## 2 Related Work  
[PERSON] et al. [2] used the KDD99 dataset and employed a convolutional neural network (CNN) technique to capture impactful features and propose a robust classification. CNN is a feed-forward multi-layered neural network consisting of multiple pooling and fully connected (dense) and convolution layers. Their CNN architecture for feature extraction has three hidden layers, each using a convolutional layer and a pooling layer, and used a softmax classifier. [PERSON] et al. [7] employed three models of Long Short-Term Memory (LSTM), which is a recursive neural network (RNN) that remembers some context and forgets the \begin{table}
\begin{tabular}{c c} \hline \hline
**Attack Category** & **Sub-Attack Types** \\ \hline Probe & Portsweep, IPsweep, Nmap, Satan \\ \hline DoS & Neptune, Smurf, Pod, Teardrop, Land \\ \hline U2R & BuferOverflow, LoadModule, Perl, Rootkit \\ \hline R2L & GuessPassword, FtpWrite, Imap, Phf, Multihop, Warezmaster, Warezclient \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Attack categories and types in the KDD99 dataset [8]. \begin{table}
\begin{tabular}{c c} \hline \hline
**Attack Category** & **Sub-Attack Types** \\ \hline Brute-force & Brute-force-Web, Brute-force XSS, FTP Brute-force, SSH Brute-force \\ \hline Botnet & Zeus, Ares \\ \hline DoS & DoS-Hulk, DoS-SlowfriTTPTest, DoS-Slowloris, DoS-GoldenEye \\ \hline DDoS & DDoS-HOIC, DDoS-LOIC-UDP, DDoS-LOIC-HTTP \\ \hline Web attacks & SQL Injection, Command Injection, Unrestricted File Upload \\ \hline Heartbleed & Heartleech \\ \hline Infiltration \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Attack categories and types in the CSE-CIC-IDS2018 dataset [11]. rest. The main applications of LSTM are grammar learning, speech recognition, time-series prediction, and sentiment analysis. They used LSTM-PCA (Principal Component Analysis), and LSTM-MI (Mutual Information) to reduce the dimension, feature selection, and attack detection. They used the KDD99 dataset, and considered multi-class and binary classification problems. Their results show that LSTM-PCA outperforms CNN [2], LSTM-RNN, and pruning VELM [12]. The phases include data preprocessing, multi-class classifications, PCA, and score calculation for MI to achieve the statistical dependencies between two variables. [PERSON] and [PERSON] [3] used the NSL-KDD dataset for their experiments and incorporated K-Means clustering to improve the K-Nearest Neighborhood (KNN) classifiers. They used five clusters equal to the number of attack types and applied KNN to capture the distance of each data to cluster centers based on Euclidean distance. In their approach, they consider both the nearest and the farthest distance (KFN) to form a distance-based IDS. Their framework with K-Means, KNN, and KFN successfully reduced the false alarm and increased the accuracy. [PERSON] et al. [4] proposed a trust-based intrusion detection and classification system (TIDCS) and an accelerated version of that using NSL-KDD and UNSW datasets. They assumed the trustworthiness reduction in each network node after each attack detection when the node is involved. As a result, a dynamic system cleaning is conducted. The results indicated the ability of both systems to reduce the false alarm rate and improve accuracy. [PERSON] et al. [6] proposed a framework that performs feature selection and grouping by employing the Random Forest technique to build a training set and uses an autoencoder for prediction. Autoencoders are deep neural structures that map the input to the same size of output via encoder and decoder sections, and are used for dimension reduction. Their feature grouping phase includes grouping the features according to their similarity based on the Affinity Propagation clustering algorithm. The anomaly detection phase includes several autoencoders equal to the number of feature subsets. Root-Mean-Squared Error (RMSE) is used to distinguish the normal traffic from the abnormal ones. They used CSE-CIC-IDS 2018 in their experiments and showed that their work is more efficient than [13].