## 2 Related Works  
Recent studies in the literature on intrusion detection system shows the improved performance of the machine learning models. The intrusion detection approach involves software and hardware for intrusion detection in a network [10]. An embedded system is deployed to implement security policies on a network level. According to the input data, an intrusion detection approach is categorized into network-based, host-based and hybrid systems. A classification-based intrusion detection model extracts features from the online data. Common approaches used for intrusion detection systems are supervised machine learning models, unsupervised machine learning models, and deep learning models. In unsupervised learning methods, a large volume of data is grouped in clusters automatically without having labels. However, few labeled data can help in improving the performance in cybersecurity or network security. High accuracy cannot be achieved in this way because of the different nature of unknown attacks. An unsupervised learning technique for intrusion detection has been designed to find clusters based on similarity [11]. Supervised learning models need labels for training and show good results. Traditional intrusion detection methods use machine learning and deep learning models. However, machine learning models did not predict different types of invasion attacks accurately because of the insufficient generalization ability of classifiers. The researchers improved the ability of machine learning models by combining them as a hybrid approach and improved the intrusion detection system. [PERSON] et al. [12] applied an ensemble of SVM along with particle swarm optimization (PSO), and k nearest neighbor (KNN). The combination of these techniques significantly improved the classification accuracy. However, the advantage of such a combination is also limited and cannot be maximized. [PERSON] [13] determined covering similarity on symbolic sequences and separate attacks from normal sequences of system calls. He analyzed three similarity measures for comparison and proved that covering similarity is an important measure of an anomaly in the host-based intrusion detection systems. High dimensional data in a growing number of intrusions and attacks is a big challenge in the intrusion detection system. In order to reduce time complexity and utilization of resources, an important feature of data needs to be analyzed to reduce dimensions. [PERSON] et al. [14] proposed SVM for anomaly identification and artificial neural network (ANN) at the second step for misuse detection. Similarly, the authors in [15] reduced data dimensions by applying the PCA-LDA ensemble technique. Deep learning models [16] and deep hierarchical models [17] have been proposed to learn non-linear relationships of data for malicious attack detection. ANN is applied on the KDD99 dataset for intrusion detection by reducing dimensions from correlation and information gain [18]. The model showed improved results in terms of accuracy. The authors proposed a real-time DDoS attack detection method by applying PCA and multivariate component analysis [19]. [PERSON] et al. [20] designed a sparse autoencoder for intrusion detection system on a reliable and updated network attacks dataset CICIDS2017. The authors proposed a deep learning model namely a memetic algorithm for abnormal traffic detection and tested it on two well-known datasets that are NSLKDD and KDD-CUP 99 [21]. Feature augmentation has been applied along with SVM to provide an effective intrusion detection framework and achieved robust results in terms of training speed and faulty alarm rate [22]. Multilevel intrusion detection has been applied by researchers for intrusion detection [23]. A novel neural network model has been proposed for intrusion detection to improve accuracy results [24]. The growing network connection and integration of terrestrial networks in satellite networks introduce additional risks and security challenges.