## 1 Introduction  
In recent years many organizations have been increasingly exposed to advanced cyber threats which led to the development of the novel intrusion detection system (IDS). The invention of IDSs affects deals with both the academic community and the industry globally since it affects economic costs, damages to reputation, and legal sequences, by every cyber-attack. It is therefore of considerable importance for networks to be secured from unauthorized access, for user interaction and user data to be protected [1], and to disclose new security vulnerabilities.  
An efficient security strengthening tool for detecting and protecting cyber assaults on any network or host is the IDS. IDSs are accountable for the detection of suspicious behaviors and the adequate protection of the network against attacks and the reduction in losses such as financial and functional [2].  
IDSs can be classified in the literature as an anomaly [3], signature [4], or as a hybrid mix [5] of the two. Intrusion detection systems based on the signature (SIDS), which is also known as Rule IDS, conduct continuous network traffic monitoring and searches for inbound network traffic sequences or patterns that meet the signature of the attack. The signature of the attack can be recognized based on the headers of the network packets, destination addresses or the source network, data sequences corresponding to the known malware pattern, data sequences, or packet series known for a particular assault. They work with great efficiency in the identification of potential known incursions by maintaininglow failure rates. Unfortunately, a database of the system must be manually updated by the admin, and SIDS can identify only those intrusions that exist in the system's database, excluding fresh attack detection.  
Anomaly-based intrusion detection systems (AIDS), or behavioral detection systems, examine the usual behavior of networks by monitoring the network deeply to detect suspicious activity. To identify new forms of intrusions, AIDS can learn using anomaly detecting algorithms or train itself with reinforcement learning algorithms. Anomaly-based systems demonstrate a substantial difference in the identification of new threats compared to signature-based ones. In addition, it is difficult for the intruders to determine which intrusion actions would not be identified to adapt the configuration profile of each system [6].  
Recently, Machine Learning (ML) based AIDS enhancement (MLAIDS) algorithms have been developed [7]. These algorithms assess the network status via classification in normal or abnormal classes of the processed data. These algorithms train and test AIDS for assaults and accuracy to assess AIDS' capabilities with various datasets. However, the majority of these datasets are severely unbalanced. The majority (98%) of these datasets are considered to be normal, while the remainder (2%) are classified as attacks [8].  
A hybrid Intrusion Detection System (HIDS) can combine the benefits of both anomalies as well as signature systems and enhance the detection and erosion of known intrusion threats. Most recent hybrid IDSs are built on deep learning techniques and machines. Because of AIDS benefits in the zero-day assaults field, the newly proposed model also develops a deeply learned anomaly-based intrusion detection system.