finish first section of related work, need to do features and types of intrusions