## 4 Background
### Machine Learning
Cluster algorithms make predictions based on training data and create clusters based on similarity or unfamiliarity. There are several clustering algorithms such as K-means [41], DBSCAN clustering [42], affinity propagation [43], and mean shift [44]. Semi-supervised learning model or algorithm uses mixed classified and unclassified data for training [45], usually a small amount of classified data with a large amount of unclassified data. Semi-supervised learning is in between supervised and unsupervised learning. There are typically two activities in a semi-supervised learning algorithm: The general rule in a semi-supervised model is first tested with classified data, and the rule is then utilized to infer the unclassified data. At the moment, semi-supervised learning performance is still unstable and needs improvement [46; 47]. There are different semi-supervised learning algorithms, including self-training techniques [48], graph-based SSL [49], and low-density separation [50]. Reinforcement learning is a technique that allows a machine to interact with its surroundings. The machine can eventually learn from its experience by repeating the process thousands or millions of times. Reinforcement learning differs from supervised learning in that there is no need to introduce input/output pairs; hence, there is no need to explicitly correct sub-level actions. Instead, this technique focuses on finding a balance between exploring uncharted territory and exploiting existing knowledge. There are different types of Reinforcement learning algorithms, including Deep Deterministic Policy Gradient, Deep Q Network, and Asynchronous Advantage Actor-Critic Algorithm [51]. Deep learning is a subfield of machine learning that deals with algorithms inspired by the structure and function of the brain, called artificial neural networks. Recently, deep learning has proven itself in many applications including network security. Deep learning can extract elementary features from data without human intervention. Deep learning provided impressive results with high performance by automatically finding correlations in raw data. With the advent of deep learning-based models, the accuracy in detecting attacks has further improved [51]. Deep learning techniques can be divided into two major categories: discriminative learning and generative learning; discriminative learning technique is utilized to provide a discriminative function in supervised or classification applications. Discriminative deep architectures are typically designed to provide discriminative power for pattern classification by describing the posterior distributions of classes conditioned on visible data [29]. Discriminative architectures mainly include convolutional neural networks (CNN) [52], multi-layer perceptron (MLP) [53], and recurrent neural networks (RNN) [54], along with their variants. Generative learning technique is typically used to characterize the high-order correlation properties or features for pattern analysis or synthesis, as well as the joint statistical distributions of the visible data and their associated classes [29]. Commonly used deep neural network techniques for generative learning are Autoencoder (AE) [55], Deep Belief Network (DBN) [56], and Self-Organizing Map (SOM) [57].