## 2 Related Work  
Traditionally, the researchers study intrusion detection approaches from two major perspectives: anomaly detection and misuse detection. However, there is no significant difference between these two approaches. [PERSON] and [PERSON] [9] proposed a classification system to further divide these approaches into three subcategories, including computation dependent on approach, artificial intelligence, and biological concepts. However, such a classification makes it too hard to see the whole properties of detection approaches. Although there is a lack of more detailed views for detection approaches, [PERSON] et al. [10] proposed a classification system consisting of five sub-classes with an in-depth perspective on their characteristics: _statistics-based, pattern-based, rule-based, state-based, and heuristic-based_. These sub-classes belongs to intrusion detection based on machine learning methods. * The researchers who applied _statistic-based_ classification in IDSs include ANFIS-IDS ([PERSON] et al. [11]), distance-based ([PERSON] and [PERSON] [12]), Bayesian-based ([PERSON] and [PERSON] [9]), and game theory ([PERSON] et al. [13]). Nevertheless, these technique's characteristics are simple but less accuracy, self-study, and poor control. * _Pattern-based_ classification consists of pattern matching ([PERSON] el al. [14]), petrinet ([PERSON] el al. [15]), keystroke monitoring ([PERSON] and [PERSON] [16]), and file system checking ([PERSON] et al. [15]). However, these techniques are simple but less flexible, using user's typing pattern. * _Rule-based_ classification includes rule-based ([PERSON] et al. [17]), data mining ([PERSON] et al. [18]), model/profile-based ([PERSON] el al. [14]), and support vector machines (SVMs) ([PERSON] et al. [19]). However, these methods are not easily created and updated; automatically generated models. * _State-based_ classification includes state-transition analysis ([PERSON] and [PERSON], [12]), user intention identification ([PERSON] el al. [15]), Markov process model ([PERSON] et al. [13]), and protocol analysis ([PERSON] and [PERSON] [9]). However, the characteristics of these techniques are high-level task pattern, probabilistic, self-training, low false positive rate, and less effective. * _Heuristic-based_ classification includes neural networks ([PERSON] et al. [17]), fuzzy logic ([PERSON] et al. [11]), genetic algorithm ([PERSON] el al. [20]), immune system ([PERSON] el al. [15]), and swarm intelligence ([PERSON] and [PERSON] [21]). Self-learning, fault tolerant, configurable, scalable, flexible are characteristics of these techniques. Currently, deep learning has become more attractive and effective in IDS field. Generative learning and discriminative learning are two kinds of deep networks. First, generative learning in deep networks intends to capture high-order correlations between observed or visible data for pattern analysis or synthesis when no available information about target class labels. [PERSON] [22] proposed an approach to detect attacks on big data using a deep autoencoder. The experiment was conducted on the NSL-KDD dataset to test the method of applying bottleneck features in dimensionality reduction as part of intrusion detection. The obtained results were more accurate than PCA, factor analysis, and Kernel/PCA with 95.25% for train data and 95.06% for test data. However, the authors did not mention about accuracy every single attack type. Besides, [PERSON] et al. in [23] explored the use of a deep Boltzmann machine (DBM) in anomaly detection by training a network with real-world data traces from 24 h workstation traffic. This experiment tested the accuracy of DBM in classifying normal data and data infected by the bot. A second experiment trained DBM with KDD Cup'99 dataset and tested it against real-world data. The result obtained 84% accuracy on KDD Cup dataset. [PERSON] et al. [24] also exploited the deep belief network (DBN) capabilities to detect intrusion through a series of experiments.