between malicious and legitimate communication.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

By changing the source port to a commonly used port number associated with a well-known service, such as port 80 for HTTP or port 443 for HTTPS, attackers attempt to blend their traffic with legitimate network traffic.

“By changing the source port to a commonly used port number associated with a well-known service, such as port 80 for HTTP or port 443 for HTTPS, attackers attempt to blend their traffic with legitimate network traffic.”

Classified as probably not a substantial claim.

Such demands can strain the processing unit, which may negatively impact the performance of the IDS.

“Such demands can strain the processing unit, which may negatively impact the performance of the IDS.”

• AssumptionRests on an assumption: Most IDS methods proposed by researchers (nearly 80%) rely on DL-based or DL-ML-based models that are highly complex and require significant processing time and computing resources.

May combine two claims.

SVM produced a classification report with the highest accuracy rate, which is 95%, followed by DT with 93% and KNN with 92%.

“SVM produced a classification report with the highest accuracy rate, which is 95 %, followed by DT with a rate of 93 % and KNN with a rate of 92 %.”

• cites [261] sourceNot checked yet

  Not checked in the free run.