Indonesi
an
Journa
l
of El
ect
ri
cal Engineer
ing
an
d
Comp
ut
er
Scie
nce
Vo
l.
23
,
No.
1
,
Ju
ly
2021
, p
p.
558
~
565
IS
S
N: 25
02
-
4752, DO
I: 10
.11
591/ijeecs
.v
23
.i
1
.
pp
558
-
565
558
Journ
al h
om
e
page
:
http:
//
ij
eecs.i
aesc
or
e.c
om
An
ens
em
ble fea
ture sel
ection
ap
proach u
sing hyb
rid ke
rnel
based
S
VM fo
r
network
intrusio
n detecti
on syst
em
Ga
d
dam V
en
u G
opal
1
, Gat
ram
R
ama
M
ohan
B
ab
u
2
1
Y.S.
Rajasekha
r
Redd
y
Univ
ersi
t
y
Coll
ege of En
gine
er
ing
&
T
echnolog
y
,
Ach
ar
ya
Naga
rjuna Uni
ver
sit
y
,
Naga
r
ju
na
Naga
r, Guntur
,
I
ndia
2
Depa
rtment of I
nform
at
ion
T
ec
h
nolog
y
,
RVR
& J
C
Coll
eg
e
of
E
ngine
er
ing, Cho
wdava
ram,
Gunt
ur
,
Indi
a
Art
ic
le
In
f
o
ABSTR
A
CT
Art
ic
le
hist
or
y:
Re
cei
ved
J
ul
1
8,
2020
Re
vised A
pr 29
, 2
021
Accepte
d
Ma
y
4
, 2
021
Feat
ure
se
le
c
ti
o
n
is
a
proc
ess
of
ide
nti
f
y
i
ng
re
levant
fe
at
ure
sub
set
tha
t
leads
to
the
m
ac
hine
l
ea
rning
al
gor
it
h
m
in
a
wel
l
-
def
i
ned
m
anne
r.
In
t
his
pape
r
,
a
novel
ense
m
ble
fea
tur
e
sele
c
ti
on
appr
oac
h
tha
t
c
om
prises
of
rel
ie
f
at
tri
bu
t
e
eva
lu
at
ion
and
h
y
brid
ker
n
el
-
base
d
support
vec
tor
m
ac
hin
e
(HK
-
S
VM
)
appr
oac
h
is
pro
posed
as
a
fea
t
ure
sele
c
ti
on
m
et
hod
for
net
wo
rk
int
rusion
det
e
ct
ion
s
y
stem
(NID
S).
A
Hy
b
rid
appr
oa
ch
a
lo
ng
with
the
comb
ina
ti
on
of
gaussian
and
p
ol
y
nom
ial
m
et
h
ods
is
used
as
a
ker
n
el
for
su
pport
ve
ct
or
m
ac
hin
e
(SV
M).
The
ke
y
issue
i
s
to
sel
ec
t
a
fe
ature
subs
et
that
yie
lds
good
ac
cur
acy
a
t
a
m
ini
m
al
compu
ta
ti
on
al
cost
.
T
he
proposed
appr
oac
h
is
implemente
d
an
d
compare
d
wit
h
c
la
ss
ic
a
l
SV
M
and
sim
ple
ker
nel.
K
y
o
to
2006+,
a
b
enc
h
m
ark
int
rusion
det
e
ct
ion
d
atase
t,
is
used
for
e
xper
imental
eva
lu
at
ion
and
t
hen
observa
ti
ons
are dra
wn
.
Ke
yw
or
d
s
:
Feat
ur
e
selec
ti
on
Hybr
i
d ker
nel
In
tr
us
i
on d
et
ec
ti
on
syst
em
Kyoto 2
006+
Suppor
t
v
ect
or
m
achine
This
is an
open
acc
ess arti
cl
e
un
der
the
CC
B
Y
-
SA
l
ic
ense
.
Corres
pond
in
g
Aut
h
or
:
Gaddam
V
en
u Gopal
Dr
.
Y.S.
Raja
s
ekh
a
r
Re
dd
y
U
niv
e
rsity
Colle
ge of
Enginee
r
ing
& Tec
hnol
og
y
Ach
a
rya
Nag
a
r
j
una
U
niv
e
rsity
Nag
a
r
j
una
Na
ga
r,
G
un
t
ur
,
In
di
a
Em
a
il
: ven
ugopal
.g
a
ddam
@g
m
ai
l.co
m
1.
INTROD
U
CTION
Now
-
a
-
days
,
ne
twork
i
ntr
us
io
n
detect
ion
s
ys
tem
play
s
an
im
po
rtant
r
ole
.
Ow
i
ng
to
t
he
r
apid
gro
wt
h
in
the
us
e
of
w
eb
us
a
ge
a
nd
ot
her
net
wor
k
s
erv
ic
es,
t
hese
netw
ork
ser
vic
es
are
pro
ne
to
vu
l
ner
a
ble
an
d
nee
d
to
be
pro
vid
e
d
with
m
or
e
se
cur
it
y.
N
et
w
ork
intr
us
i
on
det
ect
ion
syst
em
(NIDS)
is
one
of
the
s
olu
ti
ons
that
identifie
s
an
d
pr
e
ven
ts
the
intruder
f
rom
pen
et
rati
ng
into
the
network
a
nd
fro
m
do
in
g
a
ny
m
al
ic
iou
s
act
ivit
ie
s.
Fo
r
t
he
la
st
few
deca
des,
m
os
t
of
the
re
sea
rch
e
rs
are
wor
king
in
the
fie
ld
of
NIDS
a
nd
pro
posin
g
and
im
ple
m
enting
t
heir
wor
k
on
dif
fer
e
n
t
be
nch
m
ark
datas
et
s
avail
able.
As
the
se
datas
et
s
are
ve
ry
big
in
siz
e
and
pro
vid
e
d
it
h
div
e
rsified
high
dim
ension
al
it
y,
m
os
t
of
t
he
aut
hors
hav
e
pro
pose
d
m
achine
le
arn
i
ng
te
chn
iq
ues
no
t
on
ly
f
or
at
ta
ck
detect
io
n
bu
t
al
so
qu
ic
k
de
te
ct
ion
of
intr
ud
e
r.
Feat
ur
e
sel
ect
ion
an
d
f
eat
ure
reducti
on
ar
e
s
om
e
of
the
m
e
thods
t
o
c
hoose
subset
sel
ect
ion
of
dim
ension
s.
Dim
ensional
it
y
red
uctio
n
help
s
the NID
S in
in
creasin
g
the
d
e
te
ct
ion
r
at
es
by
elim
inati
ng
th
os
e ir
releva
nt
f
eat
ur
es
a
nd als
o
m
ini
m
iz
es the co
st
of the
detect
io
n
syst
em
.
Seve
ral
m
achine
le
ar
ning
te
chn
i
qu
e
s
li
ke
decisi
on
trees
,
ada
bo
os
ti
ng,
ra
ndom
f
ores
t,
arti
fici
al
neural
net
wor
ks
,
a
nd
S
VM
,
are
us
e
d
as
cl
assifi
ers
f
or
pr
e
dicti
ng
w
he
ther
the
re
quest
is
an
at
ta
ck
or
a
le
gitim
at
e
on
e.
Am
on
g
t
hese
cl
assifi
ers,
S
V
M
is
on
e
of
t
he
prom
inent
m
achine
le
ar
ning
te
ch
nique
s
t
hat
is
us
e
d
especial
ly
,
if
the
pr
ob
lem
do
m
ai
n
i
s
a
bin
ary
cl
assifi
er.
S
uppor
t
vector
m
achine
(S
VM
)
[
1
]
is
a
Evaluation Warning : The document was created with Spire.PDF for Python.
Ind
on
esi
a
n
J
E
le
c Eng &
Co
m
p
Sci
IS
S
N:
25
02
-
4752
An
e
ns
e
mb
le
fe
atu
re
selec
ti
on app
r
oac
h usin
g hybri
d
ker
nel
base
d SVM f
or…
(
Gadda
m Ve
nu
Gop
al
)
559
sta
ti
sti
cal
le
arn
in
g
base
d
li
ne
ar
cl
assifi
er
intr
oduce
d
by
Vapnik
a
nd
te
a
m
in
19
90s.
In
order
to
s
ol
ve
the
qu
a
drat
ic
opti
m
iz
at
ion
pro
ble
m
,
SV
M
al
gorithm
m
axi
m
iz
es
the
m
arg
in
am
on
g
the
t
rainin
g
data
t
hro
ugh
li
near
ly
sep
a
ra
ble h
y
perplane
.
A
hy
perplane
i
n
a
hi
gh
dim
ension
al
s
pace
ha
s
the
la
rg
est
distance
to
the
ne
arest
tr
ai
ning
data
points
of
any
cl
ass
w
hich
is
kn
own
as
the
optim
um
separ
at
ion
hy
perplane.
S
V
M
al
gorithm
,
al
ong
w
it
h
non
-
li
near
char
act
e
risti
cs
i
m
pr
ove
s
the
abili
ty
of
gen
er
al
iz
at
ion
,
so
lv
e
s
the
hig
h
-
dim
ension
al
p
roblem
s,
detect
i
on
ra
t
e
and
al
so
pro
vid
es
a
bette
r
s
ol
ution
for
fau
lt
detect
ion
an
d
pr
e
dicti
on
[
2]
.
A
ke
r
nel
f
un
ct
ion
is
us
e
d
in
l
inear
cl
assifi
ers
to
s
olv
e
non
-
li
nea
r
problem
s.
In
S
VM
cl
assifi
cat
ion
al
gorithm
,
ker
nel
play
s
an
i
m
po
rtant
ro
le
that
can
be
ap
plied
in
SV
M
t
o
conve
rt
or
i
gin
a
l
inp
ut
sp
ace
i.
e.,
a
high
dim
e
ns
io
n
sp
ace
i
nto
a
nonlinea
r
m
app
in
g.
T
he
pr
im
ary
go
al
of
any
intru
si
on
detec
ti
on
syst
em
is
t
o
ide
ntify
at
ta
cks
with
highe
st
detect
ion
rat
es.
A
pa
rt
f
ro
m
the
detect
ion
rate,
ano
t
her
re
quire
m
ent
is
quic
k
detect
ion
i.e.,
m
ini
m
iz
at
ion
of
the
com
pu
ta
ti
on
al
ti
m
e
is
al
so
im
po
rtant
in
NIDS
[3]
,
[4
]
.
I
n
the
netw
ork
e
nvir
on
m
ent,
ser
ve
r
s
nee
d
to
pr
ovide
ser
v
ic
es
wi
th
quic
k
res
po
ns
e
to
it
s
cl
ie
nt
s.
I
n
this vie
w,
NID
S h
a
ving
high
com
pu
ta
ti
on
al
tim
e, can
not
be
adop
te
d
as
a
detect
ion sy
ste
m
f
or
the
ser
ve
rs.
To
fu
l
fil
these
go
al
s
a
feat
ur
e
sel
ect
ion
m
eth
od
nam
el
y,
reli
ef
featu
re
sel
ect
ion
m
od
el
i
s
us
e
d
a
nd
a
hybr
ie
d
kernel
base
d
S
VM
cl
a
ssifie
r
(HKS
V
M)
is
a
dopted
as
a
cl
assifi
er
. Th
e obj
ect
ive
o
f
the prop
os
e
d
wor
k
is
to
dev
el
op
an
intr
us
io
n
de
te
ct
ion
syst
em
[5]
,
[6
]
us
i
ng
a
n
ensem
ble
appro
ac
h
al
ong
with
reli
ef
featur
e
est
i
m
at
or
and
HK
-
S
VM to
gai
n
hi
gh acc
ur
a
cy
an
d
go
od com
pu
ta
ti
on
al
ti
m
es.
The
rem
ai
nin
g
pap
e
r
is
orga
nized
as
sta
te
d.
Sect
io
n
2
give
s
a
bri
ef
re
vi
ew
of
r
el
at
ed
work
in
the
fiel
d
of
N
IDS
and
S
VM.
Ba
s
ic
s
an
d
dataset
descr
i
ption
is
pr
ese
nted
in
S
ect
ion
3
.
Th
e
p
rop
os
ed
m
et
ho
do
l
og
y
is el
aboratel
y
di
scusse
d
i
n
Sec
ti
on
4
a
nd in
S
ect
ion
5
resu
lt
s
. F
inall
y
,
in
Se
ct
ion
6
,
c
oncl
usi
on
s
are
d
e
riv
ed
.
2.
RELATE
D
W
ORK
Fo
r
t
he
pa
st
fe
w
deca
des,
se
ver
al
re
searc
he
rs
are
wor
king
in
the
fiel
d
of
NIDS
a
nd
al
s
o
in
S
VM.
Ther
e
a
re
de
ve
lop
m
ents
in
SV
M
as
well
as
NI
DS
.
T
his
se
ct
ion
disc
us
ses
the
relat
ed
res
earch
wor
k
do
ne
by
var
i
ou
s
a
uthor
s
in
the
area
of
NIDS
usi
ng
SV
M
[
7
]
-
[
9
]
.
Table
1
pre
sents
a
br
ie
f
de
scriptio
n
of
var
i
ou
s
researc
hers al
ong wit
h t
he dat
aset
s
are
c
onsidere
d,
an
d
m
eth
od
ologies
are
adopted/
pro
posed.
Table
1.
Rel
at
e
d work
Ref
.
No
.
Descripti
o
n
[
7
]
The
au
th
o
rs
o
f
t
h
is
p
ap
er
p
rop
o
sed
a
m
eth
o
d
o
lo
g
y
to
i
m
p
rov
e
th
e
p
erfo
r
m
an
ce
o
f
th
e
SVM
u
sin
g
f
u
si
o
n
o
f
t
h
e
g
en
etic
alg
o
rith
m
f
o
r
th
e S
VM.
KDD
19
9
9
d
ataset th
at
is u
sed
t
o
test their ac
cu
rac
y
.
[
1
0
]
The
au
th
o
rs of
this
pap
er
su
g
g
ested
a
h
y
b
rid g
en
etic alg
o
rith
m
f
o
r
SVR
as
its k
ernel f
u
n
ctio
n
.
The
m
o
d
el w
as tes
ted
on
te
m
p
eratur
e
and
load
datas
ets an
d
co
m
p
a
red with
dif
f
erent kern
el
m
eth
o
d
s.
[
1
1
]
The
au
th
o
rs
o
f
t
h
is
p
ap
er
p
resents
a
m
u
tu
al
in
f
o
r
m
ati
o
n
g
ain
b
ased
f
eat
u
re
selectio
n
m
eth
o
d
f
o
r
selectin
g
f
e
atu
re
su
b
set
an
d
tested
us
in
g
L
S
-
S
VM
cl
ass
if
er
o
n
the KDD19
9
9
datas
et.
Accur
acy, FP
r
at
e and
oth
er
m
e
asu
r
es wer
e
con
sid
ered.
[
1
2
]
The
au
th
o
rs
o
f
th
i
s
p
ap
er
p
resents
a
d
etailed
stu
d
y
wh
ich
is
p
rov
id
ed
o
n
v
ariou
s
f
eatu
re
selectio
n
alg
o
rith
m
s
in
th
e
f
ield
o
f
in
trus
io
n
d
etectin
syste
m
.
PCA,
Co
r
relation
co
ef
f
icien
t
,
an
d
Fu
sion
o
f
Gen
etic
Alg
o
rith
m
,
were
p
resented
an
d
tested
o
n
KDD
1
9
9
9
datas
et.
Dete
ctio
n
r
ate and
co
m
p
u
tatio
n
al ti
m
e
we
re
co
n
sid
ered to co
m
p
are
t
h
e
m
o
d
els.
[
1
3
]
The
au
th
o
rs
in
v
estig
ated
th
e
p
erfo
r
m
an
ce
o
f
two
class
if
icatio
n
alg
o
rith
m
s
n
a
m
ely
SV
M
an
d
Artif
icial
N
eu
ral
N
etwo
rks
(A
NN)
.
Three
p
ara
m
ete
rs
SVMs
tra
in
,
an
d
run
,
an
o
rder
o
f
m
ag
n
itu
d
e
f
aster
we
re
co
n
sid
ered
an
d
co
n
clu
d
ed
th
at
SV
M
is
b
etter
th
an
ANN fo
r
N
IDS.
[
1
4
]
The
au
th
o
rs
o
f
th
is
p
ap
er
stu
d
ied
NIDS
d
atasets
KYO
TO
2
0
0
6
+.
A
Deci
sio
n
Tr
ee
alg
o
rithm
(J4
8
)
was
ap
p
li
ed
o
n
th
is
d
atasets
an
d
gain
ed
abo
u
t 9
7
% o
f
acc
u
racy
Most
of
the
w
orks
done
by
the
re
searc
her
s
con
ce
ntrate
d
on
a
sin
gle
kern
e
l
based
SV
M
and
featu
re
sel
ect
ion
al
gor
it
h
m
s
wh
ic
h
are
al
so
co
nc
entrati
ng
only
on
the
detec
ti
on
rates.
Ve
ry
few
aut
hor
s
hav
e
con
ce
ntrate
d
on
the
com
pu
ta
ti
on
al
tim
e
whic
h
is
ver
y
i
m
portant
f
or
ti
m
e
crit
ic
al
pr
ob
l
e
m
s
li
ke
NI
D
S.
The
m
ot
ivati
on
of t
he
pa
pe
r
is
to develo
p
an
e
ns
e
m
ble c
la
ssifie
r
us
in
g
Re
li
ef f
e
at
ur
e esti
m
at
or
an
d
a
hybri
d k
ern
el
base
d
S
VM fo
r
f
eat
ure sel
ect
ion p
r
ocess
t
hat g
ive
s a
good a
ccur
acy
with
t
he
best c
om
pu
ta
ti
on
al
ti
m
e as
well
.
3.
RESEA
R
CH MET
HO
D
This
sect
ion
pr
esents
the
pro
pose
d
m
et
ho
dol
og
y
by
pro
vid
i
ng
the
detai
le
d
descr
ipti
on
of
the
dataset
,
basic
no
ta
ti
ons
and c
on
ce
pts
us
e
d,
reli
ef alg
or
it
hm
and fi
na
ll
y
,
var
io
us
pe
rfor
m
ance m
etr
ic
s.
3.1.
Pr
opose
d
met
hodol
ogy
The
propose
d
m
et
ho
dolo
gy
c
on
sist
s
of
t
hr
e
e
ph
a
ses.
T
he
y
are
data
pr
e
processi
ng
pha
se,
Feat
ure
Sele
ct
ion
,
Eva
luati
on
phase
and
res
ult
a
naly
sis
ph
a
se.
Figure
1
present
s
the
pro
posed
m
et
ho
do
l
og
y.
I
n
t
he
Evaluation Warning : The document was created with Spire.PDF for Python.
IS
S
N
:
2502
-
4752
Ind
on
esi
a
n
J
E
le
c Eng &
Co
m
p
Sci,
Vo
l.
23
, N
o.
1
,
Ju
ly
2021
:
558
-
565
560
data
prep
r
oces
sing
phase,
K
YO
T
O
2006+
dataset
is
prep
ro
ces
sed
.
T
he
pr
e
p
r
ocessi
ng
consi
sts
of
tw
o
par
ts
nam
ely,
i
)
data
tran
s
f
or
m
at
ion
and ii)
norm
alizat
ion
.
Since
S
VM
is
a
distance
ba
se
d
cl
assifi
e
r,
it
works
on
num
eric
data
w
herea
s
KYOT
O
2006+
dataset
c
onsist
s
of
non
-
num
eric
featur
es.
The
se
featur
e
val
ues
are
trans
form
ed
into
nu
m
eric
values.
T
o
av
oid
f
eat
ur
e
range
i
nfl
ue
nc
e
on
distanc
e
m
easur
e
a
nd
ot
her
cl
ass
ific
at
ion
pr
oc
ess,
each
fea
tur
e
has
un
de
rgo
ne
norm
al
iz
a
ti
on
.
The
no
rm
alization
te
ch
nique
t
hat
is
app
li
ed
i
n
this
ex
pe
rim
ent
is
m
in
-
m
ax
norm
al
iz
a
ti
on
.
The
form
ula is g
ive
n
(1),
′
=
(
−
−
×
(
_
−
_
)
+
_
)
(1
)
Wh
e
re
x
a
nd
′
are
act
ual
a
nd
tra
ns
f
or
m
ed
values
of
feat
ur
e
vecto
r
res
pecti
vely
.
,
a
nd
a
re
m
ini
m
u
m
and
m
axi
m
u
m
valu
es
of
feat
ur
e
x
and
_
an
d
_
are
ne
w
m
ini
m
u
m
and
new
m
axi
m
um
values
of
the
range
f
or
w
hi
ch
th
e
featu
re
is
to
be
norm
al
iz
ed.
A
fter
t
he
com
pleti
on
of
t
he
pr
e
pro
cessi
ng
ph
a
se,
the
r
es
ultant
data
is
store
d
as
K
Y
OTO
-
Norm
th
at
is
su
pp
li
e
d
as
an
in
pu
t
f
or
the
Feat
ure
s
el
ect
ion
ph
a
se.
In
fe
at
ure
sel
e
ct
ion
ph
ase
,
a
novel
e
ns
em
bl
e
featu
re
el
i
m
i
nation
m
et
ho
d
is
propose
d
on
Kyoto
-
norm
dataset
.
T
he fe
at
ur
e sele
ct
io
n appr
oach is gi
ve
n
as
foll
ows:
Algorithm 2: Feature Selection Approach
Input : KYOTO
-
Norm, normalized dataset
Output : Feature Ranking vector,
List of feature Subset
Step 1: Fe
atures are assigned rank based on th
eir relevance using Relief Attribute
Estimation algorithm.
St
ep
2:
T
he
KY
OT
O
-
No
rm
th
en
re
ar
r
an
ge
d
in
to
K
YO
TO
-
Ra
nk
da
ta
s
et
by
ar
r
an
gi
ng
al
l
th
e
fe
at
ur
es
ba
se
d
on
th
e
Re
li
ef
At
t
ri
bu
te
Es
ti
ma
ti
on
Ra
nk
in
g
as
sp
ec
if
i
ed
in
Algorithm 1.
St
ep
3:
A
H
K
-
SV
M
cl
as
si
fi
er
is
ap
pl
ie
d
on
th
e
K
yo
to
-
Ra
nk
da
ta
se
t
re
pe
at
ed
ly
af
te
r
eliminating the least relevance feature at a time.
St
ep
4:
F
or
ea
ch
it
er
at
io
n
in
st
e
p
3,
cl
as
si
f
ic
at
io
n
ac
cu
ra
cy
an
d
co
m
pu
ta
ti
on
al
time are measured.
St
ep
5:
A
fe
at
ur
e
su
bs
et
is
se
le
ct
ed
fr
om
th
e
ob
se
rv
at
io
n
th
at
yi
el
ds
th
e
hi
gh
es
t
accuracy with less computational time.
Finall
y, the
res
ults will
b
e
com
par
ed
with
th
e traditi
onal
S
VM m
et
ho
d.
Figure
1.
Pro
pose
d
m
et
ho
dolog
y
FS
HK
-
S
V
M
Evaluation Warning : The document was created with Spire.PDF for Python.
Ind
on
esi
a
n
J
E
le
c Eng &
Co
m
p
Sci
IS
S
N:
25
02
-
4752
An
e
ns
e
mb
le
fe
atu
re
selec
ti
on app
r
oac
h usin
g hybri
d
ker
nel
base
d SVM f
or…
(
Gadda
m Ve
nu
Gop
al
)
561
3.2.
Dataset
descri
pt
io
n
Kyoto
2006+,
a
ben
c
hm
ark
da
ta
set
is
us
ed
i
n
this
process.
The
dataset
use
d
in
the
pro
po
sed
w
ork
i
s
a
real
netw
ork
traf
fic
dataset
that
is
known
as
Kyoto
20
06+.
It
is
help
f
ul
to
im
ple
m
e
n
t
intr
us
i
on
de
te
ct
ion
m
et
ho
ds.
This
dataset
is
colle
ct
ed
from
ho
ney
po
ts
.
The
dataset
was
captu
red
from
Novem
ber
,
2006
t
o
Aug
us
t
,
2009.
O
ne
of
t
he
a
dv
a
ntage
s
of
Kyoto
20
06
+
dataset
co
ns
ist
s
of
rece
nt
tre
nd
s
of
at
ta
ck
s
that
ar
e
gen
e
rated
with
the
hel
p
of
honeyp
ots.
Kyot
o
dataset
is
a
va
il
able
with
24
featu
res,
ou
t
of
them
14
are
d
eri
ved
from
KD
DC
U
P’
99
dataset
[
15
]
-
[
17
]
,
a
nd
10
m
or
e
featu
r
es
are
a
dded
that
m
ay
be
he
lpf
ul
in
detect
ing
the
kind
of att
acks
ver
y
e
ff
ect
ivel
y i
n
the
ne
tw
or
k.
In
the
pro
pose
d
m
et
ho
dolo
gy
,
im
ple
m
entati
on
ta
kes
place
on
ly
on
e
day
da
ta
set
i.e.,
on
5
th
A
ugust
,
2009
co
ns
ist
in
g
of
1,28,34
7
sam
ples
and
24
featu
res
out
of
w
hich
,
18
input
featu
res
are
sel
ect
ed
be
cause
three
featu
res
nam
el
y
,
ID
S
_d
et
ect
io
n,
M
al
awa
re
_d
et
ect
ion
a
nd
A
shu
la
_d
et
ect
io
n
a
re
al
l
co
ns
ide
red
a
s
pr
e
dicti
on
feat
ur
es
i
n
s
uppor
t
of
cl
ass
la
bel
[18]
.
T
wo
m
or
e
featu
r
es
ar
e
IP
a
ddresses
for
bo
t
h
sou
r
ce
an
d
destinat
io
n
that
h
a
ve
ext
rem
ely large
r
an
ge o
f
val
ues.
O
wing to
t
he
a
bove
reasons
,
these
f
eat
ur
es a
re
rem
ov
e
d
for
the
expe
rim
ent. Th
e
r
es
ul
ta
nt 1
8 i
np
ut fea
tures
t
hat are
u
se
d
i
n
this a
ppr
oac
h
are
li
ste
d
in
Ta
ble 2
.
The
cl
ass
la
bel
of
this
dataset
is
a
t
hree value
d
featu
re
that d
efines
w
hethe
r
the
sam
ple
is
an
at
ta
ck
or
a
norm
al
req
ue
st.
Th
os
e
th
re
e
values
a
re
{
-
2,
-
1,
1}
t
o
re
pr
ese
nt
w
hethe
r
the
re
quest
is
an
un
known
a
tt
ack
,
known
at
ta
ck
or
a
no
rm
al
resp
ect
ively
.
T
he
per
ce
ntage
of
unknow
n
at
ta
ck
sam
ples
is
le
ss
i.e.,
ab
out
0.7%,
a
s
it
is
dif
ficult
t
o
pr
e
dict
unkn
own
at
ta
c
ks
.
I
n
orde
r
to
m
ake
it
sim
plifie
d,
bi
nar
y
cl
assifi
cat
ion
is
f
ollo
wed
as
known
a
nd
unknown
sam
ples
[19]
,
[20]
.
T
he
data
set
sel
ect
ed
for
this
stud
y
is
from
th
e
day
5
th
of
the
Augu
st
2009, Ky
ot
o 2
006+ dat
aset
.
Table
2.
Sele
vt
ed
f
eat
ur
e
s fr
om
k
yoto 2006
+
d
at
aset
Featu
re
#
Featu
re
N
a
m
e
Featu
re1
Du
ration
Featu
re2
Service
Featu
re3
so
u
rce_b
y
tes
Featu
re4
d
estin
atio
n
_
b
y
tes
Featu
re5
Co
u
n
t
Featu
re6
sa
m
e_
srv
_
rate
Featu
re7
serror_rate
Featu
re8
srv
_
serror_rate
Featu
re9
d
st_
h
o
st_
co
u
n
t
Featu
re10
d
st_
h
o
st_
srv
_
co
u
n
t
Featu
re11
d
st_
h
o
st_
sa
m
e_
src
_
p
o
rt_rate
Featu
re12
d
st_
h
o
st_
serror_rate
Featu
re13
d
st_
h
o
st_
srv
_
serro
r_rate
Featu
re14
Flag
Featu
re15
Label
Featu
re16
so
u
rce_p
o
rt_nu
m
b
er
Featu
re17
d
estin
atio
n
_
p
o
rt_nu
m
b
e
r
Featu
re18
Du
ration
1
3.3.
Reli
ef
alg
ori
th
m
RELIEF
is
a
n
eff
ic
ie
nt
feat
ure
rankin
g
m
odel
evaluated
ba
sed
on
the
c
on
te
xtu
al
inf
or
m
at
ion
.
Re
li
ef
al
gorithm
esti
m
at
es
featur
e
qu
al
it
y
for
a
s
pecific
ta
sk
by
com
pu
ti
ng
de
pende
ncies
am
ong
feat
ur
e
s.
T
he
basic
idea
of
REL
IE
F
ap
proac
h
is
t
o
est
im
at
e
the
qu
al
it
y
of
feat
ur
es
acco
rd
i
ng
to
ho
w
well
th
ei
r
value
s
disti
nguis
h
betwee
n
in
sta
nc
es
that ar
e
nea
r
to
each
o
t
her
[21
]
,
[22]
.
Algorithm 1: Relief Feature Estimator
Input : D, the input dataset
d(A,R,H/M) is the difference formula
Output: F, Feature subset vec
tor,
W, weights/Quality of the features
Step 1: Initiate weights vector W to 0 for an attribute A in F
Step 2: for each instance of D do
Step 2.1: Select R, a random instance of D
Step 2.2: find H, a nearest Hit and
M a
nearest Miss for R
Step 2.3: for A = 1 to # attributes in D do
Step
2.3.1: W[A]:=W[A]
-
d( A,R,H)/m
+d(A,R,M)/m
End for
End for
end
Evaluation Warning : The document was created with Spire.PDF for Python.
IS
S
N
:
2502
-
4752
Ind
on
esi
a
n
J
E
le
c Eng &
Co
m
p
Sci,
Vo
l.
23
, N
o.
1
,
Ju
ly
2021
:
558
-
565
562
The
al
gorithm
works
li
ke
t
his,
le
t
a
trai
ning
dataset
be
D
a
nd
F
is
t
he
feat
ur
e
sp
ace
of
D
.
A
ra
ndom
instance
R
fro
m
D
is
sel
ec
ted
,
the
n
it
picks
up
tw
o
nea
r
est
neighb
or
s
H
nea
rest
Hit
and
M
nea
rest
Mi
ss,
wh
e
re
H
is
f
r
om
the
sa
m
e
cl
ass
as
R
an
d
M
is
from
oth
er
cl
ass
.
Now,
t
he
di
ff
e
re
nce
betwee
n
t
hese
tw
o
cl
asses
a
re
c
om
pu
te
d
an
d
a
dd
e
d
to
the
W
ei
gh
t
Ve
ct
or
f
or
eac
h
at
trib
ut
e
of
A.
T
he
diff
e
re
nce
f
orm
ula
i
s
com
pu
te
d
as
fo
ll
ow
s:
d(A,
I
1
, I
2
)
=
V
(
A
,
1
)
–
V
(
A
,
2
)
max
(
)
−
min
(
)
(2
)
wh
e
re
I
1
,
I
2
a
r
e
two
instance
s,
and
V
is
the
value
of
a
n
instance
at
at
t
rib
ute
A,
m
ax
(A),
m
in(A
)
are
the
m
axi
m
u
m
an
d m
ini
m
u
m
v
al
ues
of the
att
rib
ute A.
3.4.
Ker
nel
appro
ache
s
:
The
acc
ur
acy
of
a
ny
S
VM
de
pends
on
the
sel
ect
ed
ke
rn
el
an
d
pa
ram
et
ers
pro
vid
e
d
to
it
.
The
hy
br
i
d
kernel
functi
on
that
is
pr
op
ose
d
in
this
arti
cl
e
pr
od
uces
good
res
ults.
T
he
hybri
d
ke
r
ne
l
fu
nctio
n
of
SV
M
al
gorithm
is
a
pp
li
ed
on
a
be
nch
m
ark
i
ntrusion
detect
io
n
dataset
an
d
t
he
n
the
ex
per
i
m
ent
is
exec
uted.
T
he
exp
e
rim
ent
resu
lt
s
sho
w
tha
t
the
pro
posed
pr
e
dicti
on
m
et
hod
has
be
tt
er
accu
racy
w
hen
com
par
ed
wit
h
tradit
io
nal
SVM
k
er
nel a
ppr
oach
e
s
[
23]
,
[
24]
.
A.
Gau
s
sia
n
ke
rn
e
l
An
e
xpone
ntial
decay
functi
on
w
hich
is
know
n
as
G
aus
sia
n
ke
rn
el
,
is
com
pu
te
d
be
tween
a
dat
a
po
i
nt
an
d
eac
h
of
t
he
s
uppor
t
vectors.
It
is
si
m
il
ar
to
a
weig
hted
li
nea
r
ke
rnel
.
T
he
m
axi
m
u
m
value
of
a
Gau
s
sia
n
f
un
ct
ion
is
att
ai
ned
at
the s
upport
vecto
r
that i
s
unif
or
m
ly
d
ecay
ed
am
on
g al
l d
irect
ion
s
.
1
(
,
)
=
(
−
‖
−
´
‖
2
2
2
)
>
0
(3
)
B.
Po
ly
nom
ial K
ern
el
Po
ly
nom
ial
ker
nels
are
c
omm
on
ly
us
ed
with
support
vect
or
m
achines
th
at
sp
eci
fy
the
si
m
il
arity
of
featur
e
vecto
rs
in
the
dataset
ov
e
r
poly
no
m
i
al
s
of
the
or
i
gin
al
featur
e
s.
I
n
a
Po
ly
no
m
ia
l
kernel,
K
2
re
presents
F
eat
ur
e
S
pace’
s in
ner
pro
duct
F
[
25]
:
2
(
,
)
=
(
+
)
(4
)
wh
e
re
x
a
nd y
are in
puts i
n
t
he
sam
ple sp
ace
, d is
degree
of the
po
ly
nom
ial.
The pr
opose
d
hybri
d ker
nel
H(x,
y)
is de
riv
ed fr
om
the sum
m
a
ti
on
of
(
1) an
d (2) as:
H(x,y)
=k
1
(
x,y
)
+
k
2
(
x,y
)
(5
)
The
fo
ll
owin
g
are
al
go
rithm
s
f
or
t
he
pro
pose
d
Hy
br
i
d
K
ern
el
base
d
S
VM
f
or
I
ntr
us
i
on
Detect
io
n
Syst
e
m
.
Algor
it
h
m
1
represe
nts
the
cl
assifi
cat
ion
a
ppro
ac
h
an
d
Algorith
m
2
pr
ese
nts
t
he
pr
opos
e
d
H
ybri
d
Kernel f
unct
io
n.
Let
the
trai
ni
ng
sa
m
ple
set
S
=
{(x
1
,y
1
),
(
x
2
,y
2
),
(
x
3
,y
3
)…..
},
w
her
e
x
i
∈
R
and
it
s
respec
ti
ve
m
ult
i
-
cl
ass
la
bels
y
i
∈
{
-
2,
-
1,
1}.
A
non
-
li
near
m
app
in
g
ϕ
fro
m
or
iginal
dat
a
to
a
hig
h
-
di
m
ension
al
feat
ur
e
s
pace,
therefo
re,
it
can
be
rep
la
ce
d
with
sam
ple
po
i
nts
x
i
a
nd
x
j
with
t
he
ir
m
app
ing
ϕ
(x
i
)
an
d
ϕ
(x
j
)
resp
ect
ively
[
13
].
K
is t
he ker
nel
functi
on that
x
i
, x
j
∈
R,
sati
sf
ie
s the follo
wi
ng equati
on:
(
,
)
=
{
∅
(
)
,
∅
(
)
}
(6
)
wh
e
re
ϕ
is a
m
app
i
ng fro
m
R to a feat
ure s
pa
ce F
,
∅
:
→
∅
(
)
∈
(7
)
Hybr
i
d
kernel
functi
ons
has
e
xcell
ent
le
ar
ni
ng
ca
pab
il
it
y.
I
n
th
e
desig
n
of
any
e
ff
ect
ive
m
od
el
,
ther
e
are
two
esse
nt
ia
l
par
am
e
te
rs
that
influ
e
nce
SV
M
[26]
.
A
m
o
ng
these
pa
ram
et
ers,
the
first
p
aram
et
er
C
is
known
as
re
gu
la
rizat
ion
pa
ra
m
et
er
wh
ic
h
de
fines
the
ad
ju
st
m
ent
cost.
This
ad
j
us
tm
ent
co
st
can
be
co
m
pu
te
d
as
the
cost
of
m
ini
m
iz
at
ion
of
trai
ning
er
r
or
a
nd
m
od
el
com
plexity
;
and
the
sec
ond
pa
ram
et
er
is
sigm
a
that
consi
ders
the
non
-
li
near
m
ap
ping
f
ro
m
the
avail
able
in
pu
t
-
sp
ace
t
o
the
hi
gh
-
dim
ensi
onal
featur
e
-
spa
c
e.
The
pr
ese
nt
work
sta
te
s
add
it
ive
functi
on
of
bo
t
h
the
Ga
ussi
an
an
d
poly
no
m
ia
l
ker
nel
s
as
a
hybri
d
kernel
functi
on.
Evaluation Warning : The document was created with Spire.PDF for Python.
Ind
on
esi
a
n
J
E
le
c Eng &
Co
m
p
Sci
IS
S
N:
25
02
-
4752
An
e
ns
e
mb
le
fe
atu
re
selec
ti
on app
r
oac
h usin
g hybri
d
ker
nel
base
d SVM f
or…
(
Gadda
m Ve
nu
Gop
al
)
563
3.5.
Per
fo
r
m
an
ce
metric
s
Accuracy
an
d
com
pu
ta
ti
on
al
tim
e
are
con
sidere
d
as
the
pe
rfor
m
ance
m
easur
e
s
f
or
i
de
ntifyi
ng
t
he
i
m
pact
of
feat
ur
e
sub
set
on
cl
assifi
ers
e
ff
i
ci
ency.
A
c
onf
us
io
n
m
at
rix
is
cal
culat
ed
w
it
h
the
e
ntries
of
tru
e
po
sit
ive
(TP),
true
neg
at
ive
(
TN),
false
pos
it
ive
(F
P
)
an
d
false
ne
gative
(F
N
)
values
.
Wh
e
re
T
P
is
the
total
nu
m
ber
of
co
rrec
tl
y
pr
edict
ed
no
r
m
al
sam
pl
es,
TN
is
the
to
ta
l
nu
m
ber
of
cor
re
ct
ly
pr
ed
ic
te
d
attack
sa
m
ples,
FP
a
nd
FN
the
nu
m
ber
of
nor
ma
l
sam
ples
ar
e
pr
e
dicte
d
a
s
attacks
a
nd
nu
m
ber
of
attack
sam
ples
pr
edic
te
d
as
no
r
m
al
res
pect
ively
.
Accuracy
is
co
ns
ide
red
t
o
be
rati
o
of
total
num
ber
of
te
sti
ng
sam
ples
correct
ly
cl
assifi
e
d
out
of
th
e
total
n
um
ber
of sam
ples;
ACCURAC
Y
=
TP
+
TN
TP
+
TN
+
FP
+
FN
(8
)
4.
RESU
LT
S
A
ND
D
IS
C
USS
ION
Th
e
propose
d
m
od
el
is
dev
el
op
e
d
in
Ja
va
1.7
on
In
te
l
co
r
e
i5
process
or,
with
4
GB
R
AM
an
d
with
W
i
ndows
7
e
nv
i
ro
nm
ent.
F
ro
m
the
Ky
oto
2006+,
70
%
is
c
on
si
dered
for
t
he
tra
ining
set
a
nd
30%
i
s
consi
der
e
d
a
s
the
te
st
set
.
Fig
ur
e
2
a
nd
Fi
gure
3
prese
nt
th
e
com
pu
ta
ti
onal
tim
e
and
ac
cur
aci
es
of
the
EH
K
-
SV
M
cl
assifi
e
r
r
especti
vely
,
after
each
fe
at
ur
e
el
im
inatio
n
afte
r
reli
ef
featu
re
e
stim
at
or
.
Ta
ble
3
giv
e
s
accuries
a
nd
c
om
pu
ta
ti
on
al
tim
es
of
tw
o
f
e
at
ue
subsets
w
it
h
11
feat
ur
es
an
d
9
feat
ur
es
an
d
com
par
e
d
with
the
H
K
-
SV
M
cl
assifi
er
with
total
num
ber
of
feat
ues.
I
n
Fig
ur
e
2
an
d
Fig
ur
e
3,
It
i
s
obser
ve
d
t
ha
t
t
he
cl
assifi
er
EH
K
-
SV
M
(11
)
is
an
ensem
ble
Hyb
rid
S
VM
cl
assifi
er
with
11
featur
es
a
nd
EHK
-
S
VM
(
9)
with
9
featuer
s fo
r bo
t
h gain i
n
c
om
pu
ta
ti
on
al
ti
m
e
and accu
racy a
re suggest
e
d.
Table
3.
Acc
uracy
an
d com
puta
ti
on
al
tim
e o
f
the classi
fie
rs nu
m
ber
of f
eat
ur
es
in pa
ren
t
he
sis
Alg
o
rith
m
Accurac
y
Ti
m
e
in
m
i
lliseco
n
d
s
HK
-
SV
M
(18
)
9
2
.51
2
7
5
2
0
EHK
-
SVM
(11
)
9
9
.08
1
7
5
6
2
EHK
-
SVM
(9)
9
2
.48
1
5
2
8
8
Figure
2.
Com
pu
ta
ti
onal
ti
m
e
of the
EHKS
V
M for
each it
erati
on
Figure
3.
Acc
uraci
es of t
he
E
HKSVM
f
or
e
ach
it
erati
on
In
Fig
ur
e
4
a
nd
Fig
ur
e
5,
i
t
is
ob
se
rv
e
d
that
t
he
cl
assifi
er
E
HK
-
S
V
M
(11)
is
e
xhibit
ing
highes
t
accuracy
i.e.
,
99.02
%
at
11
f
eat
ur
es.
T
he
c
om
pu
ta
ti
on
al
tim
e
of
the
cl
assifi
er
is
al
so
le
ss
when
c
om
par
ed
t
o
HKSVM
with
a total
num
ber
of
18
featu
res.
Evaluation Warning : The document was created with Spire.PDF for Python.
IS
S
N
:
2502
-
4752
Ind
on
esi
a
n
J
E
le
c Eng &
Co
m
p
Sci,
Vo
l.
23
, N
o.
1
,
Ju
ly
2021
:
558
-
565
564
Figure
4.
Acc
uraci
es of
H
KSVM, E
ns
em
bled
-
SV
M
with
11 a
nd 9 feat
ur
es
Figure
5.
Com
purati
onal
tim
e
of HKS
VM,
E
ns
em
bled
-
SV
M
(w
it
h 1
1 and 9
)
i
n
m
illiSeconds
Fr
om
the
a
bove
r
es
ults
the
fo
l
lowing
obser
va
ti
on
s
wer
e
dra
wn.
a)
A
H
KSVM
cl
assifi
er
with
is
a
hybr
id
cl
ass
ifie
r
that
yi
el
ds
good
res
ults
than
the
tra
diti
on
al
S
VM
an
d
SV
M
with
ke
rn
el
base
d
cl
a
ssifie
rs
is
im
plem
ented
al
ong
with
E
ns
e
m
bled
cl
assifi
er
with
f
eat
ure
reducti
on a
ppr
oach.
b)
EHK
-
S
VM
(
9)
is
al
so
exh
ibit
ing
good
dete
c
ti
on
rate
i.e.,
92
.48%
al
m
os
t
as
sa
m
e
as
the
ac
cur
acy
of
H
K
-
SV
M
(0.03%
di
ff
ere
nce i
n
ac
cur
aci
es
) wit
h m
or
e g
ai
n
i
n
c
om
pu
ta
ti
on
al
ti
m
e.
5.
CONCL
US
I
O
N
In
this
pa
pe
r,
an
ensem
ble
hybr
id
kernel
ba
sed
S
VM
is
us
ed
as
a
featu
r
e
sel
ect
ion
appro
ac
h
that
is
i
m
ple
m
en
te
d
and
te
ste
d
on
a
b
enc
h
m
ark
dataset
,
KYOTO
2006+.
The
pro
posed
m
et
ho
d
s
ugge
sts
2
scenari
os
,
one
with
11
feat
ures
i
.
e.
,
E
HK
-
SV
M
(
11)
a
nd
ano
t
her
with
9
featu
res
i.e.
,
EHK
-
S
VM
(
9)
.
It
is
ob
s
er
ved
t
hat
11
-
feat
ur
e
sc
e
nar
i
o
is
giv
i
ng
highest
accu
r
acy
wh
ic
h
i
s
a
good
sce
nar
io
for
a
re
quire
m
ent
of
high
detect
ion
rate
wh
e
reas
the
9
-
fe
at
ur
e
s
cenari
o
giv
es
a
good
gai
n
c
om
pu
ta
ti
on
al
t
i
m
e
that
is
hel
pful
in
qu
ic
k
detect
ion
rate.
T
he
pr
opose
d
EH
K
-
S
VM
is
com
pared
to
t
he
e
xisti
ng
m
od
el
s
that
us
es
t
he
sam
e
dataset
for
e
val
uatio
n
and
c
oncl
ude
d
the
pro
pose
d
appr
oach
e
xhibit
s
bette
r
acc
ur
acy
.
O
wing
to
these
resu
lt
s,
the
pro
po
se
d
m
odel
can
be
us
e
d
to
im
ple
m
ent
in
real
-
ti
m
e
env
ir
on
m
ent
of
NIDS.
Im
ple
m
entat
ion
of
the
EH
K
-
SV
M
on Real
tim
e d
at
aset
g
e
ner
at
e
d on N
I
DS
is t
he fut
ure
w
ork of t
his
pap
e
r.
REFERE
NCE
S
[1]
V.
N.
Vapn
ik, “
Stat
isti
ca
l
l
ea
rn
i
ng
the
or
y
,
”
vol
.
2,
1998
.
[2]
Avci,
Engi
n
,
"S
el
e
ct
ing
of
th
e
o
pti
m
al
feature
s
ubset
and
ker
ne
l
par
amete
rs
in
d
igi
tal
m
odula
ti
o
n
cl
assificat
ion
b
y
using
h
y
br
id
ge
net
i
c
a
lgori
thm
–
support
vec
tor
m
ac
hine
s:
HG
AS
VM
,
"
Ex
pert
S
yste
ms
wit
h
App
li
cations
,
vol
.
3
6,
no.
2
,
2009
,
pp
.
1391
-
1402,
doi
:
10.
1016/j.e
sw
a.
2
007.
11.
014
.
[3]
“
Ns
l
-
kdd
dat
a
set
for
net
work
-
bas
ed
in
trusion
detec
t
ion
s
y
stems
.
”
Available
on:
htt
p://ns
l.cs.unb.ca
/KDD
/NSLKD
D.ht
m
l,
Marc
h
2009.
[4]
B.
B
Rao
,
K.
Sw
at
hi
,
“
Fast
kNN
cl
assifi
ers
for
ne
tw
ork
int
rusion
det
e
ct
ion
s
y
s
te
m
,
”
Indian
Journal
of
Scienc
e
and
Technol
ogy
,
vo
l. 10, no. 14, pp.
1
-
10,
2017
,
doi
:
1
0.
17485/i
jst
/201
7/v10i
14/93690
.
[5]
Zha
ng
Qingl
ei,
a
nd
W
en
y
ing
Fen
g,
"N
et
work
in
tr
usion
det
e
ction
b
y
support
ve
ct
o
rs
and
an
t
co
lon
y
,
"
Proceedi
ngs.
The
2009
Inte
rnational
Workshop
on
Information
Sec
urity
and
Appl
ic
a
ti
on
(
IWISA
2009)
.
Ac
ademy
Publ
isher
,
2009,
pp
.
639
-
6
42.
[6]
Gu,
Chunhua,
a
nd
Xueqin
Zhang,
"A
rough
set
and
SV
M
ba
sed
int
rusio
n
de
te
c
ti
on
c
la
ss
ifi
e
r
,
"
2009
Sec
ond
Inte
rnational
W
orkshop o
n
Computer
Sc
ie
nc
e
an
d
Engi
n
ee
ring
, v
ol.
2
.
I
EEE,
200
9,
doi
:
10
.
1109/
W
CS
E.
2009.
776
.
[7]
Kim
,
Dong
Seong,
Ha
-
Nam
Ngu
y
en
,
and
Jong
Sou
Park,
"G
ene
tic
al
gor
it
hm
t
o
improve
SV
M
base
d
net
wor
k
int
rusion
d
et
e
ct
i
on
s
y
stem,
"
19th
Inte
rnat
ional
C
onfe
renc
e
on
Ad
vanc
ed
Informat
ion
Ne
tworki
ng
and
Application
s
(
AINA
'05)
,
vol.
1
(AIN
A pa
per
s)
.
v
ol
.
2
.
I
EEE,
2
005,
doi
:
10
.
110
9/AINA
.
2005.
191
.
[8]
Mo,
Yuanbin,
a
nd
Shuihua
Xu.
,
"A
ppli
cation
of
SV
M
base
d
on
hy
brid
ker
n
el
fun
c
ti
on
in
he
art
d
isea
se
di
agnose
s,
"
2010
Inte
rnati
onal
conf
ere
n
c
e
on
int
e
ll
ig
e
nt
computi
ng
and
cogni
tive
inf
orm
ati
cs
,
IEE
E
,
2010,
doi:
1
0.
1109/ICICCI.2010.96
.
[9]
Mukkam
al
a,
Sri
niva
s,
and
Andr
ew
H.
Sung,
"F
ea
tur
e
select
ion
for
int
rusion
de
t
ec
t
ion
with
neur
al
ne
two
rks
and
support
vec
tor
m
ac
hine
s,
"
Tr
anspor
tat
ion
Re
s
earc
h
Record:
Journal
of
Tr
anspor
tat
ion
Re
se
arch
Re
cor
d
,
v
ol.
1822,
no
.
1
,
pp
.
33
-
39,
2003
,
doi
:
10.
3141
/1822
-
05
.
Evaluation Warning : The document was created with Spire.PDF for Python.
Ind
on
esi
a
n
J
E
le
c Eng &
Co
m
p
Sci
IS
S
N:
25
02
-
4752
An
e
ns
e
mb
le
fe
atu
re
selec
ti
on app
r
oac
h usin
g hybri
d
ker
nel
base
d SVM f
or…
(
Gadda
m Ve
nu
Gop
al
)
565
[10]
W
u
Chih
-
Hung,
Gw
o
-
H
shiung
Tz
eng
,
and
Rong
-
Ho
Li
n,
"A
N
ovel
h
y
br
id
gen
et
i
c
al
gorit
hm
for
ker
nel
func
tion
and
par
amet
er
opti
m
iz
ati
on
in
support
vec
tor
r
e
gre
ss
ion,
"
Ex
per
t
Syste
ms
wit
h
A
ppli
cations
,
vol.
36,
no.
3,
2009,
pp.
4725
-
4735
,
doi:
10
.
1016/j.e
s
wa.
2008.
06
.
046
.
[11]
Am
iri
,
Fate
m
eh
,
Moham
m
ad
Mahdi
Rezae
i
Yous
efi
,
Caro
Luc
as
,
Aza
deh
Shaker
y
,
Nass
er
Yaz
dani
,
"M
utu
al
informati
on
-
bas
ed
fea
tur
e
select
io
n
for
int
ru
sion
det
ec
t
ion
s
y
stems
,
"
Journal
of
Net
work
and
Computer
Appl
ic
a
ti
ons
,
vo
l.
34
,
no
.
4
,
pp
.
1
184
-
1199,
2011
,
doi:
10.
1016
/j
.
j
nca
.
2011
.
01.
002
.
[12]
Chen
You,
Yang
Li
,
Xue
-
Qi
C
heng,
Li
Guo
,
"
Surve
y
and
t
axo
nom
y
of
fe
at
ur
e
sele
ction
al
gor
i
thm
s
in
int
rusion
det
e
ct
ion
s
y
s
te
m
,
"
Inte
rnational
Confe
renc
e
on
Information
Sec
u
rity
and
Cryptology
,
Sp
ringe
r
,
Berl
in
,
Heidelbe
rg
,
v
ol.
4318
,
2006
,
doi:
10
.
1007/11
937807_13.
[13]
B
.
Schölkopf,
et.
al.
“
Input
spac
e
vs.
fe
at
ur
e
spa
ce
in
k
ern
e
l
-
bas
ed
m
et
hods,”
I
E
EE
Tr
ans.
Neural
Net
works
,
vo
l
.
10
,
no
.
5
,
pp
.
10
00
-
1017,
1999
,
doi:
10
.
1109/72
.
788641
.
[14]
Sun,
Yux
uan,
X
ia
ojun
Lou,
and
Bisai
Bao,
"A
novel
rel
i
ef
feat
ure
sele
c
ti
on
algorithm
base
d
on
m
ea
n
-
var
ia
nc
e
m
odel
,
”
Journa
l
of
Information
and
Comput
ati
onal
Scienc
e
,
vol.
8,
no.
16,
pp.
3921
-
3929,
2011,
doi:
10.
24297/ijct.v1
1i8.
7047.
[15]
W
ang,
Ping
An,
Xu
Sheng
Gan,
and
W
en
Ming
Gao,
"Resea
r
ch
on
No
nli
nea
r
m
odel
ing
Method
of
Support
Vec
t
or
Mac
hine
with
W
av
el
et
Der
iva
t
ion
Kerne
l
Func
ti
on,
"
Applied
Me
chanics
and
Mate
rials
,
v
ol
.
687,
pp.
1408
-
1411,
Tra
ns T
ec
h
Publ
ic
a
ti
ons L
td, 201
4,
doi
:
10
.
4028/
ww
w.sci
ent
ific.
net
/AMM
.
687
-
6
91.
1408
.
[16]
Cheng
Lili,
Ji
an
pei
Zh
ang
,
Jing
Yang
,
Jun
Ma
,
“
An
improved
hie
rar
ch
ical
m
ult
i
-
cl
ass
support
ve
ct
or
m
ac
hin
e
wit
h
bina
r
y
tr
ee
arc
hi
te
c
ture
,
”
In
2008
Inte
rnational
Confe
renc
e
on
Int
erne
t
Computing
in
Scienc
e
and
Engi
ne
ering
,
pp
.
106
-
109
,
IE
EE, 2008,
doi
:
10
.
11
09/ICICSE.
2008
.
9
.
[17]
Sun,
Yijun,
"Ite
r
at
iv
e
RE
LIE
F
fo
r
feature
w
ei
ght
i
ng:
al
gor
it
hm
s,
t
heor
ie
s,
and
app
li
c
at
ions,
"
I
EEE
tra
nsac
ti
ons
on
pat
t
ern
an
aly
sis
and
m
ac
hin
e int
e
ll
ig
ence
,
vol
.
2
9,
no
.
6
,
pp
.
103
5
-
1051
,
2007
,
d
oi:
10
.
1109/T
PA
MI.2007.
1093.
[18]
Yili
Ren,
Fuxian
g
Hu,
Hongping
Miao,
“
The
opti
m
iz
at
ion
of
ker
nel
func
ti
on
and
it
s
par
amete
rs
for
SVM
in
well
-
loggi
ng
,
”
13th
Inte
rna
ti
ona
l
Confer
ence
on
Servic
e
S
y
s
te
m
s
and
Servic
e
Man
age
m
ent
(ICSS
SM
)
,
2016,
doi:
10.
1109/ICSS
SM
.
2016.
753856
3
.
[19]
B
.
Schölkopf
,
A
.
Sm
ola
,
“
Learni
ng
W
it
h
Ker
n
el
s
,
”
C
ambridge, M
A:
MIT
Press
,
2
002.
[20]
Chih
-
Cheng
Ya
ng,
W
an
-
Jui
Le
e
,
and
Shie
-
Jue
L
ee
,
“
L
ea
rning
of
Kerne
l
Functi
o
ns
in
Support
V
ec
tor
Ma
chi
nes
,
”
2006
Inte
rnation
al
Joi
nt
Confe
re
nce
on
Neural
Net
works
Sheraton
Vanc
ouve
r
Wall
Cent
re
Hotel
,
Vanc
ouver
,
BC,
Cana
da
,
2006
,
p
p.
1150
-
1155
.
[21]
K
y
oto
2006+
d
ataset
is a
v
ai
l
abl
e
on:
htt
p
:/
/www
.
t
aka
kura
.
com/K
yoto_da
t
a/
[22]
Song
Jungs
uk,
et
al.
“
Statis
ti
c
al
anal
y
s
is
of
hone
y
po
t
data
and
buil
ding
of
Ky
o
to
20
06+
dat
ase
t
for
NID
S
eva
lu
at
ion
,
”
Pro
ce
ed
ings
of
the
Fi
rs
t
Workshop
on
Bui
ld
ing
Ana
ly
sis
Datasets
a
nd
Gathering
E
x
perie
nc
e
R
et
urn
s
for Se
curi
ty
,
AC
M,
2011
,
pp.
29
-
36,
doi
:
10
.
1145
/1978672.
19786
76
.
[23]
Lu,
Yan
-
Li
ng,
Le
i
LI
,
M
eng
-
Meng
Zhou
,
Gu
o
-
Li
ang
Tian
,
“
A
new
fuz
z
y
su
pport
vector
m
a
chi
ne
b
ase
d
on
the
m
ixe
d
ker
ne
l
fu
nct
ion
,
”
In
2009
Inte
rnationa
l
C
onfe
renc
e
on
M
achi
ne
Learning
and
Cybe
rne
ti
c
s
,
v
ol.
1
,
2009
,
p
p.
526
-
531
,
IE
EE, doi:
10
.
1109/IC
MLC.
2009.
5212
552
.
[24]
Altun
Gulsah,
e
t.
al
.
"H
y
brid
S
VM
Kerne
ls
for
Protei
n
Se
cond
ar
y
Struct
u
re
Pr
edi
c
ti
on,
"
In
Gr
C
,
pp.
762
-
765,
2006,
doi
:
10
.
11
09/GRC.2006.
1
635912
.
[25]
A
.
Bosch,
Zi
ss
er
m
an
A,
Munoz
X,
“
Repre
senti
n
g
shap
e
with
a
spatial
p
y
ramid
ker
nel,”
Conf
ere
n
ce
on
Image
and
Vi
deo
Retrie
val
,
2007,
pp
.
401
-
4
08,
doi
:
10
.
1145
/1282280.
12823
40
.
[26]
S
.
Boughorbe
l,
J
.
P
.
Ta
re
l,
N.
B
ouje
m
aa
,
“
Gene
ral
i
ze
d
histogr
a
m
int
erse
ct
i
on
k
ern
el
for
imag
e
rec
ognition,
”
I
n
IEE
E
Internat
ion
al
Conf
ere
n
ce o
n
Im
age
Proc
essing
2005
,
Genov
a,
I
tal
y
,
IEEE, d
oi:
10
.
1109/ICIP
.
2005.
1530353
.
BIOGR
AP
HI
ES OF
A
UTH
ORS
Mr
.
G.
Venu
gopal
,
Rese
arc
h
S
chol
ar
at
Acha
r
ya
Naga
r
juna
Uni
ver
sit
y
.
Purs
uing
Ph.
D
in
th
e
fie
ld
of
Ma
chi
n
e
Le
arn
ing.
As
pa
rt
of
his
Ph.
D
work,
he
is
writi
n
g
thi
s
pape
r
.
He
Com
ple
te
d
M.
Te
ch
in
CS
E
from
Acha
ry
a
Nag
arj
una
Univer
si
t
y
(AN
U)
in
the
y
e
ar
2010.
He
Finished
B.
Te
ch
in
CS
E
from
JNT
UH
,
H
y
der
ab
a
d.
His
area
of
intere
st
is
Dat
a
Mi
ning
and
Mac
h
in
e
Learni
ng
.
He
is a
Li
f
e
m
ember
of
prof
essional
bodie
s l
ike
ISTE
,
IAENG
.
Dr.
G.
Rama
Mohan
Bab
u
,
r
ec
e
ive
d
his
B
.
T
ec
h
degr
ee
in
E
le
c
troni
cs
&
Co
m
m
unic
at
ions
Engi
ne
eri
ng
fro
m
Sri
Venka
te
s
wara
Univer
si
t
y
,
India.
He
did
h
i
s
M.T
ec
h
in
Co
m
pute
r
Scie
n
ce
&
Engi
ne
eri
ng
f
rom
Jawaha
rla
l
Nehru
Te
chno
lo
gic
a
l
Univer
sit
y
(JN
TU),
India
.
He
rec
e
ive
d
his
Ph.D.
from
Ach
ar
y
a
Naga
r
juna
Univer
sit
y
(AN
U),
India
,
in
Co
m
pute
r
Scie
nce
&
Engi
ne
eri
ng.
He
is
cur
ren
tly
working
as
P
rof
essor,
in
the
De
par
tment
of
Info
rm
at
ion
Te
chno
l
og
y
a
t
RVR
&
JC
Coll
eg
e
of
E
ngine
er
ing,
Guntur,
Ind
ia.
He
h
as
m
ore
th
an
19
y
ea
rs
o
f
t
eachi
ng
expe
r
ie
n
ce
.
His
rese
arc
h
ar
e
as
of
int
er
est
include
image
pro
c
essing,
patter
n
r
ec
ogni
ti
on,
and
dat
a
ana
l
y
t
ic
s
.
He
is life
m
ember
in
profe
ss
ional
bodi
es
li
k
e
IST
E
and
CS
I.
Evaluation Warning : The document was created with Spire.PDF for Python.