## 6 Conclusions and Future Work  
In this paper, we propose a hybrid intrusion detection approach combining modified density peak clustering algorithm (MDPCA) and deep belief networks (DBNs). MDPCA is used to find similar features of complex and large-scale network data. According to the similarity of traffic features, large-scale network data are divided into several training subsets of different clustering centers. To a certain extent, MDPCA breaks the imbalance of multiclass records, reduces the complexity of training subsets, and makes the model achieve the best detection performance. DBN can automatically \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Method** & **Dataset** & **Accuracy(\%)** & **DR(\%)** & **FPR(\%)** \\ \hline SCDNN [30] & NSL-KDD (KDDTest+) & 72.64 & 57.48 & N/A \\ STL [53] & NSL-KDD (KDDTest+) & 74.38 & 62.99 ** & 7.21 ** \\ DNN [54] & NSL-KDD (KDDTest+) & 75.75 & N/A & N/A \\ Gaussian-Bernoulli RBM [38] & NSL-KDD (KDDTest+) & 73.23 & N/A & N/A \\ RNN-IDS [55] & NSL-KDD (KDDTest+) & 81.29 ** & N/A & N/A \\
**MDPCA-DBN** & NSL-KDD (KDDTest+) & **82.08 * & **70.51 * & **2.62 * \\ \hline SCDNN [30] & NSL-KDD (KDDTest-21) & 44.55 & 37.85 & N/A \\ STL [53] & NSL-KDD (KDDTest-21) & 57.34 & 52.73 ** & 15.06 ** \\ RNN-IDS [55] & NSL-KDD (KDDTest+) & 64.67 ** & N/A & N/A \\
**MDPCA-DBN** & NSL-KDD (KDDTest-21) & **66.18 * & **61.57 * & **13.06 * \\ \hline CASCADE-ANN [56] & UNSW-NB15 & 86.40 ** & 86.74 ** & 13.1 * \\ EM Clustering [27] & UNSW-NB15 & 78.47 & N/A & N/A \\ DT [27] & UNSW-NB15 & 85.56 & N/A & N/A \\
**MDPCA-DBN** & UNSW-NB15 & **90.21 * & **96.22 * & **17.15 ** \\ \hline \hline \end{tabular}
\end{table} 
Table 13: Comparison results based on NSL-KDD and UNSW-NB15 datasets (N/A means no available results, * Ranked first, ** Ranked second). extract high-level abstract features from each training subset without a lot of heuristic rules and manual experience, and reduce data dimensions to avoid the curse of dimensions. As a deep learning approach, DBNs integrate feature extraction and classification modules into a system that can automatically extract features and classify them. This is an effective way to improve the detection performance. The classification performance of MDPCA-DBN was evaluated on the NSL-KDD (KDDTest+), NSL-KDD (KDDTest-21), and UNSW-NB15 datasets and compared with six well-known classifiers. In addition, the classification performance of MDPCA-DBN was also compared with other state-of-the-art classifiers on theNSL-KDD (KDDTest+), NSL-KDD (KDDTest-21), and UNSW-NB15 datasets. The experimental results show that the classification accuracy, detection rate and false positive rate of MDPCA-DBN are better than those of traditional methods. Since fewer U2R and R2L attacks in the NSL-KDD dataset are recorded, and nearly half of the unknown attacks on the testing dataset never appear in the training dataset, it is difficult for all classifiers to detect U2R and R2L attacks. For future work, we plan to use the adversarial learning method to synthesize U2R and R2L attacks, thereby increasing training samples for U2R and R2L attacks. Through the adversarial learning method, similar unknown U2R and R2L attack records can be synthesized. As a result, the imbalance of five types of attack records is reduced and the detection accuracy of U2R and R2L attacks is improved. This can further improve the detection performance of the proposed model. Conceptualization, Y.Y. (Yanqing Yang), K.Z. and C.W. ; Methodology, Y.Y. (Yanqing Yang), K.Z., C.W., X.N. and Y.Y. (Yixian Yang); Software, Y.Y. (Yanqing Yang); Validation, Y.Y. (Yanqing Yang), K.Z. and C.W. ; Formal Analysis, X.N. and Y.Y. (Yixian Yang); Investigation, Y.Y. (Yanqing Yang) and K.Z. ; Writing--Original Draft Preparation, Y.Y. (Yanqing Yang); Writing--Review and Editing, Y.Y. (Yanqing Yang), K.Z. and X.N. ; Visualization, X.N. ; Supervision, K.Z. and C.W. ; and Project Administration, C.W.