I
nte
rna
t
io
na
l J
o
urna
l o
f
E
lect
rica
l a
nd
Co
m
p
ute
r
E
ng
in
ee
ring
(
I
J
E
CE
)
Vo
l.
10
,
No
.
5
,
Octo
b
er
2
0
2
0
,
p
p
.
5
5
1
4
~
5
5
2
5
I
SS
N:
2
0
8
8
-
8708
,
DOI
: 1
0
.
1
1
5
9
1
/
i
j
ec
e
.
v
1
0
i
5
.
pp
5
5
1
4
-
5
5
2
5
5514
J
o
ur
na
l ho
m
ep
a
g
e
:
h
ttp
:
//ij
ec
e.
ia
esco
r
e.
co
m/in
d
ex
.
p
h
p
/I
JE
C
E
An int
rusio
n de
te
ction sy
ste
m
for p
a
ck
e
t
a
nd
flow
ba
sed
netw
o
rk
s usin
g
d
eep neu
ra
l net
w
o
rk appro
a
ch
K
a
niz F
a
rha
na
1
,
M
a
qs
ud
ur
Ra
h
m
a
n
2
,
M
d.
T
o
f
a
el
Ah
m
e
d
3
1
De
p
a
rtme
n
t
o
f
Co
m
p
u
ter S
c
ien
c
e
a
n
d
E
n
g
in
e
e
rin
g
,
P
o
rt
Cit
y
In
ter
n
a
ti
o
n
a
l
Un
iv
e
rsity
,
Ba
n
g
lad
e
sh
2
F
a
c
u
lt
y
o
f
S
c
ien
c
e
a
n
d
En
g
in
e
e
rin
g
,
De
p
a
rtm
e
n
t
o
f
Co
m
p
u
ter S
c
ien
c
e
a
n
d
E
n
g
in
e
e
rin
g
,
P
o
rt
Ci
ty
In
tern
a
ti
o
n
a
l
U
n
iv
e
rsity
,
Ba
n
g
lad
e
sh
3
F
a
c
u
lt
y
o
f
En
g
in
e
e
rin
g
,
De
p
a
rtme
n
t
o
f
In
f
o
rm
a
ti
o
n
a
n
d
C
o
m
m
u
n
ica
ti
o
n
T
e
c
h
n
o
l
o
g
y
,
Co
m
il
la Un
iv
e
rsit
y
,
Ba
n
g
lad
e
sh
Art
icle
I
nfo
AB
ST
RAC
T
A
r
ticle
his
to
r
y:
R
ec
eiv
ed
J
an
26
,
2
0
20
R
ev
i
s
ed
A
p
r
13
,
2
0
2
0
A
cc
ep
ted
A
p
r
26
,
2
0
2
0
S
tu
d
y
o
n
d
e
e
p
n
e
u
ra
l
n
e
tw
o
rk
s
a
n
d
b
ig
d
a
ta
is
m
e
rg
in
g
n
o
w
b
y
s
e
v
e
r
a
l
a
sp
e
c
ts
to
e
n
h
a
n
c
e
t
h
e
c
a
p
a
b
il
i
ti
e
s
o
f
in
tru
si
o
n
d
e
tec
ti
o
n
sy
st
e
m
(IDS)
.
M
a
n
y
IDS
m
o
d
e
ls
h
a
s
b
e
e
n
in
tr
o
d
u
c
e
d
to
p
r
o
v
id
e
se
c
u
rit
y
o
v
e
r
b
ig
d
a
ta.
T
h
is
stu
d
y
f
o
c
u
se
s
o
n
th
e
i
n
tru
si
o
n
d
e
tec
ti
o
n
i
n
c
o
m
p
u
ter
n
e
tw
o
rk
s
u
sin
g
b
ig
d
a
tas
e
ts.
T
h
e
a
d
v
e
n
t
o
f
b
ig
d
a
ta
h
a
s
a
g
it
a
ted
th
e
c
o
m
p
re
h
e
n
siv
e
a
s
s
istan
c
e
in
c
y
b
e
r
se
c
u
rit
y
b
y
f
o
r
w
a
rd
in
g
a
b
ru
n
c
h
o
f
a
ff
lu
e
n
t
a
lg
o
rit
h
m
s
to
c
l
a
ss
ify
a
n
d
a
n
a
ly
sis
p
a
tt
e
rn
s
a
n
d
m
a
k
in
g
a
b
e
tt
e
r
p
re
d
icti
o
n
m
o
re
e
ff
icie
n
t
ly
.
In
th
is
stu
d
y
,
to
d
e
tec
t
in
tru
si
o
n
a
d
e
tec
ti
o
n
m
o
d
e
l
h
a
s
b
e
e
n
p
r
o
p
o
u
n
d
e
d
a
p
p
ly
in
g
d
e
e
p
n
e
u
ra
l
n
e
tw
o
rk
s.
W
e
a
p
p
li
e
d
th
e
su
g
g
e
ste
d
m
o
d
e
l
o
n
t
h
e
late
st
d
a
tas
e
t
a
v
a
il
a
b
le
a
t
o
n
li
n
e
,
f
o
rm
a
tt
e
d
w
i
th
p
a
c
k
e
t
b
a
se
d
,
f
lo
w
b
a
se
d
d
a
ta
a
n
d
so
m
e
a
d
d
it
i
o
n
a
l
m
e
tad
a
ta
.
T
h
e
d
a
tas
e
t
i
s
lab
e
led
a
n
d
im
b
a
lan
c
e
d
w
it
h
7
9
a
tt
rib
u
tes
a
n
d
so
m
e
c
las
se
s
h
a
v
in
g
m
u
c
h
les
s
train
in
g
sa
m
p
les
c
o
m
p
a
re
d
to
o
th
e
r
c
las
se
s.
T
h
e
p
ro
p
o
se
d
m
o
d
e
l
is
b
u
il
d
u
si
n
g
Ke
ra
s
a
n
d
G
o
o
g
le
Ten
so
rf
lo
w
d
e
e
p
lea
rn
in
g
e
n
v
iro
n
m
e
n
t.
Ex
p
e
rime
n
tal
re
su
lt
sh
o
w
s
th
a
t
in
tr
u
sio
n
s
a
re
d
e
tec
ted
w
it
h
th
e
a
c
c
u
ra
c
y
o
v
e
r
9
9
%
f
o
r
b
o
th
b
i
n
a
ry
a
n
d
m
u
lt
icla
s
s
c
las
si
f
ica
ti
o
n
w
it
h
se
le
c
ted
b
e
st
f
e
a
tu
re
s.
Re
c
e
i
v
e
r
o
p
e
ra
ti
n
g
c
h
a
r
a
c
teristics
(ROC)
a
n
d
p
re
c
isio
n
-
re
c
a
ll
c
u
rv
e
a
v
e
ra
g
e
sc
o
re
is
a
lso
1
.
T
h
e
o
u
tco
m
e
im
p
li
e
s
th
a
t
De
e
p
Ne
u
ra
l
Ne
tw
o
rk
s
o
ff
e
rs
a
n
o
v
e
l
re
se
a
rc
h
m
o
d
e
l
w
it
h
g
re
a
t
a
c
c
u
ra
c
y
f
o
r
in
tru
sio
n
d
e
tec
ti
o
n
m
o
d
e
l,
b
e
tt
e
r
th
a
n
so
m
e
m
o
d
e
ls
p
re
se
n
ted
in
th
e
li
tera
tu
re
.
K
ey
w
o
r
d
s
:
B
ig
d
ata
Dee
p
n
eu
r
al
n
e
t
w
o
r
k
s
I
n
tr
u
s
io
n
d
etec
tio
n
s
y
s
te
m
(
I
D
S)
Ker
as
T
en
s
o
r
f
lo
w
Co
p
y
rig
h
t
©
2
0
2
0
In
stit
u
te o
f
A
d
v
a
n
c
e
d
E
n
g
i
n
e
e
rin
g
a
n
d
S
c
ien
c
e
.
Al
l
rig
h
ts re
se
rv
e
d
.
C
o
r
r
e
s
p
o
nd
ing
A
uth
o
r
:
Kan
iz
Far
h
an
a,
Dep
ar
t
m
en
t o
f
C
o
m
p
u
ter
Scie
n
ce
an
d
E
n
g
i
n
ee
r
in
g
,
P
o
r
t Ci
ty
I
n
ter
n
atio
n
al
U
n
iv
er
s
it
y
(
P
C
I
U)
,
C
h
i
ttag
o
n
g
,
B
an
g
lad
es
h
.
P
h
o
n
e
+8
8
0
1
8
5
7
9
7
9
9
8
4
E
m
ail:
k
an
izb
ip
s
@
g
m
ail.
co
m
1.
I
NT
RO
D
UCT
I
O
N
I
n
f
o
r
m
a
tio
n
a
n
d
co
m
m
u
n
ica
tio
n
tech
n
o
lo
g
y
(
I
C
T
)
n
o
w
p
o
s
es
a
g
r
ea
t
ch
alle
n
g
e
f
o
r
n
et
w
o
r
k
en
g
i
n
ee
r
s
b
ec
au
s
e
o
f
its
g
r
o
w
th
o
v
er
th
e
y
ea
r
s
.
A
lo
n
g
w
i
th
th
e
ad
v
an
ce
m
e
n
t
i
n
th
e
tech
n
o
lo
g
ies
th
e
a
m
o
u
n
t
o
f
th
r
ea
t
is
al
s
o
in
cr
ea
s
i
n
g
an
d
h
an
d
lin
g
b
ig
d
atase
ts
h
a
s
al
s
o
b
ec
o
m
e
an
i
m
p
o
r
tan
t
f
ac
to
r
w
h
e
n
it
co
m
e
s
to
s
ec
u
r
it
y
.
Fo
r
y
ea
r
s
,
r
esear
ch
o
n
n
et
w
o
r
k
s
ec
u
r
it
y
h
a
s
b
ee
n
f
o
llo
w
ed
b
y
a
g
r
ea
t
f
o
c
u
s
a
n
d
in
ter
est
b
y
th
e
r
esear
c
h
er
s
.
T
h
r
ea
ts
ca
n
b
r
in
g
h
u
g
e
d
a
m
a
g
e
to
s
y
s
te
m
s
a
n
d
o
r
g
an
iza
tio
n
s
.
T
h
e
ch
alle
n
g
e
is
to
d
etec
t t
h
o
s
e
in
tr
u
s
io
n
s
o
v
er
th
e
b
ig
d
ata
an
d
n
e
t
w
o
r
k
.
T
o
d
etec
t
th
e
s
e
attac
k
s
,
t
h
e
n
et
w
o
r
k
in
tr
u
s
io
n
d
etec
tio
n
s
y
s
te
m
(
I
DS)
h
as
s
h
o
w
n
g
r
ea
t
s
i
g
n
i
f
i
ca
n
ce
o
n
t
h
e
p
latf
o
r
m
s
t
h
at
n
ee
d
co
n
s
tan
t
s
ec
u
r
it
y
m
o
n
i
to
r
in
g
a
n
d
w
e
ca
n
s
a
y
th
at
in
tr
u
s
io
n
d
etec
tio
n
is
m
a
n
d
ato
r
y
f
o
r
p
r
o
tectin
g
an
y
s
y
s
t
e
m
f
r
o
m
m
alicio
u
s
ac
ti
v
ities
a
n
d
k
ee
p
th
e
s
y
s
te
m
s
ec
u
r
e
to
p
er
f
o
r
m
p
r
ec
is
el
y
.
An
in
tr
u
s
io
n
d
etec
tio
n
s
y
s
te
m
is
a
t
y
p
e
o
f
s
y
s
te
m
t
h
at
s
ca
n
s
th
r
o
u
g
h
th
e
tr
a
f
f
ic
o
f
n
et
w
o
r
k
s
an
d
lo
o
k
s
f
o
r
p
o
ten
tial
s
u
s
p
icio
u
s
ac
ti
v
it
ies,
an
al
y
ze
s
th
o
s
e
ac
ti
v
itie
s
,
aler
ts
t
h
e
s
y
s
te
m
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J
E
lec
&
C
o
m
p
E
n
g
I
SS
N:
2
0
8
8
-
8708
A
n
in
tr
u
s
io
n
d
etec
tio
n
s
ystem
fo
r
p
a
ck
et
a
n
d
flo
w
b
a
s
ed
n
et
w
o
r
ks u
s
in
g
d
ee
p
n
eu
r
a
l
.
.
.
(
K
a
n
iz
F
a
r
h
a
n
a
)
5515
i
m
m
ed
iatel
y
.
C
y
b
er
attac
k
s
th
a
t
ap
p
ea
r
e
d
f
r
o
m
2
0
0
1
t
o
2
0
1
3
ar
e
d
is
cu
s
s
ed
in
[
1
]
.
I
n
tr
u
s
io
n
d
etec
tio
n
s
y
s
te
m
s
(
I
DSs
)
ar
e
th
e
co
m
b
i
n
atio
n
o
f
h
ar
d
w
ar
e
a
n
d
s
o
f
t
w
ar
e
w
h
ich
k
ee
p
tr
ac
k
s
o
f
t
h
e
f
lo
w
o
f
d
ata
th
r
o
u
g
h
n
et
w
o
r
k
s
an
d
co
m
p
u
ter
s
,
a
ls
o
a
n
al
y
ze
t
h
e
d
ata
f
lo
w
to
d
etec
t
t
h
e
t
h
r
e
ats
an
d
a
n
o
m
a
lies
.
I
t
i
s
s
ig
n
i
f
i
ca
n
t
f
o
r
an
y
cr
itical
n
et
w
o
r
k
t
h
at
i
n
clu
d
es
s
ec
u
r
it
y
ad
m
in
i
s
tr
atio
n
to
g
et
alar
m
ed
f
r
o
m
s
o
m
e
u
n
a
u
th
o
r
ized
ac
tiv
i
ties
.
T
h
er
e
ar
e
tw
o
k
i
n
d
s
o
f
in
tr
u
s
io
n
d
etec
tio
n
s
y
s
te
m
s
b
as
ed
o
n
l
o
ca
tio
n
,
ca
lled
h
o
s
t
-
b
ased
an
d
n
et
w
o
r
k
-
b
ased
in
tr
u
s
io
n
d
etec
tio
n
s
y
s
te
m
s
.
Ho
s
t
-
b
ased
i
n
tr
u
s
io
n
d
etec
tio
n
s
y
s
te
m
s
w
o
r
k
o
n
co
llecte
d
in
f
o
r
m
atio
n
f
r
o
m
an
i
n
d
iv
id
u
al
co
m
p
u
ter
s
y
s
te
m
w
h
ile
a
n
et
w
o
r
k
-
b
ased
in
tr
u
s
io
n
d
etec
tio
n
s
y
s
te
m
co
llect
s
r
a
w
d
ata
p
ac
k
ets
f
r
o
m
t
h
e
n
et
w
o
r
k
to
lo
o
k
f
o
r
v
u
l
n
er
ab
il
ities
.
T
h
er
e
ar
e
also
tw
o
k
in
d
s
o
f
th
e
d
etec
tio
n
s
y
s
te
m
is
in
u
s
e
b
ased
o
n
t
h
e
tech
n
iq
u
e
s
,
n
a
m
ed
as
An
o
m
al
y
d
etec
tio
n
a
n
d
Mi
s
u
s
e
d
etec
tio
n
.
An
o
m
al
y
d
etec
tio
n
f
i
n
d
s
o
u
t
ch
an
g
e
s
in
p
atter
n
s
o
r
b
eh
av
io
r
o
n
th
e
o
r
ig
i
n
al
s
y
s
t
e
m
o
r
f
r
o
m
n
o
r
m
al
tr
af
f
ic.
T
h
e
ac
tiv
ities
d
if
f
er
en
t
f
r
o
m
th
e
u
s
u
al
ac
ti
v
itie
s
ar
e
lo
o
k
ed
f
o
r
an
d
o
b
s
er
v
ed
.
T
h
is
ap
p
r
o
ac
h
g
iv
e
s
a
h
ig
h
d
etec
tio
n
r
ate
b
u
t,
if
t
h
e
tr
af
f
i
c
is
n
o
t
p
r
o
f
iled
co
r
r
ec
tly
o
r
f
u
ll
y
,
t
h
i
s
s
c
h
e
m
e
ca
n
s
h
o
w
a
h
ig
h
f
alse
-
p
o
s
iti
v
e
r
ate.
W
h
ile
m
is
u
s
e
d
etec
t
io
n
t
ec
h
n
iq
u
e
w
o
r
k
s
b
y
f
i
n
d
in
g
o
u
t
ab
n
o
r
m
al
b
eh
a
v
io
r
f
r
o
m
b
o
th
k
n
o
w
n
n
o
r
m
al
a
n
d
attac
k
s
i
g
n
at
u
r
es.
T
h
en
r
ea
l
n
et
w
o
r
k
tr
af
f
ics
i
s
co
m
p
ar
ed
w
ith
t
h
e
alr
ea
d
y
co
llected
d
ata.
T
h
is
s
y
s
te
m
is
le
s
s
p
r
o
d
u
ctiv
e
f
o
r
attac
k
s
w
it
h
o
u
t
ce
r
tain
an
d
u
n
to
ld
p
atter
n
s
.
R
a
w
d
ata
p
ac
k
ets
co
n
tai
n
i
n
g
th
e
i
n
f
o
r
m
atio
n
o
f
th
e
n
et
w
o
r
k
d
ata
f
lo
w
,
p
atter
n
s
ar
e
co
llected
f
r
o
m
n
et
w
o
r
k
s
an
d
co
m
p
u
ter
s
,
u
s
ed
as
b
ig
d
ata
f
o
r
I
DSs
.
An
I
DS
class
if
ie
s
a
n
et
w
o
r
k
a
ctiv
it
y
as
'
n
o
r
m
al
'
o
r
‘
attac
k
’
(
ab
n
o
r
m
al)
.
I
n
t
h
is
p
ap
er
,
w
e
e
x
er
t
o
n
th
e
m
u
lt
i
-
class
an
d
b
in
ar
y
clas
s
i
f
icatio
n
f
o
r
in
tr
u
s
io
n
d
etec
tio
n
.
As
ti
m
e
p
as
s
ed
th
e
a
m
o
u
n
t
o
f
r
ea
l
-
ti
m
e
d
ata
h
as
i
n
cr
ea
s
ed
i
m
m
e
n
s
el
y
w
h
ic
h
m
ak
e
s
it
d
if
f
icu
lt
f
o
r
tr
ad
itio
n
al
i
n
tr
u
s
io
n
d
etec
tio
n
ap
p
r
o
ac
h
es
s
u
c
h
a
s
,
s
u
p
p
o
r
t
v
ec
to
r
m
ac
h
in
e
s
(
SV
M)
,
r
u
led
b
ased
s
y
s
te
m
,
d
ata
m
i
n
in
g
,
f
u
zz
y
lo
g
ic,
m
ac
h
i
n
e
lear
n
in
g
(
M
L
)
[
2
]
to
h
an
d
le
th
o
s
e
d
ataset
s
.
A
ls
o
u
s
i
n
g
t
r
ad
itio
n
al
m
ac
h
i
n
e
lear
n
in
g
ap
p
r
o
ac
h
es
f
o
r
cla
s
s
i
f
icatio
n
o
n
tr
ain
i
n
g
d
ata
a
v
ail
ab
le
f
r
o
m
lar
g
e
s
ca
le
n
et
w
o
r
k
s
is
n
o
t
p
r
o
d
u
ctiv
e
.
Ho
w
e
v
er
,
d
ee
p
le
ar
n
in
g
o
r
g
a
n
ize
ar
r
an
g
e
s
lear
n
in
g
al
g
o
r
ith
m
s
in
la
y
er
s
,
w
h
ich
ca
n
lear
n
an
d
m
a
k
e
d
ec
is
io
n
s
b
y
it
s
el
f
[
3
-
7
]
.
I
t
i
s
al
s
o
b
ei
n
g
u
s
ed
f
o
r
s
ec
u
r
it
y
m
ea
s
u
r
e
s
,
id
en
t
if
y
i
n
g
t
h
r
ea
ts
an
d
a
tta
ck
s
.
L
at
ter
l
y
,
d
ee
p
n
eu
r
al
n
et
w
o
r
k
(
DNN)
tech
n
iq
u
e
s
ar
e
s
h
o
w
in
g
i
m
p
r
o
v
e
m
en
t
in
h
a
n
d
li
n
g
b
i
g
d
atasets
w
it
h
r
ea
l
-
ti
m
e
co
m
p
u
ti
n
g
co
s
t
a
n
d
p
r
ed
ictiv
e
ac
c
u
r
ac
y
.
Se
v
er
al
w
o
r
k
s
ca
n
b
e
f
o
u
n
d
in
th
e
liter
at
u
r
e
w
h
ic
h
d
is
c
u
s
s
es
th
e
in
tr
u
s
io
n
d
etec
tio
n
s
y
s
te
m
s
th
o
r
o
u
g
h
l
y
a
n
d
ap
p
lies
cu
r
r
en
t
tr
en
d
s
an
d
tech
n
iq
u
es.
A
ls
o
,
d
u
e
to
th
e
lack
o
f
re
lev
an
t
d
atasets
an
d
li
m
i
tatio
n
s
o
f
tr
ad
itio
n
al
m
e
th
o
d
s
d
ed
i
ca
ted
to
r
ev
ea
lin
g
t
h
r
ea
ts
o
v
er
th
e
n
et
w
o
r
k
s
h
o
w
s
d
esp
o
n
d
en
t a
cc
u
r
ac
y
r
es
u
lt
s
.
Ki
m
et
al.
[
8
]
p
r
o
p
o
s
ed
an
in
tr
u
s
io
n
d
etec
tio
n
s
y
s
te
m
b
ased
o
n
Dee
p
Neu
r
al
Net
w
o
r
k
(
DNN)
.
T
h
ey
p
r
ep
r
o
ce
s
s
ed
th
e
d
ata
s
et
th
o
r
o
u
g
h
l
y
.
T
h
e
class
i
f
icati
o
n
m
o
d
el
w
as
tr
ai
n
ed
an
d
test
ed
o
n
k
d
d
-
C
UP
'
9
9
d
ata
s
et.
T
h
e
DNN
m
o
d
el
co
n
tain
ed
f
o
u
r
h
id
d
en
la
y
er
s
an
d
a
h
u
n
d
r
ed
lay
er
u
n
it
s
.
A
p
p
r
o
x
i
m
atel
y
9
9
%
ac
cu
r
ac
y
is
o
b
tai
n
ed
,
t
h
e
m
o
d
el
also
g
a
v
e
r
elati
v
el
y
s
m
al
l
f
alse
r
ate
s
co
r
es.
A
d
ee
p
b
elie
f
n
et
w
o
r
k
(
I
DB
N)
u
s
i
n
g
t
h
e
k
d
d
-
c
u
p
'
9
9
d
ata
s
e
t
is
p
r
o
p
o
s
ed
b
y
L
i
u
a
n
d
Z
h
an
g
[
9
]
.
A
d
ee
p
b
elief
n
et
wo
r
k
is
cr
ea
ted
an
d
th
e
p
r
o
p
o
s
ed
m
o
d
el
is
i
m
p
le
m
en
ted
to
tr
ain
th
e
n
et
w
o
r
k
d
ata.
9
2
.
4
%
ac
cu
r
ac
y
is
g
ai
n
ed
w
it
h
i
n
4
7
.
2
s
u
s
in
g
th
e
b
elief
n
e
t
w
o
r
k
an
d
9
1
.
8
%
ac
cu
r
ac
y
is
b
y
2
2
.
7
s
u
s
i
n
g
I
DB
N.
A
n
L
ST
M
m
o
d
el
u
tili
zi
n
g
a
r
m
s
p
r
o
p
o
p
tim
izer
is
p
r
o
p
o
s
ed
b
y
Sa
r
a,
E
r
ic,
an
d
Kau
s
h
i
k
[
10
]
.
T
h
e
m
o
d
el
co
n
s
tr
u
cted
a
m
u
lti
-
clas
s
i
n
tr
u
s
io
n
d
etec
tio
n
s
y
s
te
m
.
T
h
e
L
ST
M
m
o
d
el
i
s
ap
p
lied
to
th
e
C
I
DD
S
-
0
0
1
d
ataset
an
d
s
h
o
w
ed
0
.
8
4
8
3
ac
cu
r
ac
ies.
A
R
an
d
o
n
Fo
r
est
b
ased
an
o
m
al
y
d
etec
tio
n
m
o
d
el
i
s
p
r
esen
ted
an
d
ass
es
s
ed
o
n
th
e
k
d
d
-
cu
p
'
9
9
d
ata
s
et
b
y
Z
h
a
n
g
an
d
Z
u
lk
er
m
i
n
e
[
11
]
.
T
h
ey
co
n
s
id
er
ed
t
w
o
att
ac
k
t
y
p
es
a
n
d
g
ai
n
ed
a
d
etec
ti
o
n
r
ate
o
f
9
4
.
7
%
o
n
b
in
ar
y
attac
k
t
y
p
es.
Gao
et
al
.
[
12
]
p
r
o
p
o
s
ed
an
I
DS
u
s
in
g
th
e
KDD
-
C
UP
-
1
9
9
9
d
ataset.
T
h
e
class
if
icat
io
n
u
s
ed
Dee
p
B
elie
f
Net
w
o
r
k
s
an
d
p
er
f
o
r
m
a
n
ce
e
v
al
u
atio
n
is
d
o
n
e
b
y
co
m
p
ar
i
n
g
t
h
e
m
o
d
el
w
it
h
Su
p
p
o
r
t
Vec
to
r
Ma
ch
in
es
an
d
A
r
ti
f
ici
al
Neu
r
al
Net
w
o
r
k
s
.
Usi
n
g
ANN
o
b
tain
ed
ac
cu
r
ac
y
i
s
8
2
.
3
0
%
an
d
S
VM
m
o
d
el
ac
cu
r
ac
y
is
8
6
.
8
2
%.
T
h
e
h
ig
h
est
ac
cu
r
ac
y
i
s
ac
h
ie
v
ed
w
it
h
DB
N
at
9
3
.
4
9
%.
A
n
i
n
tr
u
s
io
n
d
etec
tio
n
s
y
s
te
m
u
s
i
n
g
S
u
p
p
o
r
t
Vec
to
r
Ma
ch
i
n
e
h
as
b
ee
n
ap
p
lied
o
n
t
h
e
C
I
C
I
DS2
0
1
7
d
ataset
is
p
r
esen
ted
b
y
Vij
a
y
a
n
a
n
d
,
Dev
ar
aj
,
an
d
Kan
n
ap
ir
an
[
13
]
.
Sev
er
al
SVM
m
o
d
els
h
av
e
b
ee
n
tr
ain
ed
o
n
m
u
ltip
le
attac
k
t
y
p
es.
9
9
% a
cc
u
r
ac
y
r
ate
is
o
b
tain
ed
.
In
[1
4
]
B
ip
r
an
ee
l
an
d
Ho
n
in
tr
o
d
u
ce
d
a
d
ee
p
lear
n
in
g
tec
h
n
iq
u
e
n
a
m
ed
b
i
-
d
ir
ec
t
io
n
al
lo
n
g
s
h
o
r
t
-
ter
m
m
e
m
o
r
y
r
ec
u
r
r
en
t
n
eu
r
al
n
et
w
o
r
k
(
B
L
ST
M)
.
Af
t
er
f
ea
tu
r
e
e
x
tr
ac
tio
n
d
ata
s
et
t
r
ain
in
g
a
n
d
test
in
g
w
er
e
i
m
p
lied
.
T
h
e
ex
p
er
i
m
en
t
r
es
u
lt
s
h
o
w
s
o
v
er
9
5
%
ac
cu
r
ac
y
f
o
r
t
h
e
UN
SW
-
NB
1
5
d
ataset.
T
h
ey
p
er
f
o
r
m
ed
f
o
r
b
in
ar
y
c
l
ass
i
f
icatio
n
p
r
o
b
lem
s
w
it
h
1
0
0
%
p
r
ec
is
io
n
.
MD
.
Mo
in
et
al
.
[
1
5
]
im
p
le
m
e
n
ted
a
d
ee
p
lear
n
in
g
m
e
th
o
d
f
o
r
i
n
tr
u
s
io
n
d
etec
tio
n
o
n
t
h
e
k
d
d
an
d
n
s
l
-
k
d
d
d
ataset.
T
h
ey
tr
ain
ed
a
d
ee
p
C
NN
s
tr
u
ct
u
r
e
f
o
r
f
ea
t
u
r
e
e
x
tr
ac
tio
n
,
t
h
e
tr
ai
n
i
n
g
also
co
n
ti
n
u
e
d
as
a
1
-
NN
c
lass
if
ier
to
d
etec
t
th
e
attac
k
a
n
d
ac
h
iev
ed
o
v
er
9
4
% a
cc
u
r
ac
ies
f
o
r
b
o
th
d
ataset
s.
Ser
p
il,
Z
e
y
n
ep
an
d
M
u
h
a
m
m
ed
[
1
6
]
p
r
esen
ted
an
in
tr
u
s
io
n
d
etec
tio
n
s
y
s
te
m
.
T
h
e
y
ap
p
li
ed
r
an
d
o
m
f
o
r
est
f
o
r
r
ec
u
r
s
iv
e
f
ea
tu
r
e
e
li
m
i
n
atio
n
,
also
u
s
ed
d
ee
p
le
ar
n
in
g
cla
s
s
i
f
ier
s
o
n
t
h
e
C
I
C
I
DS2
0
1
7
d
ata
s
et.
T
h
ey
ac
h
ie
v
ed
9
1
%
ac
c
u
r
ac
y
b
y
i
m
p
le
m
en
t
in
g
a
d
ee
p
m
u
l
tila
y
er
p
er
ce
p
tr
o
n
s
tr
u
ct
u
r
e
o
n
f
ea
t
u
r
es
o
b
tain
ed
f
r
o
m
r
ec
u
r
s
iv
e
f
ea
t
u
r
e
eli
m
i
n
atio
n
.
U
s
t
e
b
a
y
e
t
a
l
.
[
1
7
]
p
r
e
s
en
ted
d
if
f
er
en
t
A
NN
m
o
d
els
to
d
etec
t
m
alicio
u
s
ac
tiv
itie
s
.
T
o
r
ed
u
ce
f
ea
t
u
r
es
o
f
t
h
e
C
I
C
I
DS2
0
1
7
d
ataset
th
e
y
e
m
p
lo
y
ed
Dee
p
Ne
u
r
al
Net
w
o
r
k
,
S
h
allo
w
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
0
8
8
-
8708
I
n
t J
E
lec
&
C
o
m
p
E
n
g
,
Vo
l.
10
,
No
.
5
,
Octo
b
e
r
2
0
2
0
:
5
5
1
4
-
5525
5516
Neu
r
al
Net
w
o
r
k
,
a
n
d
A
u
to
E
n
co
d
er
.
T
h
ey
co
m
p
ar
ed
t
h
e
ac
c
u
r
ac
y
a
m
o
n
g
t
h
ese
m
o
d
els.
T
h
eir
s
t
u
d
y
s
h
o
w
ed
s
ev
er
al
ac
c
u
r
ac
ies
w
it
h
9
8
.
4
5
%
ac
cu
r
ac
y
r
ate.
An
I
D
S
s
y
s
te
m
p
r
o
p
o
s
ed
b
y
G.
W
atso
n
[
1
8
]
u
s
in
g
th
e
C
I
C
I
DS2
1
0
7
d
ataset.
Fo
r
th
eir
s
tu
d
y
t
h
e
ap
p
lied
t
h
e
m
o
d
e
l
o
n
2
7
f
ea
t
u
r
es.
T
h
e
y
g
ai
n
ed
9
4
.
5
%
ac
cu
r
ac
y
o
n
l
y
f
o
r
ML
P
,
w
h
ile
9
5
.
2
% a
cc
u
r
ac
y
is
o
b
tai
n
ed
b
y
u
s
in
g
M
L
P
an
d
P
ay
lo
ad
m
o
d
el
to
g
et
h
e
r
.
Dee
p
n
eu
r
al
n
et
w
o
r
k
s
tec
h
n
iq
u
e
s
f
o
c
u
s
o
n
lear
n
in
g
f
r
o
m
a
ttrib
u
te
s
an
d
p
er
f
o
r
m
b
etter
o
n
i
m
b
alan
ce
d
b
ig
d
ataset
s
.
T
h
is
p
ap
er
p
r
o
p
o
u
n
d
s
a
s
i
m
u
latio
n
o
f
d
ee
p
n
eu
r
al
n
et
w
o
r
k
m
o
d
el
o
n
C
I
C
I
DS2
0
1
7
p
u
b
licall
y
a
v
ailab
le
d
atase
t
[
19
]
f
o
r
in
tr
u
s
io
n
d
etec
tio
n
an
d
p
er
f
o
r
m
a
n
ce
is
e
v
al
u
a
ted
f
o
r
b
in
ar
y
a
n
d
m
u
lticla
s
s
w
it
h
s
elec
ted
b
est
f
ea
tu
r
es
[
20
]
.
T
h
e
m
o
d
el
is
ex
ec
u
ted
u
s
i
n
g
th
e
P
y
t
h
o
n
en
v
ir
o
n
m
e
n
t,
Ker
as
an
d
Go
o
g
le
T
en
s
o
r
Flo
w
.
Go
o
g
le
d
ev
elo
p
ed
T
en
s
o
r
Flo
w
,
o
p
en
-
s
o
u
r
ce
s
o
f
t
w
ar
e
f
o
r
m
ac
h
in
e
lear
n
in
g
a
n
d
Dee
p
L
ea
r
n
i
n
g
p
r
ac
tices.
Ker
as
is
a
h
ig
h
-
lev
el
ap
p
licatio
n
p
r
o
g
r
am
m
in
g
in
ter
f
ac
e
f
o
r
lear
n
i
n
g
,
w
h
ich
is
C
P
U
an
d
GP
U
en
ab
led
.
I
t su
p
p
o
r
ts
p
r
o
g
r
a
m
m
in
g
la
n
g
u
a
g
e
p
y
t
h
o
n
,
w
h
ich
ca
n
r
u
n
o
n
T
en
s
o
r
Flo
w
.
T
h
e
co
n
ten
ts
o
f
t
h
is
s
t
u
d
y
ar
e
d
is
p
o
s
ed
o
f
as
f
o
llo
w
s
.
T
h
e
Data
s
et
s
ec
tio
n
e
x
p
lo
r
es
th
e
u
s
ed
d
ataset
in
th
is
s
t
u
d
y
.
T
h
e
n
e
x
t
s
ec
ti
o
n
in
cl
u
d
es
d
ata
p
r
ep
r
o
ce
s
s
in
g
.
T
h
e
m
o
d
el
i
m
p
le
m
e
n
tati
o
n
s
ec
tio
n
e
x
p
lain
s
th
e
d
ee
p
n
e
u
r
al
n
et
w
o
r
k
m
o
d
el.
T
h
en
th
e
m
o
d
el
te
s
t
r
es
u
lt
a
n
d
r
esu
lt
a
n
al
y
s
is
s
ec
tio
n
s
h
o
w
th
e
e
x
p
er
i
m
e
n
ta
l
an
al
y
s
is
a
n
d
s
ec
tio
n
co
n
cl
u
s
io
n
d
ed
u
ce
s
t
h
e
p
ap
er
.
2.
DATAS
E
T
Fo
r
in
tr
u
s
io
n
d
etec
tio
n
,
it
is
im
p
o
r
ta
n
t
to
h
av
e
ce
r
tain
p
r
o
p
er
ties
in
n
et
w
o
r
k
-
b
ased
d
atase
ts
,
s
u
c
h
as
th
e
f
o
r
m
at
a
n
d
t
h
e
lab
eli
n
g
o
f
d
ata.
Fo
r
b
o
th
s
u
p
er
v
is
ed
a
n
d
u
n
s
u
p
er
v
is
ed
in
tr
u
s
io
n
d
ete
ctio
n
m
et
h
o
d
s
t
h
es
e
p
r
o
p
er
ties
ar
e
s
ig
n
i
f
ica
n
tl
y
e
x
p
lain
ed
at
Ma
r
k
u
s
et
al.
[
2
1
]
.
T
h
is
s
ec
tio
n
d
is
cu
s
s
es
th
e
b
ac
k
g
r
o
u
n
d
o
f
th
e
C
I
C
I
DS2
0
1
7
d
ataset
th
at
i
s
u
s
ed
as a
n
i
n
tr
u
s
io
n
d
etec
tio
n
d
ataset
f
o
r
th
is
s
tu
d
y
.
T
h
e
d
ataset
in
tr
o
d
u
ce
d
b
y
th
e
C
a
n
ad
ian
I
n
s
tit
u
te
f
o
r
C
y
b
er
s
ec
u
r
it
y
,
it
is
w
id
e
o
p
en
f
o
r
all
r
esear
ch
er
s
[
19
]
.
I
t is
o
n
e
o
f
t
h
e
latest
d
ataset
s
in
t
h
e
liter
at
u
r
e
f
o
r
n
e
t
w
o
r
k
in
tr
u
s
io
n
d
etec
t
io
n
t
h
at
co
n
tain
s
2
8
3
0
7
4
3
r
ec
o
r
d
s
w
it
h
7
9
n
et
w
o
r
k
tr
af
f
ic
f
ea
t
u
r
es
a
n
d
1
5
a
ttac
k
t
y
p
es
a
r
e
av
ailab
le
a
t
[
22
]
.
T
h
e
r
ec
o
r
d
s
in
t
h
e
d
ataset
ar
e
t
h
e
co
lle
ctio
n
o
f
r
ea
l
-
w
o
r
l
d
d
ata
[
1
9
,
20
]
,
s
p
r
ea
d
o
v
er
eig
h
t
f
iles
co
n
tain
in
g
f
i
v
e
-
d
a
y
b
en
ig
n
a
n
d
attac
k
ac
ti
v
it
y
.
T
h
e
f
o
r
m
at
o
f
th
e
r
ec
o
r
d
s
is
m
ai
n
l
y
p
ac
k
et
-
b
ased
an
d
b
if
ac
ial
f
lo
w
-
b
ased
,
i
n
cl
u
d
i
n
g
a
d
d
itio
n
al
m
etad
ata
[
21
]
.
A
ls
o
,
th
e
d
ataset
is
f
u
ll
y
lab
eled
.
T
h
e
in
ten
t
io
n
o
f
g
e
n
er
atin
g
t
h
e
d
ataset
is
f
o
r
n
et
w
o
r
k
i
n
tr
u
s
io
n
d
etec
tio
n
,
th
er
ef
o
r
e
it
f
o
cu
s
es
o
n
th
e
attac
k
t
y
p
es
m
e
n
tio
n
ed
i
n
T
ab
le
1
.
Fo
r
b
in
ar
y
cla
s
s
i
f
icatio
n
all
attac
k
t
y
p
e
s
ar
e
c
o
n
s
id
er
ed
as
'
1
'
a
n
d
b
en
ig
n
attac
k
s
ar
e
co
n
s
id
er
ed
as '
0
'
.
Fo
r
m
u
lti
-
cla
s
s
i
f
icatio
n
,
ea
ch
attac
k
t
y
p
e
is
co
n
s
id
er
ed
as th
e
y
ar
e
g
iv
e
n
.
T
h
e
attac
k
s
ar
e
co
m
p
r
is
ed
o
f
s
ev
en
co
m
m
o
n
attac
k
f
a
m
ili
es
as
B
o
tn
et,
Do
S
attac
k
,
D
Do
S
attac
k
,
B
r
u
te
f
o
r
ce
attac
k
,
W
eb
attac
k
,
I
n
f
iltra
tio
n
at
tack
,
a
n
d
Hea
r
tb
leed
attac
k
.
B
r
u
te
f
o
r
ce
attac
k
is
u
s
ed
to
cr
ac
k
p
ass
w
o
r
d
s
,
lo
ca
te
h
id
d
en
c
o
n
ten
t
s
,
h
it
a
n
d
tr
y
an
a
tt
ac
k
.
B
o
tn
et
at
tack
s
p
er
f
o
r
m
attac
k
s
t
h
r
o
u
g
h
in
ter
n
e
t
-
co
n
n
ec
ted
d
e
v
ices
a
n
d
s
e
n
d
s
p
a
m
.
Do
S
a
ttack
m
ak
e
s
t
h
e
s
y
s
te
m
u
n
av
ai
lab
le
f
o
r
s
o
m
e
t
i
m
e,
it
o
v
er
lo
ad
s
th
e
s
y
s
te
m
n
e
t
w
o
r
k
s
.
DDo
S
attac
k
o
cc
u
r
s
w
h
e
n
m
u
l
tip
le
s
y
s
te
m
s
f
al
l
in
to
a
v
icti
m
.
W
eb
attac
k
s
ar
e
s
o
f
t
w
ar
e
p
r
o
g
r
a
m
s
w
r
it
te
n
to
attac
k
t
h
e
u
s
er
s
y
s
te
m
,
l
o
o
k
f
o
r
v
u
l
n
er
ab
ilit
ies.
I
n
a
n
in
f
iltra
tio
n
attac
k
,
af
ter
e
x
p
lo
itin
g
t
h
e
u
s
er
s
y
s
t
e
m
a
b
ac
k
d
o
o
r
w
il
l
b
e
cr
ea
t
ed
to
ex
ec
u
te
attac
k
s
o
n
th
e
s
y
s
te
m
.
Hea
r
tb
leed
attac
k
w
o
r
k
s
b
y
d
ec
eiv
i
n
g
s
er
v
er
s
,
g
ai
n
i
n
g
p
r
i
v
ate
en
cr
y
p
t
io
n
k
e
y
an
d
lea
k
in
g
t
h
eir
in
f
o
r
m
atio
n
.
T
ab
le
1
.
Data
s
et
an
d
attac
k
t
y
p
es
F
i
l
e
N
a
me
s (.c
sv
f
i
l
e
f
o
r
mat
)
+
A
c
t
i
v
i
t
y
D
a
y
I
n
st
a
n
c
e
s
A
t
t
a
c
k
T
y
p
e
s
F
r
i
d
a
y
W
o
r
k
i
n
g
H
o
u
r
s A
f
t
e
r
n
o
o
n
D
D
o
s
2
2
5
7
4
5
B
e
n
i
g
n
,
D
D
o
S
F
r
i
d
a
y
W
o
r
k
i
n
g
H
o
u
r
s A
f
t
e
r
n
o
o
n
P
o
r
t
S
c
a
n
2
8
6
4
6
7
B
e
n
i
g
n
,
P
o
r
t
S
c
a
n
F
r
i
d
a
y
W
o
r
k
i
n
g
H
o
u
r
s
M
o
r
n
i
n
g
1
9
1
0
3
3
B
e
n
i
g
n
,
B
o
t
M
o
n
d
a
y
W
o
r
k
i
n
g
H
o
u
r
s
5
2
9
9
1
8
B
e
n
i
g
n
T
h
u
r
sd
a
y
W
o
r
k
i
n
g
H
o
u
r
s A
f
t
e
r
n
o
o
n
I
n
f
i
l
t
r
a
t
i
o
n
2
8
8
6
0
2
B
e
n
i
g
n
,
I
n
f
i
l
t
r
a
t
i
o
n
T
h
u
r
sd
a
y
W
o
r
k
i
n
g
H
o
u
r
s
M
o
r
n
i
n
g
W
e
b
A
t
t
a
c
k
s
1
7
0
3
6
6
B
e
n
i
g
n
,
W
e
b
A
t
t
a
c
k
B
r
u
t
e
F
o
r
c
e
,
W
e
b
A
t
t
a
c
k
S
q
l
I
n
j
e
c
t
i
o
n
,
W
e
b
A
t
t
a
c
k
X
S
S
T
u
e
sd
a
y
W
o
r
k
i
n
g
H
o
u
r
s
4
4
5
9
0
9
B
e
n
i
g
n
,
F
T
P
P
a
t
a
t
o
r
,
S
S
H
P
a
t
a
t
o
r
W
e
d
n
e
sd
a
y
W
o
r
k
i
n
g
H
o
u
r
s
6
9
2
7
0
3
B
e
n
i
g
n
,
D
o
S
-
G
o
l
d
e
n
Ey
e
,
D
o
S
-
H
u
l
k
,
D
o
S
S
l
o
w
h
t
t
p
t
e
st
,
D
o
S
-
S
l
o
w
l
o
r
i
s,
H
e
a
r
t
b
l
e
e
d
3.
DATA P
R
E
P
RO
CE
SS
I
NG
T
h
e
p
h
ase
o
f
d
ata
p
r
ep
r
o
ce
s
s
in
g
i
s
s
ig
n
i
f
ica
n
t
to
tr
an
s
f
o
r
m
r
a
w
d
ata
i
n
to
t
h
e
p
e
n
etr
ab
le
f
o
r
m
at
as
r
ea
l
-
w
o
r
ld
d
ata
i
s
o
f
te
n
i
m
p
er
f
ec
t,
in
co
m
p
atib
le
i
n
ce
r
tai
n
w
a
y
s
.
I
t
m
i
n
i
m
izes
t
h
e
a
m
b
ig
u
it
y
p
r
ese
n
t
i
n
th
e
u
s
ed
d
ataset
a
n
d
to
b
r
in
g
o
u
t
th
e
ac
c
u
r
ate
s
tatis
t
ics
o
f
th
e
d
etec
tio
n
s
y
s
te
m
.
T
h
e
d
ata
p
r
ep
r
o
ce
s
s
in
g
p
h
as
e
d
if
f
er
s
f
r
o
m
d
ata
to
d
ata
a
n
d
s
tu
d
y
b
y
s
t
u
d
y
.
I
n
t
h
is
s
ec
tio
n
d
ata
p
r
ep
r
o
ce
s
s
in
g
i
s
d
is
cu
s
s
ed
t
h
r
o
u
g
h
s
u
b
-
s
ec
tio
n
s
as
f
ea
tu
r
e
s
elec
ti
o
n
,
r
em
o
v
i
n
g
d
u
p
licate
s
,
clas
s
i
m
b
alan
ce
,
n
o
r
m
aliza
tio
n
,
an
d
lab
el
en
co
d
in
g
.
Fig
u
r
e
1
m
an
if
e
s
ts
t
h
e
p
r
o
ce
s
s
o
f
d
ata
-
p
r
ep
r
o
ce
s
s
in
g
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J
E
lec
&
C
o
m
p
E
n
g
I
SS
N:
2
0
8
8
-
8708
A
n
in
tr
u
s
io
n
d
etec
tio
n
s
ystem
fo
r
p
a
ck
et
a
n
d
flo
w
b
a
s
ed
n
et
w
o
r
ks u
s
in
g
d
ee
p
n
eu
r
a
l
.
.
.
(
K
a
n
iz
F
a
r
h
a
n
a
)
5517
Fig
u
r
e
1
.
Data
p
r
ep
r
o
ce
s
s
in
g
3
.
1
.
F
ea
t
ure
s
elec
t
io
n
W
h
en
w
o
r
k
i
n
g
w
it
h
h
ig
h
d
i
m
en
s
io
n
al
d
ata,
m
o
d
els
ca
n
r
etch
b
ec
au
s
e
o
f
th
e
in
cr
ea
s
ed
tr
ai
n
in
g
ti
m
e
.
T
r
ain
in
g
ti
m
e
i
s
i
n
f
lu
e
n
ce
d
b
y
t
h
e
n
u
m
b
er
o
f
f
ea
tu
r
e
s
,
a
ls
o
th
er
e
is
a
c
h
an
ce
o
f
o
v
er
f
itti
n
g
i
f
to
o
m
a
n
y
f
ea
t
u
r
es
ar
e
u
s
ed
w
h
ile
tr
ain
i
n
g
th
e
m
o
d
el.
So
,
f
ea
tu
r
e
r
ed
u
c
tio
n
is
i
m
p
o
r
tan
t
f
o
r
b
u
ild
in
g
a
m
o
d
el
w
it
h
h
i
g
h
d
i
m
en
s
io
n
al
d
ata
w
it
h
o
u
t
m
u
ch
lo
s
s
o
f
to
tal
in
f
o
r
m
at
io
n
.
T
h
e
cr
ea
to
r
o
f
th
e
C
I
C
I
DS2
0
1
7
d
ataset
ex
p
lain
ed
th
e
o
p
ti
m
al
f
ea
t
u
r
es
s
et
d
ep
en
d
in
g
o
n
ea
c
h
at
tack
t
y
p
e
i
n
[
19
]
.
R
an
d
o
m
Fo
r
est
R
eg
r
es
s
o
r
h
as
b
ee
n
u
s
ed
as
a
class
i
f
ier
a
n
d
o
b
s
er
v
e
s
t
h
e
b
est
f
ea
tu
r
e
s
f
o
r
ea
ch
attac
k
t
y
p
e
a
m
o
n
g
7
9
f
ea
tu
r
es
ac
co
r
d
in
g
to
t
h
e
w
ei
g
h
t
o
f
th
e
f
ea
t
u
r
es.
I
n
th
is
s
tu
d
y
,
2
4
f
ea
tu
r
es
i
n
cl
u
d
in
g
cla
s
s
lab
el
[
19
,
20
]
h
av
e
b
ee
n
co
n
s
id
er
ed
as
th
e
b
est
-
s
elec
te
d
f
ea
t
u
r
es f
o
r
d
etec
tio
n
.
T
ab
le
2
d
es
cr
ib
es th
e
s
elec
ted
f
ea
tu
r
e
s
[
23
,
24
].
T
ab
le
2
.
B
est
f
ea
tu
r
e
s
F
e
a
t
u
r
e
N
a
me
D
e
scri
p
t
i
o
n
F
l
o
w
d
u
r
a
t
i
o
n
F
l
o
w
d
u
r
a
t
i
o
n
T
o
t
a
l
l
e
n
g
t
h
o
f
t
h
e
f
o
r
w
a
r
d
p
a
c
k
e
t
s
C
o
mb
i
n
e
d
si
z
e
o
f
t
h
e
p
a
c
k
e
t
s
i
n
f
o
r
w
a
r
d
d
i
r
e
c
t
i
o
n
S
u
b
f
l
o
w
f
o
r
w
a
r
d
_
b
y
t
e
s
A
v
e
r
a
g
e
n
u
m
b
e
r
o
f
t
h
e
b
y
t
e
s p
r
e
se
n
t
i
n
a
su
b
f
l
o
w
t
o
t
h
e
f
o
r
w
a
r
d
d
i
r
e
c
t
i
o
n
B
a
c
k
w
a
r
d
p
a
c
k
e
t
l
e
n
g
t
h
s
t
d
S
t
a
n
d
a
r
d
d
e
v
i
a
t
i
o
n
l
e
n
g
t
h
o
f
p
a
c
k
e
t
s
i
n
t
h
e
b
a
c
k
w
a
r
d
d
i
r
e
c
t
i
o
n
F
l
o
w
I
A
T
M
i
n
M
i
n
i
m
u
m
T
i
me
b
e
t
w
e
e
n
t
w
o
p
a
c
k
e
t
s
p
a
sse
d
t
h
r
o
u
g
h
t
h
e
f
l
o
w
F
l
o
w
I
A
T
M
e
a
n
M
e
a
n
t
i
me
a
c
r
o
ss
t
w
o
p
a
c
k
e
t
s p
a
sse
d
i
n
t
h
e
f
l
o
w
F
l
o
w
I
A
T
st
d
T
i
me
o
f
st
a
n
d
a
r
d
d
e
v
i
a
t
i
o
n
b
e
t
w
e
e
n
t
w
o
p
a
c
k
e
t
s
F
o
r
w
a
r
d
I
A
T
M
i
n
M
i
n
i
m
u
m
t
i
me
a
c
r
o
ss
t
w
o
p
a
c
k
e
t
s
p
a
sse
d
i
n
t
h
e
f
o
r
w
a
r
d
d
i
r
e
c
t
i
o
n
A
c
t
i
v
e
M
i
n
B
e
f
o
r
e
t
u
r
n
i
n
g
i
n
t
o
i
d
l
e
t
h
e
mi
n
i
m
u
m
a
c
t
i
v
a
t
i
o
n
t
i
me
o
f
a
f
l
o
w
A
c
t
i
v
e
M
e
a
n
B
e
f
o
r
e
t
u
r
n
i
n
g
i
n
t
o
i
d
l
e
t
h
e
me
a
n
a
c
t
i
v
e
t
i
me
o
f
a
f
l
o
w
A
v
e
r
a
g
e
_
P
a
c
k
e
t
_
S
i
z
e
A
v
e
r
a
g
e
me
a
su
r
e
me
n
t
o
f
p
a
c
k
e
t
B
a
c
k
w
a
r
d
P
a
c
k
e
t
L
e
n
g
t
h
M
i
n
M
i
n
i
m
u
m
p
a
c
k
e
t
l
e
n
g
t
h
i
n
t
h
e
b
a
c
k
w
a
r
d
d
i
r
e
c
t
i
o
n
F
o
r
w
a
r
d
_
I
A
T
_
M
e
a
n
M
e
a
n
t
i
me
a
c
r
o
ss
t
w
o
p
a
c
k
e
t
s p
a
sse
d
i
n
t
o
f
o
r
w
a
r
d
d
i
r
e
c
t
i
o
n
B
a
c
k
w
a
r
d
_
I
A
T
_
M
e
a
n
M
e
a
n
t
i
me
a
c
r
o
ss
t
w
o
p
a
c
k
e
t
s
p
a
sse
d
i
n
t
o
b
a
c
k
w
a
r
d
d
i
r
e
c
t
i
o
n
I
n
i
t
i
a
l
W
i
n
b
y
t
e
s fo
r
w
a
r
d
T
o
t
a
l
n
u
m
b
e
r
o
f
b
y
t
e
s p
a
sse
d
t
h
r
o
u
g
h
i
n
i
t
i
a
l
w
i
n
d
o
w
i
n
t
o
f
o
r
w
a
r
d
d
i
r
e
c
t
i
o
n
A
C
K
f
l
a
g
_
C
o
u
n
t
N
u
mb
e
r
o
f
p
a
c
k
e
t
s o
n
a
c
k
n
o
w
l
e
d
g
men
t
S
Y
N
f
l
a
g
_
C
o
u
n
t
N
u
mb
e
r
o
f
p
a
c
k
e
t
s o
n
sy
n
c
h
r
o
n
i
z
a
t
i
o
n
F
o
r
w
a
r
d
p
u
sh
_
f
l
a
g
N
u
mb
e
r
s o
f
h
o
w
man
y
t
i
me
s p
u
sh
f
l
a
g
se
t
i
n
p
a
c
k
e
t
s
t
o
t
r
a
v
e
l
i
n
t
o
f
o
r
w
a
r
d
d
i
r
e
c
t
i
o
n
F
l
o
w
_
p
a
c
k
e
t
s
N
u
mb
e
r
o
f
p
a
c
k
e
t
s c
a
r
r
i
e
d
p
e
r
se
c
o
n
d
I
n
i
t
i
a
l
w
i
n
_
b
y
t
e
s b
a
c
k
w
a
r
d
T
o
t
a
l
n
u
m
b
e
r
o
f
b
y
t
e
s p
a
sse
d
t
h
r
o
u
g
h
i
n
i
t
i
a
l
w
i
n
d
o
w
i
n
t
o
b
a
c
k
w
a
r
d
d
i
r
e
c
t
i
o
n
F
o
r
w
a
r
d
P
a
c
k
e
t
L
e
n
g
t
h
M
e
a
n
M
e
a
n
p
a
c
k
e
t
l
e
n
g
t
h
i
n
t
o
f
o
r
w
a
r
d
d
i
r
e
c
t
i
o
n
B
a
c
k
w
a
r
d
P
a
c
k
e
t
s
N
u
mb
e
r
o
f
p
a
c
k
e
t
s c
a
r
r
i
e
d
p
e
r
se
c
o
n
d
P
u
sh
F
l
a
g
_
C
o
u
n
t
P
a
c
k
e
t
n
u
m
b
e
r
s o
n
P
U
S
H
3
.
2
.
Re
m
o
v
ing
d
up
lica
t
es
So
m
e
o
f
th
e
r
ec
o
r
d
s
in
th
e
d
ataset
h
av
e
d
u
p
licate
v
alu
e
s
.
Fo
r
p
r
ec
is
e
ev
alu
atio
n
,
it
w
a
s
n
e
ce
s
s
ar
y
to
r
e
m
o
v
e
d
u
p
licate
v
al
u
es
f
r
o
m
t
h
e
d
ataset.
Af
ter
r
e
m
o
v
i
n
g
d
u
p
licate
r
ec
o
r
d
s
n
u
m
b
e
r
o
f
i
n
s
tan
ce
s
h
as
r
ed
u
ce
d
to
2
2
8
6
6
0
4
f
o
r
m
u
lt
i
-
clas
s
attac
k
t
y
p
es.
Fi
g
u
r
e
2
s
h
o
w
s
th
e
d
is
tr
ib
u
tio
n
o
f
ea
ch
class
lab
el
f
o
r
m
u
lti
-
clas
s
i
f
icatio
n
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
0
8
8
-
8708
I
n
t J
E
lec
&
C
o
m
p
E
n
g
,
Vo
l.
10
,
No
.
5
,
Octo
b
e
r
2
0
2
0
:
5
5
1
4
-
5525
5518
3
.
3
.
Cla
s
s
i
m
ba
la
nce
I
t
is
o
b
s
er
v
ed
th
at
th
e
s
ize
o
f
th
e
d
ataset
co
m
b
in
ed
is
h
u
g
e,
also
th
e
class
i
m
b
a
lan
ce
s
i
tu
at
io
n
ca
n
b
e
s
ee
n
f
r
o
m
Fi
g
u
r
e
2
.
I
f
th
e
co
m
b
in
ed
d
ataset
i
s
u
s
ed
f
o
r
tr
ain
i
n
g
t
h
e
m
o
d
el,
t
h
en
t
h
e
m
o
d
el
w
ill
li
k
el
y
s
h
o
w
r
esu
lt
s
b
iased
to
w
ar
d
s
th
e
m
aj
o
r
ity
clas
s
t
y
p
e.
B
ec
au
s
e
o
f
th
is
c
lass
i
m
b
ala
n
ce
i
s
s
u
e,
t
h
e
m
o
d
el
ca
n
g
iv
e
a
h
i
g
h
f
alse
alar
m
r
ate
w
i
th
l
o
w
ac
c
u
r
ac
y
.
Fo
r
t
h
is
s
t
u
d
y
,
to
r
ed
u
ce
t
h
e
e
f
f
ec
t
o
f
clas
s
i
m
b
a
la
n
ce
p
r
o
b
le
m
'
Mo
n
d
a
y
-
W
o
r
k
i
n
g
Ho
u
r
s
.
p
ca
p
_
I
SC
X.
csv
'
d
atase
t
w
h
ic
h
co
n
tain
s
o
n
l
y
b
en
i
g
n
r
ec
o
r
d
s
h
as
b
ee
n
tak
en
o
u
t
o
f
co
n
s
id
er
atio
n
.
T
h
e
a
m
o
u
n
t
o
f
b
en
i
g
n
r
ec
o
r
d
is
m
o
r
e
th
a
n
8
0
%
w
h
ic
h
ca
n
m
a
k
e
t
h
e
c
lass
i
f
ier
o
v
er
-
f
itted
to
w
ar
d
s
t
h
e
n
o
r
m
al
a
ttack
.
W
ith
o
u
t
t
h
e
m
e
n
t
io
n
ed
d
ataset
t
h
e
to
tal
n
u
m
b
er
o
f
in
s
ta
n
ce
s
f
o
r
th
e
m
u
lti
-
cla
s
s
d
ataset
is
1
8
3
5
5
6
9
.
Fig
u
r
e
2
.
A
ttac
k
i
n
s
ta
n
ce
s
n
u
m
b
er
f
o
r
m
u
lti
-
clas
s
3
.
4
.
No
r
m
a
liza
t
io
n
No
r
m
a
lizatio
n
is
i
m
p
o
r
tan
t
f
o
r
d
ata
p
r
ep
ar
atio
n
in
n
e
u
r
al
n
et
w
o
r
k
s
b
ec
au
s
e
t
h
e
la
y
er
s
in
th
e
m
o
d
el
ac
t
s
en
s
iti
v
e
d
ep
en
d
in
g
o
n
t
h
e
w
ei
g
h
ts
o
f
th
e
d
ata.
T
h
e
f
e
atu
r
es
o
f
t
h
e
C
I
C
I
DS2
0
1
7
d
ataset
h
a
v
e
v
alu
e
s
o
f
d
if
f
er
e
n
t
r
a
n
g
e
s
w
h
ic
h
m
a
k
e
th
e
d
ataset
in
co
m
p
ar
ab
le.
So
,
to
k
ee
p
t
h
e
v
alu
e
s
in
a
co
m
m
o
n
r
an
g
e
n
o
r
m
aliza
t
io
n
i
s
ap
p
lied
,
w
h
i
ch
m
ak
e
s
t
h
e
lear
n
i
n
g
p
r
o
ce
s
s
ea
s
ier
f
o
r
n
e
u
r
al
n
e
t
w
o
r
k
la
y
er
s
.
A
ll
th
e
v
al
u
es
ar
e
n
o
r
m
a
lized
w
ith
in
a
r
an
g
e
o
f
0
to
1
u
s
in
g
m
a
x
-
m
in
n
o
r
m
aliza
tio
n
.
x
'
=
(
x
-
m
i
n
)
/(
m
a
x
-
m
i
n
)
*
(
n
e
w
_
m
ax
–
n
e
w
_
m
i
n
)
+
n
e
w
_
m
i
n
T
h
e
s
tatu
s
o
f
ea
c
h
r
ec
o
r
d
b
ef
o
r
e
an
d
af
ter
n
o
r
m
aliza
tio
n
is
s
h
o
w
n
b
elo
w
.
B
ef
o
r
e
No
r
m
aliza
t
io
n
(
s
n
ip
p
et
o
f
d
ataset)
3
,
1
2
,
6
,
0
,
0
,
3
,
0
,
3
,
3
,
3
,
0
,
0
,
6
6
6
6
6
6
.
7
,
0
,
0
,
0
,
1
,
9
,
1
2
,
3
3
,
-
1
,
0
,
0
,
B
E
NI
GN
Af
ter
No
r
m
aliza
tio
n
(
s
n
ip
p
et
o
f
d
ataset)
0
,
0
.
0
0
0
0
6
6
,
0
.
0
0
1
5
5
2
,
0
,
0
,
0
,
0
,
0
,
0
,
0
,
0
,
0
,
0
.
2
2
2
2
2
2
,
0
,
0
,
0
,
1
,
0
.
0
0
3
5
6
,
0
.
0
0
0
0
6
6
,
0
.
0
0
0
5
1
9
,
0
,
0
,
0
,
B
E
NI
GN
3
.
5
.
L
a
bel
enco
din
g
Fo
r
b
in
ar
y
clas
s
i
f
icatio
n
b
e
n
ig
n
a
n
d
attac
k
ar
e
co
n
s
id
er
e
d
as
'
0
'
an
d
'
1
'
r
esp
ec
tiv
e
l
y
.
An
d
f
o
r
m
u
lti
-
clas
s
clas
s
if
icatio
n
L
ab
e
l
en
co
d
in
g
h
as
b
ee
n
ap
p
lied
o
n
th
e
d
atase
t
b
ec
au
s
e
t
h
e
m
u
l
t
i
-
clas
s
lab
els
h
av
e
s
tr
in
g
n
a
m
es.
I
t
is
v
ita
l
to
b
in
ar
ize
th
o
s
e
s
tr
in
g
n
a
m
es
i
n
to
n
u
m
er
al
v
al
u
e
s
b
ef
o
r
e
p
ass
in
g
th
e
d
ataset
th
r
o
u
g
h
th
e
class
if
icatio
n
m
o
d
el.
L
ab
el
en
co
d
in
g
i
s
u
s
ed
r
ath
er
th
an
r
an
d
o
m
l
y
n
u
m
b
er
i
n
g
t
h
e
s
tr
in
g
s
to
av
o
id
an
y
b
iases
i
n
th
e
m
o
d
el
to
w
ar
d
s
t
h
e
h
ier
ar
ch
y
o
f
t
h
e
n
u
m
b
er
s
o
f
clas
s
t
y
p
e.
Af
ter
en
co
d
in
g
th
e
clas
s
t
y
p
e
i
n
to
b
in
ar
y
co
d
es
it
i
s
u
s
ed
a
s
t
h
e
o
u
tp
u
t
la
y
er
f
o
r
t
h
e
m
u
lti
-
class
i
f
icatio
n
w
i
th
n
clas
s
es.
L
ab
el
e
n
co
d
in
g
is
s
u
m
m
ar
ized
i
n
A
l
g
o
r
ith
m
1
.
Af
ter
lab
el
en
co
d
i
n
g
,
th
e
cla
s
s
at
tr
ib
u
te
f
o
r
ea
c
h
r
ec
o
r
d
f
o
r
m
s
a
n
ar
r
a
y
w
it
h
b
in
ar
y
v
a
lu
e
s
ass
i
g
n
ed
to
ev
er
y
1
5
class
es r
an
d
o
m
l
y
.
E
ac
h
r
ec
o
r
d
lo
o
k
s
lik
e
t
h
e
b
elo
w
ar
r
a
y
f
r
a
g
m
e
n
t.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J
E
lec
&
C
o
m
p
E
n
g
I
SS
N:
2
0
8
8
-
8708
A
n
in
tr
u
s
io
n
d
etec
tio
n
s
ystem
fo
r
p
a
ck
et
a
n
d
flo
w
b
a
s
ed
n
et
w
o
r
ks u
s
in
g
d
ee
p
n
eu
r
a
l
.
.
.
(
K
a
n
iz
F
a
r
h
a
n
a
)
5519
[
1
,
0
,
0
,
.
.
.
,
0
,
0
,
0
]
[
1
,
0
,
0
,
.
.
.
,
0
,
1
,
0
]
[
1
,
0
,
0
,
.
.
.
,
0
,
0
,
0
]
…………
….
.
.
.
.
.
.
.
.
.
[
1
,
0
,
0
,
.
.
.
,
0
,
0
,
0
]
[
1
,
0
,
0
,
.
.
.
,
1
,
0
,
0
]
[
1
,
0
,
0
,
.
.
.
,
0
,
0
,
0
]
Algorithm 1 : Label Encoding for multi
-
class classification
Input: Dataset D with features f
0
,
f
1
, ………, f
n
-
1
and attack classes (1…….C) for each records
in the dataset
Output: label encoded class feature
1:
LabelBinarizer()
2: lb.fit_transform()
3: y
⃪
label_binarize() #binary coded class label
4: end
A
f
ter
en
co
d
in
g
,
clas
s
d
is
tr
i
b
u
t
io
n
is
s
h
o
w
n
i
n
T
ab
le
3
.
T
ab
le
3
.
C
lass
d
is
tr
ib
u
tio
n
C
l
a
ss
n
u
m
b
e
r
C
l
a
ss
n
a
me
C
l
a
ss
-
0
B
e
n
i
g
n
C
l
a
ss
-
1
B
o
t
C
l
a
ss
-
2
D
D
o
S
C
l
a
ss
-
3
D
o
S
G
o
l
d
e
n
e
y
e
C
l
a
ss
-
4
D
o
S
H
u
l
k
C
l
a
ss
-
5
D
o
S
S
l
o
w
h
t
t
p
t
e
st
C
l
a
ss
-
6
D
o
S
S
l
o
w
l
o
r
i
s
C
l
a
ss
-
7
F
T
P
-
P
a
t
a
t
o
r
C
l
a
ss
-
8
H
e
a
r
t
b
l
e
e
d
C
l
a
ss
-
9
I
n
f
i
l
t
r
a
t
i
o
n
C
l
a
ss
-
10
P
o
r
t
S
c
a
n
C
l
a
ss
-
11
SSH
-
P
a
t
a
t
o
r
C
l
a
ss
-
12
W
e
b
A
t
t
a
c
k
-
B
r
u
t
e
F
o
r
c
e
C
l
a
ss
-
13
W
e
b
A
t
t
a
c
k
-
S
q
l
I
n
j
e
c
t
i
o
n
C
l
a
ss
-
14
W
e
b
A
t
t
a
c
k
-
X
S
S
4.
RE
S
E
ARCH
M
E
T
H
O
D
Fo
r
th
e
i
m
p
le
m
en
tatio
n
p
r
o
ce
s
s
,
w
e
u
s
ed
J
u
p
y
ter
n
o
teb
o
o
k
,
p
y
t
h
o
n
p
r
o
g
r
a
m
m
i
n
g
en
v
ir
o
n
m
en
t
th
r
o
u
g
h
T
en
s
o
r
Flo
w
an
d
Ker
as
lib
r
ar
y
.
Af
ter
d
ata
p
r
ep
r
o
c
ess
i
n
g
all
t
h
e
d
ataset
s
ar
e
s
ep
ar
ated
in
to
t
w
o
f
i
les
f
o
r
b
in
ar
y
a
n
d
m
u
lti
-
clas
s
cla
s
s
i
f
icatio
n
.
Fig
u
r
e
3
d
ep
ict
s
t
h
e
m
e
th
o
d
o
lo
g
y
o
f
th
is
s
tu
d
y
.
First,
th
e
d
atase
t
is
p
r
ep
r
o
ce
s
s
ed
s
o
th
at
th
e
m
o
d
e
l
ca
n
b
e
ap
p
lied
t
o
th
e
d
ataset
th
o
r
o
u
g
h
l
y
.
T
h
e
d
ataset
w
it
h
s
elec
ted
2
4
f
ea
tu
r
es
(
in
clu
d
i
n
g
th
e
clas
s
t
y
p
e)
h
as
b
ee
n
d
iv
id
ed
in
to
6
5
%
o
f
th
e
tr
ain
i
n
g
s
et
a
n
d
3
5
%
o
f
th
e
te
s
t
s
et.
T
h
e
d
atasets
ar
e
d
iv
id
ed
w
it
h
th
e
s
a
m
e
p
r
o
p
o
r
tio
n
f
o
r
b
o
th
b
in
ar
y
a
n
d
m
u
lti
-
clas
s
clas
s
i
f
icatio
n
.
Fig
u
r
e
3
.
Me
th
o
d
o
lo
g
y
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
0
8
8
-
8708
I
n
t J
E
lec
&
C
o
m
p
E
n
g
,
Vo
l.
10
,
No
.
5
,
Octo
b
e
r
2
0
2
0
:
5
5
1
4
-
5525
5520
4
.
1
.
P
ro
po
s
ed
m
o
del
T
h
e
p
r
o
p
o
s
ed
d
ee
p
n
eu
r
al
n
et
w
o
r
k
m
o
d
el
is
b
u
ilt
w
it
h
f
o
u
r
la
y
er
s
,
w
h
er
e
al
l
t
h
e
n
o
d
es
i
n
th
e
la
y
er
s
ar
e
f
u
l
l
y
co
n
n
ec
ted
u
s
e
s
b
ac
k
p
r
o
p
ag
atio
n
f
o
r
th
e
lear
n
i
n
g
m
o
d
el.
DNN
p
r
o
d
u
ce
s
o
u
tp
u
t
v
alu
es
b
y
ca
lcu
lati
n
g
th
e
h
id
d
en
la
y
er
n
eu
r
o
n
w
ei
g
h
ts
.
So
,
t
h
e
m
o
d
el
co
n
s
tr
u
c
ts
w
it
h
o
n
e
in
p
u
t
la
y
er
,
t
w
o
h
id
d
en
la
y
er
s
,
a
n
d
o
n
e
o
u
tp
u
t
la
y
er
.
T
h
e
n
u
m
b
er
o
f
h
id
d
en
la
y
er
s
i
s
n
o
t
i
n
cr
e
ased
to
av
o
id
th
e
v
a
n
is
h
i
n
g
g
r
ad
ien
t
p
r
o
b
le
m
,
also
m
a
n
y
h
id
d
en
la
y
er
s
ca
n
p
r
o
d
u
ce
r
esu
lt
s
w
it
h
v
er
y
h
i
g
h
s
en
s
iti
v
it
y
.
Fi
g
u
r
e
4
g
iv
e
s
a
n
id
ea
o
f
th
e
p
r
o
p
o
s
ed
m
o
d
el.
Fig
u
r
e
4
.
Dee
p
n
eu
r
al
n
et
w
o
r
k
As
ac
tiv
atio
n
f
u
n
c
tio
n
,
R
e
L
u
is
u
s
ed
in
b
o
th
in
p
u
t
a
n
d
h
id
d
en
la
y
er
f
o
r
ea
s
ier
m
a
th
e
m
atica
l
o
p
er
atio
n
,
w
h
ile
s
ig
m
o
id
f
u
n
ctio
n
is
ac
ti
v
ated
f
o
r
b
in
ar
y
class
i
f
icatio
n
an
d
ac
tiv
a
tio
n
f
u
n
ct
io
n
s
o
f
t
m
a
x
i
s
e
m
p
lo
y
ed
o
n
th
e
f
i
n
al
la
y
er
f
o
r
m
u
l
ti
-
c
lass
cla
s
s
i
f
icatio
n
r
esp
ec
tiv
el
y
.
I
n
p
u
t
d
i
m
is
s
et
as
2
3
as
th
e
in
p
u
t
f
ea
t
u
r
es
,
ex
cl
u
d
in
g
t
h
e
clas
s
ty
p
e
f
ea
t
u
r
e
.
T
h
e
f
ir
s
t
la
y
er
i
s
s
et
f
o
r
1
2
8
n
o
d
es,
t
w
o
h
id
d
en
n
o
d
es
la
y
er
s
ar
e
s
e
t
to
6
4
an
d
3
2
r
esp
ec
tiv
el
y
w
h
il
e
th
e
o
u
tp
u
t
la
y
e
r
n
o
d
e
is
s
et
as
1
f
o
r
b
in
ar
y
clas
s
m
o
d
el
an
d
f
o
r
th
e
m
u
lti
-
clas
s
p
r
o
b
lem
it i
s
s
et
ac
co
r
d
in
g
to
t
h
e
N
clas
s
n
u
m
b
er
.
N
class
e
s
ar
e
th
e
co
u
n
t o
f
b
en
ig
n
an
d
att
ac
k
t
y
p
e
s
.
Fo
r
b
o
th
s
ce
n
ar
io
s
tr
ai
n
i
n
g
b
atch
s
ize
i
s
s
et
a
s
1
0
th
o
u
s
a
n
d
(
f
o
r
a
s
i
n
g
le
b
atch
o
f
t
h
e
s
a
m
p
le)
an
d
th
e
ep
o
ch
i
s
s
e
t
to
1
5
0
(
t
o
tal
p
ass
n
u
m
b
er
o
v
er
th
e
co
m
p
lete
tr
ai
n
i
n
g
s
et)
.
T
h
e
p
r
o
p
o
s
ed
m
o
d
el
is
s
u
m
m
ar
ized
in
A
l
g
o
r
ith
m
2
.
Algorithm 2: Proposed DNN model
In
pu
t:
Da
ta
se
t
D
wi
th
fe
at
ur
es
f
0
,
f
1
,
……
…,
f
n
-
1
a
nd
at
ta
ck
la
be
l
en
co
de
d
(1
……
.C
)
fo
r
ea
ch
record
1. Train test split
2. Build the model on training dataset
-
Sequential()
3. Adding layers to the neural network
-
model.add()
4. Compile the model and calculate the accuracy
model.fit( )
for i to n
-
1 Each layer according to the batch size and epochs
calculate the performance (lose, accuracy) of each layer
5. End
return
⃪
accuracy
6. ROC and Precision
-
recall calculation
return
⃪
roc and precision
-
recall curve
Her
e,
s
tep
2
d
ef
in
es
th
e
Ker
as
m
o
d
el
f
o
r
class
i
f
icat
io
n
.
On
s
tep
3
n
ew
la
y
er
s
ar
e
ad
d
ed
to
t
h
e
m
o
d
el.
T
h
en
,
th
e
m
o
d
el
is
tr
ain
ed
o
v
er
6
5
%
o
f
th
e
d
ataset,
ca
lcu
lati
n
g
t
h
e
ac
cu
r
ac
y
,
lo
s
s
s
co
r
e
f
o
r
ea
ch
lay
er
.
Af
ter
s
tep
4
,
th
e
av
er
ag
e
v
alu
e
o
f
ac
cu
r
ac
y
a
n
d
lo
s
s
is
co
u
n
ted
.
Fi
n
a
ll
y
,
r
o
c
an
d
p
r
ec
is
io
n
-
r
ec
all
s
co
r
es
ar
e
ca
lcu
lated
to
u
n
d
er
s
tan
d
th
e
p
er
f
o
r
m
an
ce
o
f
t
h
e
p
r
o
p
o
s
ed
m
o
d
el
o
n
b
o
th
m
u
lt
i
-
clas
s
an
d
b
in
ar
y
class
i
f
icatio
n
p
r
o
b
lem
s
.
5.
T
E
ST
R
E
SU
L
T
A
ND
P
E
RF
O
RM
ANCE AN
AL
YS
I
S
W
e
m
ea
s
u
r
ed
t
h
e
v
al
u
es
o
f
th
e
lo
s
s
f
u
n
ct
io
n
a
n
d
ac
cu
r
ac
y
o
n
t
h
e
test
d
atase
t
f
o
r
b
in
ar
y
an
d
m
u
lti
-
clas
s
clas
s
if
icatio
n
w
it
h
2
4
b
est
-
s
elec
ted
f
ea
tu
r
es
in
cl
u
d
in
g
th
e
cla
s
s
lab
el.
T
h
e
p
er
f
o
r
m
a
n
ce
o
f
th
e
m
o
d
el
i
s
al
s
o
esti
m
ated
u
n
d
er
t
h
e
r
ec
ei
v
er
o
p
er
atin
g
ch
ar
ac
ter
is
tic
(
R
O
C
)
c
u
r
v
e
a
n
d
p
r
ec
is
io
n
-
r
ec
al
l
cu
r
v
e.
R
OC
r
e
f
er
s
to
a
g
r
ap
h
ical
illu
s
tr
atio
n
to
s
h
o
w
t
h
e
p
o
ten
tial
o
f
a
cla
s
s
i
f
ier
.
T
r
u
e
p
o
s
itiv
e
a
n
d
f
al
s
e
p
o
s
itiv
e
r
ates
ar
e
th
e
t
w
o
p
a
r
a
m
eter
s
u
s
ed
i
n
r
o
c.
Me
tr
ic
s
d
ef
i
n
ed
b
elo
w
ar
e
u
s
ed
to
m
ea
s
u
r
e
ac
c
u
r
ac
y
,
r
o
c
an
d
p
r
ec
is
io
n
-
r
ec
all
cu
r
v
e
[
2
5
]
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J
E
lec
&
C
o
m
p
E
n
g
I
SS
N:
2
0
8
8
-
8708
A
n
in
tr
u
s
io
n
d
etec
tio
n
s
ystem
fo
r
p
a
ck
et
a
n
d
flo
w
b
a
s
ed
n
et
w
o
r
ks u
s
in
g
d
ee
p
n
eu
r
a
l
.
.
.
(
K
a
n
iz
F
a
r
h
a
n
a
)
5521
-
T
r
u
e
Po
s
itiv
e
-
T
P
-
r
ep
r
esen
ts
a
ttack
d
ata
w
h
ic
h
i
s
co
r
r
ec
tly
cl
ass
i
f
ied
as a
n
attac
k
t
y
p
e.
-
Fals
e
P
o
s
itiv
e
-
FP
-
r
e
f
er
s
to
th
e
d
ata
th
at
is
n
o
t c
o
r
r
ec
tl
y
id
e
n
ti
f
ied
as a
n
attac
k
t
y
p
e.
-
T
r
u
e
Neg
ativ
e
-
T
N
-
allu
d
es to
d
ata
th
at
is
co
r
r
ec
tl
y
id
en
t
if
i
ed
as a
n
o
r
m
al
t
y
p
e.
-
Fals
e
Ne
g
ati
v
e
-
FN
-
r
e
f
er
s
to
a
ttack
d
ata
th
at
i
s
n
o
t c
o
r
r
ec
tl
y
ca
teg
o
r
ized
as a
n
o
r
m
al
t
y
p
e.
P
r
ec
is
io
n
,
r
ec
all
s
co
r
e
d
eliv
er
s
th
e
s
u
cc
e
s
s
o
f
p
r
ed
ictio
n
o
n
th
e
i
m
b
alan
ce
d
cla
s
s
e
s
.
P
r
ec
is
io
n
r
ef
er
s
to
th
e
r
esu
lt
o
f
r
elev
a
n
c
y
,
w
h
er
e
r
ec
all
ca
lcu
lates
tr
u
e
r
ele
v
an
t
ev
e
n
t
s
th
at
h
a
v
e
b
ee
n
f
o
u
n
d
.
P
r
ec
is
io
n
r
ef
er
s
to
tp
/tp
+f
p
an
d
R
ec
all
r
e
f
er
s
t
o
tp
/tp
+f
n
.
T
h
e
p
r
ec
is
io
n
-
r
ec
a
ll
cu
r
v
e
ill
u
s
tr
ates
t
h
e
tr
ad
e
-
o
f
f
r
elatio
n
b
et
w
ee
n
r
ec
all
an
d
p
r
ec
is
io
n
f
o
r
n
o
n
-
i
d
en
tical
t
h
r
es
h
o
ld
s
.
T
h
e
to
p
ar
ea
u
n
d
er
t
h
e
cu
r
v
e
m
ea
n
s
p
e
ak
v
a
lu
e
s
f
o
r
r
ec
all
an
d
p
r
ec
is
io
n
,
b
u
t
to
p
p
r
ec
is
io
n
m
ea
n
s
t
h
e
lo
w
e
s
t
f
al
s
e
-
p
o
s
iti
v
e
r
ate
a
n
d
t
o
p
r
ec
all
m
ea
n
s
lo
w
e
s
t
f
alse
-
n
eg
a
tiv
e
r
ate.
P
ea
k
s
co
r
es
s
h
o
w
t
h
at
cla
s
s
i
f
ier
g
iv
i
n
g
p
r
ec
is
e
r
esu
lts
a
s
h
i
g
h
p
o
in
t
p
r
ec
is
io
n
.
T
ab
le
4
g
iv
e
s
th
e
r
es
u
lt,
w
h
er
e
t
h
e
DNN
m
o
d
el
w
it
h
t
w
o
h
id
d
en
l
a
y
er
s
ac
h
ie
v
ed
h
i
g
h
ac
c
u
r
ac
y
r
ates.
Fo
r
b
in
ar
y
class
i
f
icatio
n
T
ab
le
5
s
h
o
w
s
t
h
e
p
r
ec
is
io
n
,
r
ec
all
s
co
r
es.
An
d
,
th
e
p
lo
t
is
s
h
o
w
n
i
n
Fi
g
u
r
e
5
s
h
o
w
s
th
e
R
O
C
cu
r
v
e
v
alu
e
a
s
1
f
o
r
b
in
ar
y
cla
s
s
i
f
icatio
n
.
T
ab
le
4
.
T
est
r
esu
lt 1
B
i
n
a
r
y
C
l
a
ssi
f
i
c
a
t
i
o
n
M
u
l
t
i
-
c
l
a
ss
C
l
a
ssi
f
i
c
a
t
i
o
n
A
c
c
u
r
a
c
y
9
9
.
1
3
%
9
9
.
2
9
%
L
o
ss
0
.
0
2
3
2
0
.
0
2
8
9
T
ab
le
5
.
T
est
r
esu
lt 2
B
i
n
a
r
y
c
l
a
ssi
f
i
c
a
t
i
o
n
P
r
e
c
i
si
o
n
0
.
9
9
R
e
c
a
l
l
0
.
9
6
Fig
u
r
e
5
.
R
OC
f
o
r
b
in
ar
y
clas
s
if
ica
tio
n
T
h
e
p
lo
t
is
s
h
o
w
n
in
Fig
u
r
e
6
is
th
e
R
O
C
f
o
r
m
u
lt
iclas
s
,
w
h
ic
h
g
i
v
es
R
O
C
ar
ea
u
n
d
er
th
e
cu
r
v
e
v
alu
e
a
s
1
f
o
r
all
1
5
class
es.
R
OC
A
U
C
v
al
u
e
v
ar
ie
s
b
et
w
ee
n
0
an
d
1
,
w
h
ile
1
is
co
n
s
i
d
er
ed
as
a
p
er
f
ec
t
p
er
f
o
r
m
a
n
ce
.
Fig
u
r
e
7
d
ep
icts
t
h
e
P
r
ec
is
io
n
-
r
ec
all
cu
r
v
e
f
o
r
m
u
lti
-
cla
s
s
at
tack
s
.
T
ab
le
6
s
h
o
w
s
th
e
p
r
ec
is
io
n
-
r
ec
all
c
u
r
v
e
s
co
r
es
co
n
ce
r
n
i
n
g
t
h
e
attac
k
n
a
m
e
a
n
d
it
is
o
b
s
er
v
e
d
f
r
o
m
T
ab
le
6
,
th
at
t
h
e
p
r
ec
is
io
n
-
r
ec
all
c
u
r
v
e
s
co
r
e
f
o
r
attac
k
cla
s
s
e
s
8
,
9
an
d
1
3
is
0
.
C
las
s
8
,
9
an
d
r
e
p
r
esen
ts
th
e
attac
k
s
‘
Hea
r
tb
leed
’
,
‘
I
n
f
iltra
tio
n
’
an
d
‘
W
eb
A
ttac
k
Sq
l
i
n
j
ec
tio
n
’
r
esp
ec
tiv
el
y
.
Fro
m
Fi
g
u
r
e
2
,
we
ca
n
s
ee
t
h
at
t
h
es
e
attac
k
t
y
p
es
h
av
e
a
v
er
y
s
m
all
p
er
ce
n
tag
e
co
m
p
ar
ed
to
o
th
er
attac
k
t
y
p
es.
T
h
is
class
i
m
b
a
lan
ce
p
r
o
b
lem
an
d
a
s
m
a
ll
n
u
m
b
er
o
f
a
ttack
in
s
ta
n
ce
s
ar
e
t
h
e
r
ea
s
o
n
w
h
y
t
h
e
m
o
d
el
ca
n
n
o
t
g
i
v
e
t
h
e
p
r
ec
is
io
n
-
r
ec
all
c
u
r
v
e
s
co
r
e
f
o
r
th
o
s
e
s
p
ec
if
ic
attac
k
t
y
p
e
s
.
P
er
ce
n
tag
e
an
d
p
r
ec
is
io
n
-
r
ec
all
cu
r
v
e
s
co
r
es
f
o
r
o
th
er
W
eb
attac
k
s
ar
e
also
r
elativ
el
y
lo
w
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
0
8
8
-
8708
I
n
t J
E
lec
&
C
o
m
p
E
n
g
,
Vo
l.
10
,
No
.
5
,
Octo
b
e
r
2
0
2
0
:
5
5
1
4
-
5525
5522
Fig
u
r
e
6
.
R
OC
f
o
r
m
u
lti
-
clas
s
i
f
icatio
n
Fig
u
r
e
7
.
T
h
e
p
r
ec
is
io
n
-
r
ec
all
cu
r
v
e
f
o
r
m
u
lti
-
clas
s
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J
E
lec
&
C
o
m
p
E
n
g
I
SS
N:
2
0
8
8
-
8708
A
n
in
tr
u
s
io
n
d
etec
tio
n
s
ystem
fo
r
p
a
ck
et
a
n
d
flo
w
b
a
s
ed
n
et
w
o
r
ks u
s
in
g
d
ee
p
n
eu
r
a
l
.
.
.
(
K
a
n
iz
F
a
r
h
a
n
a
)
5523
T
ab
le
6
.
T
est
r
esu
lt 3
C
l
a
ss
n
a
me
P
r
e
c
i
si
o
n
-
r
e
c
a
l
l
c
u
r
v
e
sco
r
e
B
e
n
i
g
n
(
C
l
a
ss
0
)
1
B
o
t
(
C
l
a
ss
1)
0
.
5
4
D
D
o
S
(
C
l
a
ss 2
)
1
D
o
S
G
o
l
d
e
n
e
y
e
(
C
l
a
ss 3
)
0
.
9
9
D
o
S
H
u
l
k
(
C
l
a
ss
4
)
1
D
o
S
S
l
o
w
h
t
t
p
t
e
st
(
C
l
a
ss
5
)
0
.
8
2
D
o
S
S
l
o
w
l
o
r
i
s (Cl
a
ss 6
)
0
.
9
7
F
T
P
-
P
a
t
a
t
o
r
(
C
l
a
ss
7
)
0
.
9
9
H
e
a
r
t
b
l
e
e
d
(
C
l
a
ss 8
)
0
I
n
f
i
l
t
r
a
t
i
o
n
(
C
l
a
ss
9
)
0
P
o
r
t
S
c
a
n
(
C
l
a
ss
1
0
)
0
.
6
9
SSH
-
P
a
t
a
t
o
r
(
C
l
a
ss
1
1
)
0
.
9
4
W
e
b
A
t
t
a
c
k
B
r
u
t
e
F
o
r
c
e
(
C
l
a
ss 1
2
)
0
.
2
4
W
e
b
A
t
t
a
c
k
S
q
l
I
n
j
e
c
t
i
o
n
(
C
l
a
ss
1
3
)
0
W
e
b
A
t
t
a
c
k
X
S
S
(
C
l
a
ss
1
4
)
0
.
1
9
Fig
u
r
e
8
s
h
o
w
s
th
e
av
er
a
g
e
r
etu
r
n
ed
f
o
r
th
e
p
r
ec
is
io
n
-
r
ec
all
cu
r
v
e
s
co
r
e
as
1
.
C
I
C
I
DS2
0
1
7
is
o
n
e
o
f
th
e
i
n
cl
u
s
i
v
e
d
ata
s
et
u
s
ed
in
l
iter
atu
r
e.
Fro
m
T
ab
le
4
w
e
h
a
v
e
s
ee
n
t
h
at
t
h
e
ac
c
u
r
ac
y
o
f
th
e
m
o
d
el
f
o
r
b
in
ar
y
an
d
m
u
lti
-
clas
s
clas
s
if
icatio
n
is
r
elativ
el
y
b
etter
in
co
n
tr
a
s
t
w
it
h
th
e
s
t
u
d
ies
[
1
6
,
1
7
]
t
h
at
u
s
ed
th
e
s
a
m
e
d
ataset
f
o
r
d
ee
p
n
eu
r
al
n
et
w
o
r
k
s
.
T
ab
le
7
s
h
o
w
s
a
p
er
f
o
r
m
a
n
ce
co
m
p
ar
is
o
n
b
et
w
ee
n
th
e
p
r
o
p
o
s
ed
m
o
d
el
an
d
o
th
er
s
tu
d
ie
s
.
I
t
is
also
v
i
s
ib
le
t
h
at
f
ea
tu
r
e
s
elec
tio
n
a
n
d
d
ata
-
p
r
ep
r
o
ce
s
s
in
g
e
f
f
ec
t
s
th
e
p
er
f
o
r
m
an
ce
o
f
m
o
d
el
s
u
s
ed
in
t
h
e
clas
s
i
f
icatio
n
.
I
n
th
is
s
tu
d
y
,
t
h
e
s
elec
ted
f
ea
t
u
r
es
an
d
d
ata
-
p
r
ep
r
o
ce
s
s
in
g
r
esu
lt
s
o
v
er
a
9
9
%
ac
cu
r
ac
y
r
ate
th
at
m
ak
e
s
th
e
DNN
m
o
d
el
b
etter
th
an
th
e
p
r
ev
io
u
s
l
y
m
en
tio
n
ed
s
t
u
d
ies
[
1
6
,
1
7
]
o
f
th
e
DNN
m
o
d
el.
Fig
u
r
e
8
.
Av
er
ag
ed
p
r
ec
is
io
n
-
r
ec
all
cu
r
v
e
f
o
r
m
u
l
ti
-
c
lass
T
ab
le
7
.
C
o
m
p
ar
is
o
n
T
h
e
p
r
o
p
o
se
d
me
t
h
o
d
T
h
e
st
u
d
y
[
1
6
]
T
h
e
st
u
d
y
[
1
7
]
B
i
n
a
r
y
C
l
a
ssi
f
i
c
a
t
i
o
n
M
u
l
t
i
-
c
l
a
ss
C
l
a
ssi
f
i
c
a
t
i
o
n
B
i
n
a
r
y
C
l
a
ssi
f
i
c
a
t
i
o
n
M
u
l
t
i
-
c
l
a
ss
C
l
a
ssi
f
i
c
a
t
i
o
n
A
l
l
f
e
a
t
u
r
e
s
1
0
f
e
a
t
u
r
e
s
2
0
f
e
a
t
u
r
e
s
3
0
f
e
a
t
u
r
e
s
A
c
c
u
r
a
c
y
9
9
.
1
3
%
9
9
.
2
9
%
8
9
%
9
8
.
4
0
%
9
4
.
7
2
%
9
5
.
9
2
%
9
6
.
7
1
%
6.
CO
NCLU
SI
O
N
An
I
DS
m
o
d
el
is
p
r
o
p
o
s
ed
in
th
is
s
t
u
d
y
u
s
i
n
g
Dee
p
n
eu
r
al
n
et
w
o
r
k
s
an
d
t
h
e
m
o
d
el
is
tr
ain
ed
an
d
test
ed
o
n
th
e
C
I
C
I
DS2
0
1
7
d
ataset,
co
n
ta
in
s
r
ea
l
n
et
w
o
r
k
tr
af
f
ic
d
ata.
T
h
e
h
u
g
e
s
ize
o
f
t
h
e
d
ataset
w
as
a
ch
alle
n
g
e
to
h
a
n
d
le.
L
ab
el
E
n
co
d
in
g
is
p
er
f
o
r
m
ed
o
n
t
h
e
d
ata
p
r
ep
r
o
ce
s
s
in
g
s
tag
e
to
en
s
u
r
e
th
a
t
t
h
e
m
o
d
el
d
o
es
n
o
t
s
h
o
w
b
ia
s
n
e
s
s
f
o
r
an
y
attac
k
cla
s
s
e
s
.
T
h
e
d
ee
p
n
e
u
r
al
n
et
w
o
r
k
is
u
s
ed
s
o
t
h
at
t
h
e
d
ata
s
et
ca
n
p
r
o
d
u
ce
r
esu
lts
w
it
h
g
o
o
d
ac
cu
r
ac
y
a
n
d
s
p
ee
d
.
I
n
th
i
s
s
tu
d
y
,
t
h
e
p
r
o
p
o
s
ed
n
eu
r
al
n
e
t
w
o
r
k
m
o
d
el
g
iv
e
s
Evaluation Warning : The document was created with Spire.PDF for Python.