## 2 Related Work  
Some of the recent existing methodologies related to intrusion detection and response are reviewed below:  
Detection of intrusion in the network is a vast research area, and multiple works are based on this domain. Different authors establish different techniques and ways to address this problem. However, deep learning-based models are highly common as they are effective in classification and can yield better accuracy than any other techniques. Keeping this as motivation, [PERSON] et al. [24] introduced a deep learning-based hybrid model to deal with this problem. The method hybridized the classical autoencoder (CAE) with the deep neural network (DNN) model to perform intrusion detection. There were two phases: the first phase, feature engineering, was performed using the CAE model, and the second phase, classification, was carried out using DNN. The validations of a method were performed using the UNSW-NB15 dataset, and the outcomes proved that the method was effective in terms of different metrics. [PERSON] et al. [25] presented a classification framework to classify web attacks based on the attack features. An ensemble classification system was introduced to deal with the task. Initially, the filter and wrapper selection procedure was followed to discard irrelevant and redundant features. Then, the logic boost algorithm was utilized along with random forest (RF) as a weak classifier. Three datasets, improved KDD Cup 1999, NSL-KDD, and UNSW-NB15, were utilized to evaluate the framework, and the results proved the efficacy. Another method for malicious activity detection in the network was introduced by [PERSON] et al. [26], where the UNSW-NB15 dataset was considered for depth evaluations. The dataset was considered an offline dataset for developing an integrated classification model. Also, the method developed and generated a real-time dataset at NIT Patna CSE lab (RTNITP18) that was retained as a working example of the proposed method. The developed new dataset was utilized as a testing dataset, and the evaluations were carried out. Evaluating a model on both datasets proved that the method resulted in higher accuracy and a lower false alarm rate than other models. Also, the method acted as a dog watcher to identify several types of threats in the network. The distributed denial of service (DDoS) security threat presses information systems and computer networks. Moreover, it is highly challenging to detect this threat before any mitigation measures can be taken. Thus, [PERSON] et al. [27] presented a method to achieve full-scale success in detecting DDoS threats. A new integrated model was proposed to deal with the problem, where the model featured a Gaussian mixture model (GMM), bi-directional long short-term memory (Bi-LSTM), and incremental learning for attack detection. The GMM model was employed to capture the unknown traffic data, which was then labeled by the traffic engineers and provided to the model as training data. Two main datasets, CIC-IDS2017 and CIC-IDS2019, were utilized for evaluations, and the method provided promising detection results. Traditional machine learning-based algorithms cannot completely process massive high-dimensional data, and labeling has to be performed manually, which causes increased cost issues. To deal with the problem, [PERSON] et al. [28] introduced a framework for intrusion detection called a semi-supervised double deep Q-network (SSDDQN). The proposed framework was based on a deep reinforcement learning algorithm and initially utilized an autoencoder model to reconstruct the traffic features. Following that, a DNN model was utilized as the classifier, where the target network initially utilized a k-means clustering algorithm and then a DNN model for prediction. The experiments of a model were carried out using AWID and NSL-KDD datasets, and the results proved that the model was efficient and effective. [PERSON] and [PERSON] [29] suggested a deep SARSA-based reinforcement learning method for anomaly network IDSs.