I
nte
rna
t
io
na
l J
o
urna
l o
f
E
lect
rica
l a
nd
Co
m
p
ute
r
E
ng
in
ee
ring
(
I
J
E
CE
)
Vo
l.
11
,
No
.
3
,
J
u
n
e
2
0
2
1
,
p
p
.
2
3
6
0
~
2
3
7
0
I
SS
N:
2
0
8
8
-
8708
,
DOI
: 1
0
.
1
1
5
9
1
/
i
j
ec
e
.
v
1
1
i
3
.
p
p
2
3
6
0
-
2
3
7
0
2360
J
o
ur
na
l ho
m
ep
a
g
e
:
h
ttp
:
//ij
ec
e.
ia
esco
r
e.
co
m
O
pti
m
i
z
a
tion o
f
n
etw
o
rk
t
ra
ff
i
c an
o
m
a
ly
det
e
ction u
sing
m
a
chine
learning
Cho
Do
Xua
n
1
,
H
o
a
ng
T
ha
nh
2
,
Ng
uy
en
T
un
g
L
a
m
3
1
In
f
o
rm
a
ti
o
n
S
e
c
u
ri
ty
De
p
ar
t
m
e
n
t,
P
o
sts a
n
d
T
e
lec
o
m
m
u
n
ica
ti
o
n
s
In
stit
u
t
e
o
f
T
e
c
h
n
o
lo
g
y
,
Ha
n
o
i,
Vie
tn
a
m
2
Dig
it
a
l
M
a
rk
e
ti
n
g
,
F
P
T
Un
iv
e
rsity
,
Ha
n
o
i,
V
iet
n
a
m
3
In
f
o
rm
a
ti
o
n
A
ss
u
ra
n
c
e
De
p
a
rt
m
e
n
t
,
F
P
T
Un
iv
e
rsity
,
Ha
n
o
i,
V
ietn
a
m
Art
icle
I
nfo
AB
ST
RAC
T
A
r
ticle
his
to
r
y:
R
ec
eiv
ed
Sep
6
,
2
0
2
0
R
ev
i
s
ed
D
ec
9
,
2
0
2
0
A
cc
ep
ted
Dec
1
5
,
2
0
2
0
In
th
is
p
a
p
e
r,
to
o
p
ti
m
ize
th
e
p
ro
c
e
ss
o
f
d
e
tec
ti
n
g
c
y
b
e
r
-
a
tt
a
c
k
s,
w
e
c
h
o
o
se
to
p
ro
p
o
se
2
m
a
in
o
p
t
im
iza
ti
o
n
so
lu
ti
o
n
s:
Op
ti
m
izin
g
th
e
d
e
tec
ti
o
n
m
e
th
o
d
a
n
d
o
p
ti
m
izin
g
f
e
a
tu
re
s.
Bo
th
o
f
th
e
s
e
tw
o
o
p
ti
m
iza
ti
o
n
so
lu
ti
o
n
s
a
re
to
e
n
su
re
th
e
a
im
is
to
in
c
re
a
se
a
c
c
u
ra
c
y
a
n
d
re
d
u
c
e
t
h
e
ti
m
e
f
o
r
a
n
a
l
y
sis
a
n
d
d
e
tec
ti
o
n
.
A
c
c
o
rd
in
g
ly
,
f
o
r
th
e
d
e
tec
ti
o
n
m
e
th
o
d
,
w
e
re
c
o
m
m
e
n
d
u
sin
g
th
e
Ra
n
d
o
m
F
o
re
st
su
p
e
rv
ise
d
c
las
sifica
ti
o
n
a
lg
o
rit
h
m
.
T
h
e
e
x
p
e
ri
m
e
n
tal
re
su
lt
s
in
se
c
ti
o
n
4
.
1
h
a
v
e
p
ro
v
e
n
th
a
t
o
u
r
p
ro
p
o
sa
l
th
a
t
u
se
th
e
Ra
n
d
o
m
F
o
re
st
a
lg
o
rit
h
m
f
o
r
a
b
n
o
rm
a
l
b
e
h
a
v
io
r
d
e
tec
ti
o
n
is
c
o
m
p
lete
ly
c
o
rre
c
t
b
e
c
a
u
se
th
e
re
su
lt
s o
f
th
is
a
lg
o
rit
h
m
a
re
m
u
c
h
b
e
tt
e
r
th
a
n
so
m
e
o
th
e
r
d
e
tec
ti
o
n
a
lg
o
rit
h
m
s
o
n
a
ll
m
e
a
su
re
s.
F
o
r
th
e
f
e
a
tu
re
o
p
ti
m
iza
ti
o
n
so
lu
ti
o
n
,
w
e
p
ro
p
o
se
to
u
se
so
m
e
d
a
ta
d
i
m
e
n
sio
n
a
l
re
d
u
c
ti
o
n
tec
h
n
iq
u
e
s
su
c
h
a
s
in
f
o
rm
a
ti
o
n
g
a
in
,
p
rin
c
i
p
a
l
c
o
m
p
o
n
e
n
t
a
n
a
ly
sis
,
a
n
d
c
o
rre
latio
n
c
o
e
f
f
icie
n
t
m
e
th
o
d
.
T
h
e
re
su
lt
s
o
f
th
e
re
se
a
r
c
h
p
ro
p
o
se
d
in
o
u
r
p
a
p
e
r
h
a
v
e
p
ro
v
e
n
th
a
t
to
o
p
ti
m
ize
th
e
c
y
b
e
r
-
a
tt
a
c
k
d
e
tec
ti
o
n
p
r
o
c
e
ss
,
it
is
n
o
t
n
e
c
e
ss
a
r
y
to
u
se
a
d
v
a
n
c
e
d
a
lg
o
r
it
h
m
s
w
it
h
c
o
m
p
lex
a
n
d
c
u
m
b
e
rso
m
e
c
o
m
p
u
tatio
n
a
l
re
q
u
irem
e
n
ts,
it
m
u
st d
e
p
e
n
d
o
n
th
e
m
o
n
it
o
rin
g
d
a
ta
f
o
r
se
le
c
ti
n
g
th
e
re
a
so
n
a
b
le
fe
a
tu
re
e
x
tra
c
ti
o
n
a
n
d
o
p
ti
m
iza
ti
o
n
a
lg
o
rit
h
m
a
s
we
ll
a
s
th
e
a
p
p
ro
p
riate
a
tt
a
c
k
c
la
ss
i
f
ica
ti
o
n
a
n
d
d
e
tec
ti
o
n
a
lg
o
ri
th
m
s
.
K
ey
w
o
r
d
s
:
Featu
r
e
o
p
ti
m
izat
io
n
Ma
ch
i
n
e
lear
n
i
n
g
Net
w
o
r
k
tr
af
f
ic
Net
w
o
r
k
tr
af
f
ic
an
o
m
al
y
d
etec
tio
n
Op
ti
m
izatio
n
T
h
is
is
a
n
o
p
e
n
a
c
c
e
ss
a
rticle
u
n
d
e
r th
e
CC B
Y
-
SA
li
c
e
n
se
.
C
o
r
r
e
s
p
o
nd
ing
A
uth
o
r
:
C
h
o
Do
Xu
a
n
Dep
ar
t
m
en
t o
f
I
n
f
o
r
m
atio
n
Se
cu
r
it
y
P
o
s
ts
an
d
T
elec
o
m
m
u
n
icatio
n
s
I
n
s
ti
tu
te
o
f
T
ec
h
n
o
lo
g
y
122
Ho
an
g
Qu
o
c
Viet,
C
a
u
Gi
a
y
Dis
tr
ict,
Ha
n
o
i,
Viet
n
a
m
E
m
ail:
c
h
o
d
x
@
p
ti
t.e
d
u
.
v
n
1.
I
NT
RO
D
UCT
I
O
N
T
h
e
cy
b
er
-
a
ttack
is
a
f
o
r
m
o
f
d
an
g
er
o
u
s
a
ttack
th
at
h
a
s
i
n
cr
ea
s
ed
r
ap
id
l
y
i
n
b
o
th
t
h
e
n
u
m
b
er
o
f
r
ec
o
r
d
e
d
attac
k
s
an
d
th
e
ex
ten
t
o
f
th
eir
d
a
m
a
g
e
to
o
r
g
an
iza
ti
o
n
s
a
n
d
b
u
s
i
n
ess
e
s
.
T
h
e
r
esea
r
ch
[
1
-
3
]
clas
s
i
f
ied
c
y
b
er
-
attac
k
tech
n
iq
u
es
i
n
to
t
w
o
m
a
in
m
et
h
o
d
s
:
P
a
s
s
iv
e
attac
k
an
d
ac
ti
v
e
attac
k
.
A
cc
o
r
d
in
g
to
th
e
r
ep
o
r
t
[
4
]
,
in
2
0
1
9
,
cy
b
er
-
a
ttack
tec
h
n
iq
u
e
s
ar
e
co
n
s
id
e
r
ed
as
th
e
to
p
o
f
t
h
e
m
o
s
t
d
an
g
er
o
u
s
attac
k
tech
n
iq
u
es.
Fro
m
t
h
e
s
tati
s
tic
s
ab
o
u
t
s
ec
u
r
it
y
v
u
l
n
er
ab
ilit
i
es
[
5
]
th
at
ar
e
o
f
ten
ex
p
lo
ite
d
in
th
e
s
y
s
te
m
b
y
attac
k
er
s
,
w
e
ca
n
s
ee
th
e
lev
e
l
an
d
t
h
e
d
a
n
g
er
o
f
c
u
r
r
en
t
c
y
b
er
-
attac
k
s
f
o
r
o
r
g
a
n
izatio
n
s
,
g
o
v
er
n
m
e
n
t
s
,
an
d
b
u
s
i
n
ess
e
s
.
T
h
er
ef
o
r
e,
t
h
e
p
r
o
b
le
m
o
f
d
etec
ti
n
g
a
n
d
ea
r
l
y
w
ar
n
in
g
s
i
g
n
s
o
f
c
y
b
er
-
attac
k
ca
m
p
ai
g
n
s
is
v
er
y
n
ec
es
s
ar
y
to
d
a
y
.
T
h
e
s
tu
d
ies
[
2
,
3
]
p
r
esen
ted
th
e
d
if
f
er
en
ce
b
et
w
ee
n
c
y
b
er
-
attac
k
an
d
o
th
er
attac
k
tech
n
i
q
u
es,
th
u
s
m
ak
in
g
t
h
e
d
etec
tio
n
a
n
d
th
e
w
ar
n
in
g
o
f
th
is
attac
k
h
av
e
m
an
y
d
i
f
f
icu
l
ties
.
C
u
r
r
en
tl
y
,
t
h
er
e
ar
e
t
w
o
m
ai
n
m
et
h
o
d
s
f
o
r
d
etec
ti
n
g
c
y
b
er
-
attac
k
s
:
s
i
g
n
a
tu
r
e
-
b
ase
d
m
et
h
o
d
th
r
o
u
g
h
t
h
e
r
u
le
s
ets,
a
n
d
an
o
m
al
y
-
b
ased
m
et
h
o
d
b
ased
o
n
d
ata
an
al
y
s
i
s
an
d
s
ta
tis
tic
s
to
f
in
d
o
u
t
ab
n
o
r
m
al
c
h
ar
ac
ter
is
t
ics
i
n
t
h
e
n
e
t
w
o
r
k
[1
-
3
,
6
]
.
T
h
e
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J
E
lec
&
C
o
m
p
E
n
g
I
SS
N:
2
0
8
8
-
8708
Op
timiz
a
tio
n
o
f n
etw
o
r
k
tr
a
ffi
c
a
n
o
ma
ly
d
etec
tio
n
u
s
in
g
ma
ch
in
e
lea
r
n
in
g
(
C
h
o
Do
X
u
a
n
)
2361
s
ig
n
at
u
r
e
-
b
ased
m
et
h
o
d
h
a
s
th
e
ab
ilit
y
to
d
etec
t
q
u
ick
l
y
an
d
ac
c
u
r
atel
y
b
u
t
ca
n
n
o
t
d
etec
t
n
e
w
a
ttac
k
tech
n
iq
u
es
[
1
]
.
T
h
e
an
o
m
al
y
-
b
ased
m
et
h
o
d
is
n
o
t
o
n
l
y
c
ap
ab
le
o
f
d
etec
tin
g
attac
k
s
b
u
t
also
ca
p
ab
le
o
f
d
etec
tin
g
ab
n
o
r
m
al
b
eh
a
v
io
r
s
,
b
u
t
t
h
is
m
et
h
o
d
r
eq
u
ir
es
co
m
p
lex
ca
lcu
la
tio
n
a
n
d
p
r
o
ce
s
s
in
g
,
a
n
d
h
a
s
lo
w
ac
cu
r
ac
y
.
T
h
e
an
o
m
al
y
-
b
a
s
ed
m
et
h
o
d
is
u
s
u
all
y
b
ased
o
n
t
w
o
m
ai
n
tec
h
n
iq
u
es
t
h
at
ar
e
m
a
ch
in
e
lear
n
i
n
g
a
n
d
d
ee
p
lear
n
in
g
to
clas
s
i
f
y
ab
n
o
r
m
al
an
d
n
o
r
m
al
b
e
h
av
io
r
[
1
,
2
]
.
I
n
th
is
p
ap
er
,
w
e
p
r
o
p
o
s
e
a
c
y
b
er
-
at
tack
d
etec
tio
n
m
et
h
o
d
u
s
i
n
g
t
h
e
r
an
d
o
m
f
o
r
est
(
R
F)
m
ac
h
i
n
e
l
ea
r
n
in
g
alg
o
r
it
h
m
.
T
h
e
R
F
a
lg
o
r
ith
m
h
a
s
b
ee
n
p
r
o
v
ed
as
th
e
cu
r
r
e
n
t
b
est
al
g
o
r
ith
m
f
o
r
class
i
f
icatio
n
b
y
s
tu
d
ie
s
[
1
,
3
,
6
-
8
]
.
T
h
e
s
tu
d
y
[
1
,
2
]
lis
ted
an
d
an
al
y
ze
d
s
o
m
e
d
ata
s
ets
co
m
m
o
n
l
y
u
s
ed
f
o
r
c
y
b
er
-
at
tack
d
etec
tio
n
s
u
ch
as
D
AR
P
A
/K
DD
C
u
p
9
9
,
C
A
I
D
A
,
NSL
-
K
DD,
I
SC
X
2
0
1
2
,
UNSW
-
NB
1
5
,
etc.
I
n
th
es
e
d
atasets
,
th
e
U
NSW
-
NB
1
5
d
at
a
s
et
is
b
u
ilt
a
n
d
d
ev
elo
p
ed
r
elativ
el
y
in
ac
co
r
d
an
ce
w
it
h
r
ea
l
n
et
w
o
r
k
s
y
s
te
m
s
[
1
,
9
]
.
T
h
er
ef
o
r
e,
in
t
h
i
s
p
ap
er
,
w
e
w
i
ll
u
s
e
t
h
e
UNSW
-
NB
1
5
d
ataset
to
ex
p
er
i
m
e
n
t
w
it
h
c
y
b
er
-
a
ttack
d
etec
t
io
n
m
et
h
o
d
s
.
As p
r
esen
ted
ab
o
v
e,
in
o
r
d
er
to
o
p
tim
ize
t
h
e
p
r
o
ce
s
s
o
f
d
ete
ctin
g
an
d
aler
ti
n
g
c
y
b
er
-
attac
k
s
b
ased
o
n
m
ac
h
in
e
lear
n
i
n
g
tech
n
iq
u
e
s
,
r
ec
en
t
s
t
u
d
ies
a
n
d
r
ec
o
m
m
en
d
atio
n
s
o
f
te
n
atte
m
p
t
to
f
in
d
n
e
w
d
etec
t
io
n
m
et
h
o
d
s
an
d
tec
h
n
iq
u
es.
Ho
w
e
v
er
,
w
e
r
ec
o
g
n
ize
t
h
at
t
h
e
n
e
w
ap
p
r
o
ac
h
es
ar
e
u
s
u
all
y
o
n
l
y
s
u
itab
le
f
o
r
ex
is
t
in
g
d
ataset
s
,
w
h
e
n
t
h
e
y
ar
e
ap
p
lied
in
p
r
ac
tice,
th
ey
o
f
te
n
d
o
n
'
t
b
r
in
g
h
ig
h
e
f
f
icien
c
y
d
u
e
to
th
e
in
co
m
p
atib
ili
t
y
o
f
m
o
d
el
b
u
i
l
d
in
g
d
ata
s
et
s
w
ith
m
o
n
i
to
r
in
g
d
atasets
.
T
h
er
ef
o
r
e,
in
o
u
r
p
o
in
t
o
f
v
ie
w
,
in
s
tead
o
f
tr
y
i
n
g
to
lear
n
o
r
d
e
v
elo
p
n
e
w
d
etec
tio
n
m
e
th
o
d
s
,
w
e
l
o
o
k
f
o
r
w
a
y
s
to
an
al
y
ze
a
n
d
b
u
ild
ex
p
er
i
m
e
n
tal
d
atasets
s
o
th
at
t
h
e
y
ar
e
m
o
s
t
s
u
itab
le
f
o
r
r
ea
l
n
et
w
o
r
k
m
o
n
i
to
r
in
g
s
y
s
te
m
s
.
I
n
th
i
s
p
ap
er
,
i
n
o
r
d
er
to
o
p
tim
ize
th
e
ab
n
o
r
m
al
d
etec
tio
n
p
r
o
ce
s
s
b
ased
o
n
t
h
e
UN
SW
-
NB
1
5
d
ataset,
w
e
p
r
o
p
o
s
e
m
et
h
o
d
s
o
f
e
v
al
u
ati
n
g
a
n
d
s
elec
ti
n
g
n
e
w
f
ea
tu
r
e
s
.
T
h
e
m
eth
o
d
s
th
at
w
e
p
r
o
p
o
s
e
to
u
s
e
in
t
h
is
p
ap
er
in
cl
u
d
e
in
f
o
r
m
a
tio
n
g
ai
n
,
p
r
in
cip
al
co
m
p
o
n
e
n
t a
n
al
y
s
i
s
,
an
d
co
r
r
elatio
n
co
ef
f
icie
n
t
m
eth
o
d
.
Ou
r
r
esear
ch
is
p
r
ese
n
ted
as
f
o
llo
w
s
:
th
e
u
r
g
en
c
y
o
f
th
e
r
es
ea
r
ch
p
r
o
b
lem
is
p
r
ese
n
ted
in
s
ec
tio
n
1
.
I
n
s
ec
tio
n
2
,
w
e
p
r
ese
n
t
t
h
e
p
r
o
ce
s
s
o
f
r
esear
ch
in
g
,
s
u
r
v
e
y
i
n
g
,
a
n
d
ev
al
u
ati
n
g
r
elate
d
w
o
r
k
s
.
T
h
e
alg
o
r
it
h
m
s
r
elate
d
to
th
e
p
r
o
b
lem
o
f
cla
s
s
i
f
y
in
g
attac
k
an
d
r
ed
u
ci
n
g
f
ea
t
u
r
e
d
i
m
e
n
s
io
n
s
ar
e
p
r
esen
ted
in
s
ec
ti
o
n
3
.
Sectio
n
4
p
r
esen
t
s
th
e
r
es
u
lt
s
o
f
th
e
e
x
p
er
i
m
e
n
tal
p
r
o
ce
s
s
.
A
cc
o
r
d
in
g
l
y
,
s
ec
tio
n
4
.
1
is
th
e
e
x
p
er
i
m
e
n
tal
p
r
o
ce
s
s
o
f
d
etec
tin
g
c
y
b
er
-
att
ac
k
s
,
i
n
w
h
ich
w
e
ev
al
u
ate
a
n
d
co
m
p
ar
e
o
u
r
p
r
o
p
o
s
ed
m
et
h
o
d
w
ith
s
o
m
e
o
t
h
er
s
tu
d
ie
s
.
T
h
e
r
esu
lts
o
f
th
e
p
r
o
ce
s
s
o
f
e
v
alu
at
in
g
an
d
co
m
p
ar
i
n
g
th
e
ef
f
icie
n
c
y
o
f
th
e
f
ea
tu
r
e
d
i
m
e
n
s
io
n
r
ed
u
ctio
n
m
et
h
o
d
ar
e
p
r
esen
ted
in
s
ec
tio
n
4
.
2
.
C
o
n
clu
s
io
n
an
d
ev
alu
atio
n
ar
e
p
r
esen
ted
in
s
ec
tio
n
5
.
T
h
e
p
r
ac
tical
s
ig
n
i
f
ican
ce
a
n
d
s
cie
n
ti
f
icit
y
o
f
o
u
r
p
ap
er
in
clu
d
e:
-
A
p
p
l
y
R
F
m
ac
h
in
e
lear
n
i
n
g
alg
o
r
ith
m
a
n
d
UNSW
-
NB
1
5
d
ataset
to
d
etec
t
ab
n
o
r
m
al
b
eh
av
io
r
in
t
h
e
n
et
w
o
r
k
.
I
n
th
e
s
tu
d
ie
s
th
at
w
e
s
u
r
v
e
y
ed
(
s
ee
Sectio
n
2
.
1
)
,
th
e
au
th
o
r
s
u
s
ed
d
if
f
er
e
n
t
m
ac
h
in
e
lear
n
in
g
m
et
h
o
d
s
to
co
m
p
ar
e
an
d
ev
al
u
ate
t
h
e
ef
f
ec
ti
v
e
n
es
s
o
f
ea
c
h
alg
o
r
ith
m
.
Ho
w
e
v
er
,
n
o
r
ese
ar
ch
h
a
s
ap
p
lied
th
e
R
F
al
g
o
r
ith
m
to
d
etec
t
a
n
o
m
alie
s
b
ased
o
n
th
e
UNS
W
-
NB
1
5
d
ata
s
et,
alth
o
u
g
h
t
h
is
a
lg
o
r
it
h
m
h
a
s
b
ee
n
i
n
d
icate
d
as
th
e
c
u
r
r
en
t
b
est
al
g
o
r
ith
m
f
o
r
clas
s
i
f
icati
o
n
b
y
s
o
m
e
s
tu
d
ie
s
.
O
u
r
e
x
p
er
i
m
en
tal
r
es
u
lt
s
p
r
esen
ted
in
s
ec
tio
n
4
.
1
p
r
o
v
e
th
e
e
f
f
ec
ti
v
en
e
s
s
o
f
R
F
al
g
o
r
ith
m
in
d
etec
t
in
g
a
n
o
m
al
ie
s
an
d
s
h
o
w
t
h
at
w
h
e
n
b
u
ild
i
n
g
ab
n
o
r
m
al
d
etec
tio
n
s
y
s
te
m
s
,
it
i
s
n
o
t
n
e
ce
s
s
ar
y
to
s
et
u
p
alg
o
r
it
h
m
s
th
at
ar
e
to
o
cu
m
b
er
s
o
m
e
an
d
co
m
p
licated
.
I
n
ad
d
itio
n
,
b
ased
o
n
th
e
r
esu
lts
o
f
o
u
r
p
r
o
p
o
s
ed
ex
p
er
im
en
ta
l
s
ce
n
ar
io
s
,
w
e
h
a
v
e
s
h
o
w
n
t
h
e
o
p
tio
n
s
f
o
r
s
elec
tin
g
t
h
e
d
ataset
an
d
p
ar
a
m
eter
s
o
f
t
h
e
alg
o
r
it
h
m
s
o
th
at
th
e
y
ar
e
i
n
co
m
p
lia
n
ce
w
it
h
t
h
e
d
etec
tio
n
m
o
d
el.
-
P
r
o
p
o
s
in
g
m
e
th
o
d
s
o
f
ev
a
l
u
at
in
g
a
n
d
s
elec
ti
n
g
f
ea
tu
r
e
s
.
I
n
th
is
p
ap
er
,
w
e
p
r
o
p
o
s
e
to
u
s
e
s
o
m
e
m
et
h
o
d
s
an
d
tech
n
iq
u
es
i
n
o
r
d
er
to
ev
alu
ate
an
d
s
elec
t
th
e
b
est
f
ea
t
u
r
es.
I
n
ad
d
itio
n
,
w
e
w
il
l
r
ea
s
s
e
s
s
th
e
d
etec
tio
n
m
o
d
el
b
ased
o
n
t
h
e
s
elec
ted
f
ea
tu
r
es
w
i
th
t
w
o
cr
iter
ia:
ac
c
u
r
ac
y
a
n
d
p
r
o
ce
s
s
i
n
g
ti
m
e.
T
h
e
r
es
u
lts
o
f
th
e
r
esear
ch
an
d
e
v
al
u
atio
n
i
n
s
ec
tio
n
4
.
2
ar
e
d
ev
elo
p
m
e
n
t
s
an
d
s
u
p
p
le
m
en
ts
to
t
h
e
s
h
o
r
t
co
m
in
g
s
o
f
t
h
e
s
tu
d
ie
s
p
r
esen
ted
in
s
ec
tio
n
2
.
2
.
2.
RE
L
AT
E
D
WO
RK
2
.
1
.
Cy
ber
-
a
t
t
a
c
k
s
det
ec
t
io
n ba
s
ed
o
n UN
SW
-
NB
1
5
da
t
a
s
et
I
n
th
e
s
t
u
d
y
[
10
]
,
Ku
m
ar
et
a
l.
p
r
o
p
o
s
ed
a
m
et
h
o
d
to
cla
s
s
i
f
y
c
y
b
er
-
attac
k
tech
n
iq
u
es
b
ased
o
n
UNSW
-
NB
1
5
b
y
u
s
i
n
g
d
if
f
er
en
t
r
u
le
s
et
s
.
Ho
w
e
v
er
,
in
th
i
s
s
tu
d
y
,
b
u
ild
i
n
g
a
n
d
ap
p
l
y
in
g
th
e
r
u
le
s
et
w
ill
b
e
li
m
ited
b
ec
au
s
e
t
h
e
co
v
er
ag
e
an
d
th
e
n
u
m
b
er
o
f
r
u
le
s
ets
ar
e
n
o
t
lar
g
e
e
n
o
u
g
h
.
Mo
u
s
ta
f
a
et
a
l.
[
11
]
p
r
o
p
o
s
ed
th
e
g
eo
m
etr
ic
ar
ea
an
al
y
s
is
tech
n
iq
u
e
to
d
etec
t
cy
b
er
-
a
tt
ac
k
s
b
y
u
s
i
n
g
tr
ap
ez
o
id
al
ar
ea
esti
m
atio
n
.
T
o
ev
alu
a
te
t
h
e
ef
f
ec
t
iv
e
n
es
s
o
f
t
h
e
p
r
o
p
o
s
ed
m
et
h
o
d
,
th
e
a
u
t
h
o
r
s
co
n
d
u
cted
ex
p
er
i
m
en
ts
o
n
UNSW
-
NB
1
5
an
d
NSL
-
K
DD
d
ataset
s
.
E
x
p
er
i
m
en
tal
r
es
u
lt
s
i
n
t
h
e
s
tu
d
y
s
h
o
w
ed
t
h
e
s
u
p
er
io
r
it
y
o
f
t
h
e
U
NSW
-
NB
1
5
d
ataset
o
v
er
th
e
NS
L
-
KDD
d
ataset.
B
esid
es,
r
esear
ch
[
1
2
]
p
r
esen
ts
a
tech
n
iq
u
e
f
o
r
b
u
ild
in
g
a
n
ef
f
ec
ti
v
e
an
o
m
al
y
d
etec
tio
n
s
y
s
te
m
b
a
s
ed
o
n
tw
o
d
atasets
:
th
e
NS
L
-
KD
D
an
d
UNSW
-
NB
1
5
.
T
h
is
tech
n
iq
u
e
r
eq
u
ir
es
t
h
r
ee
m
o
d
u
les
:
ca
p
tu
r
in
g
a
n
d
lo
g
g
i
n
g
m
o
d
u
le,
p
r
e
-
p
r
o
ce
s
s
i
n
g
m
o
d
u
le,
an
d
th
e
Dir
ich
let
m
i
x
t
u
r
e
m
o
d
el
th
at
i
s
a
n
o
v
el
s
tati
s
tical
d
ec
is
io
n
en
g
i
n
e
b
ased
o
n
an
o
m
al
y
d
etec
tio
n
tec
h
n
iq
u
e.
T
h
e
f
ir
s
t
m
o
d
u
le
s
ca
n
s
a
n
d
g
a
th
er
s
n
et
w
o
r
k
d
ata.
T
h
en
t
h
e
s
ec
o
n
d
m
o
d
u
le
an
al
y
ze
s
a
n
d
f
ilter
s
th
ese
d
ata
i
n
o
r
d
er
to
im
p
r
o
v
e
th
e
e
f
f
icie
n
c
y
o
f
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
0
8
8
-
8708
I
n
t J
E
lec
&
C
o
m
p
E
n
g
,
Vo
l.
11
,
No
.
3
,
J
u
n
e
2
0
2
1
:
2
3
6
0
-
2370
2362
th
e
d
ec
is
io
n
en
g
i
n
e.
Fin
al
l
y
,
t
h
e
d
ec
is
io
n
en
g
i
n
e
is
b
u
ilt
b
ased
o
n
th
e
Dir
ich
let
m
ix
t
u
r
e
m
o
d
el.
B
ag
u
i
et
a
l.
[1
3
]
p
r
o
p
o
s
ed
th
e
cy
b
er
-
attac
k
s
d
etec
tio
n
m
et
h
o
d
b
ased
o
n
Naïv
e
B
a
y
es,
a
n
d
d
ec
is
io
n
tr
ee
s
(
J
4
8
)
alg
o
r
ith
m
.
I
n
th
eir
e
x
p
er
i
m
e
n
tal
s
ec
tio
n
,
th
e
r
esear
ch
tea
m
[
1
3
]
u
s
ed
th
ese
alg
o
r
it
h
m
s
i
n
t
u
r
n
to
cla
s
s
if
y
d
if
f
er
en
t
c
y
b
er
-
attac
k
co
m
p
o
n
e
n
t
s
i
n
th
e
U
N
SW
-
NB
1
5
d
ataset.
I
n
th
e
s
t
u
d
y
[
1
4
]
,
th
e
au
th
o
r
s
p
r
o
p
o
s
ed
a
m
o
d
el
to
d
etec
t
c
y
b
er
-
attac
k
s
u
s
i
n
g
s
tack
in
g
t
ec
h
n
iq
u
es.
A
cc
o
r
d
in
g
l
y
,
i
n
th
e
tr
ain
in
g
p
r
o
ce
s
s
o
f
th
eir
m
o
d
el,
th
e
au
th
o
r
u
s
e
s
m
ac
h
in
e
lear
n
in
g
al
g
o
r
ith
m
s
co
n
s
is
t
in
g
o
f
K
-
Nea
r
es
t
Neig
h
b
o
r
s
,
Dec
is
io
n
T
r
ee
,
an
d
L
o
g
is
t
ic
R
e
g
r
ess
io
n
i
n
o
r
d
er
to
b
u
ild
a
m
o
d
el
b
ased
o
n
th
e
UN
SW
-
N
B
1
5
an
d
UGR
'
1
6
d
atasets
.
T
h
e
s
t
u
d
y
[
1
5
]
ev
alu
ated
th
e
ef
f
ec
tiv
e
n
e
s
s
o
f
8
m
ac
h
i
n
e
le
ar
n
in
g
a
lg
o
r
it
h
m
s
(
co
n
s
is
tin
g
o
f
2
-
la
y
er
an
d
3
-
la
y
er
al
g
o
r
ith
m
s
)
f
o
r
n
et
w
o
r
k
in
tr
u
s
io
n
d
etec
tio
n
.
T
h
is
is
a
g
o
o
d
id
ea
,
b
u
t
it
r
eq
u
ir
es
th
e
u
s
e
o
f
t
h
e
Mic
r
o
s
o
f
t
A
zu
r
e
Ma
ch
i
n
e
L
ea
r
n
i
n
g
Stu
d
io
s
y
s
te
m
to
ap
p
l
y
in
p
r
ac
tice.
I
n
t
h
i
s
r
esear
c
h
,
w
e
p
r
o
ce
ed
ed
to
d
is
tin
g
u
is
h
b
et
w
ee
n
attac
k
an
d
n
o
r
m
a
l
b
ased
o
n
p
u
r
e
m
ac
h
i
n
e
lear
n
i
n
g
al
g
o
r
ith
m
s
an
d
t
h
e
u
s
e
o
f
A
p
ac
h
e
Sp
ar
k
tech
n
o
lo
g
y
.
O
u
r
r
esu
lt
s
ar
e
s
i
m
ilar
to
th
e
r
es
u
lt
s
o
f
th
e
m
et
h
o
d
th
a
t
au
t
h
o
r
s
[
1
5
]
p
r
o
p
o
s
ed
,
b
u
t
o
u
r
p
er
f
o
r
m
an
ce
an
d
e
x
p
er
i
m
en
tal
co
n
f
i
g
u
r
atio
n
ar
e
m
u
c
h
s
i
m
p
ler
th
a
n
t
h
e
r
ese
ar
ch
[
1
5
]
.
I
n
ad
d
itio
n
,
o
th
er
s
tu
d
ies
al
s
o
p
r
esen
ted
m
eth
o
d
s
to
d
etec
t
attac
k
co
m
p
o
n
e
n
ts
i
n
th
e
n
et
w
o
r
k
u
s
i
n
g
m
ac
h
in
e
lear
n
in
g
alg
o
r
it
h
m
s
.
T
h
e
s
tu
d
y
[1
6
]
p
r
esen
ted
a
m
et
h
o
d
o
f
d
etec
tin
g
DDO
S
attac
k
s
u
s
i
n
g
a
tech
n
iq
u
e
t
h
at
co
m
p
r
eh
e
n
s
iv
e
l
y
s
i
m
u
late
s
DDOS
at
tack
s
.
I
n
th
eir
s
tu
d
y
[
1
7
]
,
Nar
en
d
er
et
a
l.
p
r
o
p
o
s
ed
a
m
et
h
o
d
to
d
etec
t
DDOS
atta
ck
s
u
s
i
n
g
m
ac
h
i
n
e
lear
n
i
n
g
a
lg
o
r
ith
m
s
s
u
c
h
as
L
o
g
is
t
ic
R
eg
r
ess
io
n
,
De
cisi
o
n
T
r
ee
,
an
d
K
-
Nea
r
est
Neig
h
b
o
r
s
.
T
h
is
is
a
r
elativ
el
y
cl
ass
ic
ap
p
r
o
ac
h
.
No
w
ad
a
y
s
,
th
ese
clas
s
i
f
icatio
n
alg
o
r
ith
m
s
ar
e
o
f
ten
n
o
t
as
ef
f
ec
ti
v
e
a
s
t
h
e
RF
alg
o
r
it
h
m
[
7
].
J
af
ar
et
a
l.
[1
8
]
p
r
o
p
o
s
ed
a
m
et
h
o
d
to
cla
s
s
i
f
y
DOS,
P
r
o
b
,
U2
R
,
an
d
L
2
R
attac
k
tec
h
n
i
q
u
e
s
b
y
u
s
i
n
g
s
o
m
e
al
g
o
r
ith
m
s
co
n
s
is
ti
n
g
o
f
Ne
u
r
al
Ne
t
w
o
r
k
,
Gen
etic,
an
d
Dec
is
io
n
T
r
ee
.
Ho
w
e
v
er
,
th
e
ap
p
r
o
ac
h
u
s
in
g
class
i
f
icatio
n
alg
o
r
it
h
m
s
w
it
h
KDD
9
9
d
ataset
in
th
e
s
t
u
d
y
i
s
an
o
ld
o
n
e
b
ec
au
s
e
th
e
cu
r
r
en
t c
y
b
er
-
attac
k
d
ata
is
m
u
ch
m
o
r
e
ab
u
n
d
a
n
t a
n
d
d
iv
er
s
e.
2
.
2
.
T
he
pro
ble
m
o
f
o
pti
m
izing
t
he
a
no
m
a
ly
det
ec
t
io
n
f
ea
t
ure
o
n
t
he
net
w
o
rk
ba
s
ed
o
n
t
he
UNS
W
-
NB
1
5
da
t
a
s
et
I
n
th
e
s
tu
d
y
[
1
9
]
,
th
e
au
th
o
r
p
r
o
p
o
s
ed
u
s
in
g
P
ea
r
s
o
n
'
s
co
r
r
elatio
n
co
ef
f
icien
t
an
d
g
ain
r
atio
tech
n
iq
u
e
to
ev
al
u
ate
f
ea
t
u
r
e
s
.
Ho
w
e
v
er
,
th
e
l
i
m
itatio
n
o
f
th
i
s
s
t
u
d
y
is
t
h
at
t
h
e
au
t
h
o
r
s
d
id
n
'
t
co
n
d
u
ct
ex
p
er
i
m
e
n
ts
to
ev
al
u
ate
th
e
a
cc
u
r
ac
y
o
f
ea
c
h
m
et
h
o
d
o
f
f
e
atu
r
e
d
i
m
e
n
s
io
n
r
ed
u
c
tio
n
.
I
n
th
i
s
p
ap
er
,
w
e
w
ill
n
o
t
o
n
l
y
ev
a
lu
ate
f
ea
tu
r
e
s
to
s
elec
t
i
m
p
o
r
tan
t
f
ea
tu
r
e
s
b
u
t
also
ev
alu
ate
t
h
e
an
o
m
a
l
y
d
et
e
ctio
n
m
o
d
el
b
ased
o
n
t
h
e
f
ea
t
u
r
e
e
v
alu
a
tio
n
p
r
o
ce
s
s
.
T
h
e
s
tu
d
y
[
20
]
p
r
o
p
o
s
ed
th
e
I
n
f
o
r
m
atio
n
g
a
in
m
e
th
o
d
t
o
r
ed
u
ce
t
h
e
f
ea
t
u
r
e
d
i
m
en
s
io
n
i
n
th
e
tr
ain
in
g
p
r
o
ce
s
s
o
f
th
e
b
o
tn
et
d
etec
tio
n
m
o
d
el.
Ho
w
ev
er
,
in
t
h
at
s
t
u
d
y
,
th
e
au
t
h
o
r
s
d
id
n
'
t
s
p
ec
if
y
w
h
ic
h
r
ed
u
n
d
a
n
t
f
ea
t
u
r
es
w
er
e
r
e
m
o
v
ed
.
T
h
e
s
tu
d
y
[
10
]
d
escr
ib
ed
th
e
I
n
f
o
r
m
atio
n
g
a
i
n
a
l
g
o
r
i
t
h
m
f
o
r
r
e
d
u
c
i
n
g
t
h
e
f
e
a
t
u
r
e
d
i
m
e
n
s
i
o
n
.
H
o
w
e
v
e
r
,
i
n
t
h
e
e
x
p
e
r
i
m
e
n
t
a
l
p
a
r
t
,
t
h
e
a
u
t
h
o
r
s
d
i
d
n
'
t
c
o
m
p
a
r
e
t
h
e
e
f
f
e
c
t
i
v
e
n
e
s
s
o
f
t
h
e
d
e
t
e
c
t
i
o
n
m
e
t
h
o
d
w
h
e
n
u
s
i
n
g
t
h
e
f
e
a
t
u
r
e
d
i
m
e
n
s
i
o
n
r
e
d
u
c
t
i
o
n
t
e
c
h
n
i
q
u
e
.
B
ag
u
i
et
a
l.
[1
3
]
p
r
o
p
o
s
ed
m
et
h
o
d
s
o
f
f
ea
t
u
r
e
s
elec
tio
n
u
s
i
n
g
K
-
m
ea
n
s
C
l
u
s
ter
in
g
an
d
C
o
r
r
elati
o
n
b
ased
Featu
r
e
Selectio
n
alg
o
r
ith
m
s
.
I
n
t
h
e
s
tu
d
y
[
2
1
]
,
th
e
a
u
t
h
o
r
s
p
r
o
p
o
s
ed
u
s
i
n
g
a
d
ee
p
lear
n
in
g
m
o
d
el
co
m
b
in
in
g
C
o
n
v
o
lu
tio
n
al
Neu
r
al
Net
w
o
r
k
a
n
d
lo
n
g
s
h
o
r
t
-
ter
m
m
e
m
o
r
y
n
et
w
o
r
k
(
L
ST
M)
to
ex
tr
ac
t
a
n
d
class
i
f
y
c
y
b
er
-
at
tack
s
u
s
i
n
g
t
h
e
C
I
C
I
DS2
0
1
7
d
ataset.
E
x
p
er
i
m
e
n
tal
r
es
u
lts
s
h
o
w
t
h
a
t
t
h
e
c
l
a
s
s
i
f
i
c
a
t
i
o
n
s
y
s
t
e
m
g
i
v
e
s
o
v
e
r
a
l
l
a
c
c
u
r
a
c
y
a
s
9
8
.
6
7
%
a
n
d
t
h
e
a
c
c
u
r
a
c
y
o
f
e
a
c
h
a
t
t
a
c
k
t
y
p
e
a
s
o
v
e
r
9
9
.
5
0
%
.
H
o
w
e
v
e
r
,
t
h
i
s
a
p
p
r
o
a
c
h
r
e
q
u
i
r
e
s
a
l
o
t
o
f
t
i
m
e
a
n
d
a
c
u
m
b
e
r
s
o
m
e
c
a
l
c
u
l
a
t
i
o
n
s
y
s
t
e
m
.
T
h
u
s
t
h
i
s
m
e
t
h
o
d
i
s
o
n
l
y
s
u
i
t
a
b
l
e
f
o
r
s
t
u
d
i
e
s
a
n
d
i
s
d
i
f
f
i
c
u
l
t
t
o
a
p
p
l
y
i
n
r
ea
lit
y
.
3.
ANO
M
AL
Y
CL
ASS
I
F
I
CA
T
I
O
N
AND
I
T
S O
P
T
I
M
I
Z
A
T
I
O
N
USI
N
G
M
ACH
I
NE
L
E
ARNIN
G
3
.
1
.
E
x
peri
m
e
nta
l da
t
a
T
h
e
d
ata
s
et
u
s
ed
f
o
r
e
x
p
er
im
en
ts
is
UNSW
-
NB
1
5
.
T
h
is
d
ataset
w
a
s
b
u
ilt
b
y
u
s
in
g
th
e
I
XI
A
P
er
f
ec
tSt
o
r
m
to
o
l
to
ex
tr
ac
t
a
m
i
x
tu
r
e
o
f
attac
k
o
p
er
atio
n
s
i
n
t
h
e
n
et
w
o
r
k
.
Mo
r
e
th
a
n
1
0
0
GB
o
f
r
a
w
n
et
w
o
r
k
tr
af
f
ic
ar
e
ca
p
tu
r
ed
b
y
T
cp
d
u
m
p
to
o
l
an
d
p
r
o
ce
s
s
ed
b
y
A
r
g
u
s
,
B
r
o
-
I
DS,
a
n
d
t
w
el
v
e
al
g
o
r
ith
m
s
w
r
itten
i
n
t
h
e
C
#
lan
g
u
a
g
e
to
ex
tr
ac
t 4
3
f
ea
t
u
r
es a
n
d
s
a
v
e
it i
n
C
SV
f
o
r
m
a
t [
9
,
1
0
, 1
2
, 1
3
]
.
T
h
e
s
elec
ted
f
ea
t
u
r
es a
r
e
d
iv
id
ed
in
to
s
i
x
g
r
o
u
p
s
:
-
Flo
w
f
ea
t
u
r
es:
I
n
cl
u
d
e
f
ea
t
u
r
es
u
s
ed
to
id
en
ti
f
y
n
e
t
w
o
r
k
f
lo
w
s
u
c
h
as
I
P
ad
d
r
ess
,
p
o
r
t
n
u
m
b
er
,
an
d
p
r
o
to
co
l.
-
B
asic f
ea
t
u
r
es:
I
n
cl
u
d
e
co
n
n
ec
tio
n
d
escr
ip
tio
n
f
ea
tu
r
es.
-
C
o
n
te
n
t f
ea
tu
r
es
:
C
o
n
s
is
t
o
f
f
e
atu
r
es o
f
T
C
P
/I
P
p
r
o
to
co
l,
an
d
f
ea
tu
r
e
s
o
f
HT
T
P
ap
p
licatio
n
la
y
er
p
r
o
to
co
l.
-
T
im
e
f
ea
tu
r
e
s
:
i
n
clu
d
e
ti
m
e
-
r
e
lated
f
ea
tu
r
e
s
s
u
ch
a
s
p
ac
k
et
a
r
r
iv
al
ti
m
e,
s
tar
t/e
n
d
ti
m
e
a
n
d
r
o
u
n
d
tr
ip
ti
m
e
o
f
T
C
P
p
r
o
to
co
l.
-
A
d
d
itio
n
al
g
e
n
er
ated
f
ea
t
u
r
es
.
Featu
r
es
i
n
t
h
i
s
g
r
o
u
p
ca
n
b
e
d
iv
id
ed
in
to
t
w
o
s
m
aller
g
r
o
u
p
s
:
g
en
er
a
l
p
u
r
p
o
s
e
f
ea
tu
r
es a
n
d
co
n
n
ec
ti
o
n
f
ea
t
u
r
es.
-
L
ab
eled
f
ea
t
u
r
es: ar
e
lab
els f
o
r
r
ec
o
r
d
s
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J
E
lec
&
C
o
m
p
E
n
g
I
SS
N:
2
0
8
8
-
8708
Op
timiz
a
tio
n
o
f n
etw
o
r
k
tr
a
ffi
c
a
n
o
ma
ly
d
etec
tio
n
u
s
in
g
ma
ch
in
e
lea
r
n
in
g
(
C
h
o
Do
X
u
a
n
)
2363
3
.
2
.
Ano
m
a
ly
cla
s
s
if
ica
t
io
n us
ing
ra
nd
o
m
f
o
re
s
t
m
a
chine
lea
r
nin
g
a
lg
o
rit
h
m
T
h
e
s
tu
d
y
[
7
]
s
u
r
v
e
y
ed
a
n
d
ev
al
u
ated
s
o
m
e
s
u
p
er
v
is
ed
lear
n
in
g
alg
o
r
it
h
m
s
in
t
h
e
c
y
b
er
-
attac
k
d
etec
tio
n
p
r
o
b
lem
.
A
cc
o
r
d
in
g
l
y
,
t
h
e
s
t
u
d
y
in
d
icate
s
t
h
at
t
h
e
R
F
al
g
o
r
ith
m
is
t
h
e
c
u
r
r
en
t
b
est
clas
s
if
icatio
n
tech
n
iq
u
e.
T
h
er
ef
o
r
e,
in
t
h
is
p
ap
er
,
w
e
w
ill
u
s
e
t
h
e
R
F
al
g
o
r
ith
m
to
d
etec
t
an
o
m
alie
s
in
th
e
n
et
w
o
r
k
b
ased
o
n
th
e
UN
SW
-
NB
1
5
d
ataset.
RF
is
a
n
en
s
e
m
b
le
clas
s
if
icati
o
n
m
et
h
o
d
[
22
]
.
T
h
is
alg
o
r
it
h
m
is
b
ased
o
n
a
n
en
s
e
m
b
le
o
f
cla
s
s
i
f
ier
s
,
w
h
ic
h
n
o
r
m
all
y
ar
e
d
ec
is
io
n
tr
ee
s
t
o
m
a
k
e
t
h
e
f
in
al
p
r
ed
ictio
n
[2
3
]
.
T
h
e
th
eo
r
etica
l
f
o
u
n
d
atio
n
o
f
t
h
i
s
al
g
o
r
ith
m
i
s
b
ased
o
n
J
en
s
e
n
'
s
i
n
eq
u
alit
y
[
2
3
]
.
A
cc
o
r
d
in
g
to
J
en
s
e
n
's
i
n
eq
u
alit
y
ap
p
lied
to
th
e
cla
s
s
i
f
icat
io
n
p
r
o
b
le
m
s
,
it
is
s
h
o
w
n
t
h
at
th
e
co
m
b
i
n
atio
n
o
f
m
a
n
y
m
o
d
el
s
m
a
y
p
r
o
d
u
ce
less
er
r
o
r
r
ate
th
a
n
th
at
o
f
ea
c
h
in
d
i
v
id
u
al
m
o
d
el
.
3
.
3
.
F
ea
t
ure
ev
a
lua
t
io
n
a
nd
s
elec
t
io
n
I
n
f
ac
t,
n
o
t
all
f
ea
tu
r
es,
w
h
i
ch
w
e
f
o
u
n
d
,
ar
e
u
s
ef
u
l
to
b
u
ild
a
tr
ain
i
n
g
m
o
d
el
to
h
elp
m
a
k
e
t
h
e
n
ec
es
s
ar
y
p
r
ed
ictio
n
s
.
Usi
n
g
a
f
e
w
f
ea
t
u
r
es
s
o
m
eti
m
es
r
ed
u
ce
s
t
h
e
ac
cu
r
ac
y
o
f
p
r
ed
ictio
n
an
d
tak
e
s
ti
m
e
to
b
u
ild
a
m
o
d
el.
T
h
er
ef
o
r
e,
f
ea
tu
r
e
s
elec
tio
n
p
la
y
s
a
v
er
y
i
m
p
o
r
tan
t,
n
ec
ess
ar
y
r
o
le
in
th
e
p
r
o
ce
s
s
o
f
b
u
ild
in
g
ab
n
o
r
m
al
d
etec
tio
n
s
y
s
te
m
s
.
Selectin
g
g
o
o
d
f
ea
tu
r
e
s
w
ill
n
o
t
o
n
l
y
i
m
p
r
o
v
e
t
h
e
ac
cu
r
ac
y
o
f
attac
k
p
r
ed
ictio
n
b
u
t
also
r
ed
u
ce
f
ea
tu
r
e
e
x
tr
ac
tio
n
ti
m
e.
I
n
t
h
is
p
ap
er
,
w
e
ev
alu
a
te
an
d
s
elec
t
f
ea
t
u
r
es
b
y
s
o
m
e
d
i
f
f
er
e
n
t
m
et
h
o
d
s
in
o
r
d
er
to
ass
e
s
s
t
h
e
ef
f
ec
tiv
e
n
e
s
s
o
f
ea
c
h
m
e
th
o
d
f
o
r
th
e
UNSW
-
NB
1
5
d
ataset.
3
.
3
.
1
.
F
ea
t
ure
o
ptim
iza
t
io
n
u
s
ing
co
rr
ela
t
io
n c
o
ef
f
icient
m
et
ho
d
T
h
e
co
r
r
elatio
n
co
ef
f
icie
n
t
is
a
s
tatis
tical
i
n
d
ex
th
at
m
e
asu
r
es
t
h
e
s
tr
en
g
t
h
o
f
th
e
r
elatio
n
s
h
ip
b
et
w
ee
n
t
w
o
v
ar
iab
les.
T
h
er
e
ar
e
m
an
y
d
i
f
f
er
e
n
t
k
i
n
d
s
o
f
c
o
r
r
elatio
n
co
ef
f
ic
ien
t
s
.
I
n
t
h
i
s
p
ap
er
,
w
e
u
s
ed
t
h
e
P
ea
r
s
o
n
co
r
r
elatio
n
co
ef
f
icie
n
t.
P
ea
r
s
o
n
co
r
r
elatio
n
co
ef
f
ici
en
t
b
et
w
ee
n
t
w
o
v
ar
iab
les
X
an
d
Y
is
ca
lcu
late
d
b
y
t
h
e
f
o
r
m
u
la
[2
4
]
.
(
)
w
h
er
e:
C
o
v
(
X
,
Y
)
is
t
h
e
co
v
ar
ian
ce
o
f
X
an
d
Y
is
th
e
s
ta
n
d
ar
d
d
ev
iatio
n
o
f
X
is
th
e
s
ta
n
d
ar
d
d
ev
iatio
n
o
f
Y
T
h
e
co
r
r
elatio
n
co
ef
f
icie
n
t
h
as
a
v
alu
e
b
et
w
ee
n
-
1
an
d
1
.
T
h
e
n
eg
ati
v
e
co
r
r
elatio
n
co
ef
f
icie
n
t
in
d
icate
s
t
h
at
t
h
e
t
w
o
v
ar
iab
les
h
a
v
e
a
n
eg
at
iv
e
co
r
r
elati
o
n
o
r
in
v
er
s
e
co
r
r
elatio
n
(
is
a
p
er
f
ec
t
n
e
g
ati
v
e
co
r
r
elatio
n
w
h
en
t
h
e
v
al
u
e
is
-
1
)
.
T
h
e
p
o
s
itiv
e
co
r
r
elatio
n
co
ef
f
icie
n
t
in
d
icate
s
a
p
o
s
iti
v
e
co
r
r
elatio
n
(
is
a
p
er
f
ec
t
p
o
s
itiv
e
co
r
r
elatio
n
w
h
e
n
th
e
v
alu
e
i
s
1
)
.
T
h
e
c
o
r
r
elatio
n
co
ef
f
icie
n
t
is
ze
r
o
if
t
w
o
v
ar
iab
les
ar
e
in
d
ep
en
d
en
t
o
f
ea
ch
o
t
h
er
.
Featu
r
es
w
it
h
lar
g
e
co
r
r
elatio
n
co
ef
f
icie
n
t
s
h
a
v
e
lin
ea
r
d
ep
en
d
en
ce
,
an
d
th
u
s
th
e
y
h
av
e
al
m
o
s
t t
h
e
s
a
m
e
e
f
f
ec
t o
n
th
e
d
ep
en
d
en
t f
ea
t
u
r
es.
So
we
ca
n
r
ed
u
ce
o
n
e
o
f
th
o
s
e
t
w
o
f
ea
t
u
r
es.
3
.
3
.
2
.
F
ea
t
ure
o
ptim
iza
t
i
o
n
u
s
ing
info
r
m
a
t
io
n g
a
in
m
et
ho
d
I
n
f
o
r
m
a
tio
n
g
ai
n
(
I
G)
i
s
a
f
ea
tu
r
e
e
v
alu
a
tio
n
m
et
h
o
d
b
ased
o
n
en
tr
o
p
y
f
u
n
ctio
n
an
d
i
s
w
i
d
ely
u
s
ed
in
m
ac
h
in
e
lear
n
in
g
[
2
5
]
.
I
n
f
o
r
m
atio
n
g
ai
n
is
d
e
f
i
n
ed
as
a
q
u
an
t
it
y
t
h
at
m
ea
s
u
r
es
th
e
a
m
o
u
n
t
o
f
in
f
o
r
m
a
tio
n
g
ain
ed
ab
o
u
t
a
cla
s
s
f
r
o
m
a
f
ea
t
u
r
e.
I
n
f
o
r
m
atio
n
g
ai
n
is
ca
lcu
lated
b
ased
o
n
en
tr
o
p
y
q
u
an
tit
y
[
2
3
]
.
T
h
e
en
tr
o
p
y
f
u
n
c
tio
n
is
d
ef
in
ed
a
s
f
o
llo
w
s
[
2
3
]
:
Giv
en
a
p
r
o
b
ab
ilit
y
d
is
tr
ib
u
t
io
n
o
f
a
d
is
cr
ete
v
ar
iab
le
ca
n
r
ec
eiv
e
d
if
f
er
en
t
v
al
u
es
*
}.
Su
p
p
o
s
e
th
a
t
t
h
e
p
r
o
b
ab
ilit
y
f
o
r
g
et
th
e
s
e
v
a
lu
e
s
a
r
e
(
)
w
it
h
an
d
∑
.
T
h
is
d
is
tr
ib
u
ti
o
n
s
y
m
b
o
l
is
(
)
.
T
h
e
en
tr
o
p
y
o
f
th
is
d
is
tr
ib
u
tio
n
i
s
d
ef
in
ed
b
y
f
o
r
m
u
la
(
1
)
(
)
∑
(
)
(
1
)
Fro
m
th
e
f
o
r
m
u
l
a
o
f
e
n
tr
o
p
y
,
w
e
f
o
r
m
u
late
t
h
e
ca
lcu
la
tio
n
p
r
in
cip
le
o
f
I
n
f
o
r
m
atio
n
g
ai
n
as
f
o
llo
w
s
:
Step
1
:
C
o
n
s
id
er
a
p
r
o
b
lem
w
it
h
d
if
f
er
en
t
class
es.
S
u
p
p
o
s
e
th
at
w
e
w
o
r
k
w
i
th
a
n
o
n
-
lea
f
n
o
d
e
w
it
h
d
ata
p
o
in
ts
f
o
r
m
in
g
th
e
s
et
w
i
th
t
h
e
n
u
m
b
er
o
f
ele
m
e
n
ts
as
.
Su
p
p
o
s
e
f
u
r
th
er
t
h
at
in
t
h
ese
d
ata
p
o
in
ts
,
t
h
er
e
ar
e
p
o
in
ts
(
w
i
t
h
)
b
elo
n
g
s
to
cla
s
s
c.
T
h
e
p
r
o
b
ab
ilit
y
f
o
r
ea
ch
d
ata
p
o
in
t
b
elo
n
g
s
to
clas
s
c
is
ap
p
r
o
x
i
m
atel
y
(
m
a
x
i
m
u
m
li
k
eli
h
o
o
d
esti
m
atio
n
)
.
T
h
u
s
,
th
e
e
n
tr
o
p
y
at
th
is
n
o
d
e
is
c
alcu
la
ted
as f
o
llo
w
s
:
(
)
∑
(
2
)
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
0
8
8
-
8708
I
n
t J
E
lec
&
C
o
m
p
E
n
g
,
Vo
l.
11
,
No
.
3
,
J
u
n
e
2
0
2
1
:
2
3
6
0
-
2370
2364
Step
2
:
Ass
u
m
in
g
th
at
t
h
e
d
ataset
is
d
iv
id
ed
in
to
s
u
b
s
ets
ac
co
r
d
in
g
t
o
a
f
ea
tu
r
e
.
B
ased
o
n
,
d
ata
p
o
in
ts
i
n
S
ar
e
d
iv
id
ed
in
to
ch
ild
n
o
d
es:
w
it
h
p
o
in
ts
in
ea
c
h
c
h
ild
n
o
d
e.
W
e
d
ef
in
e
f
o
r
m
u
la
(
3
)
as
t
h
e
s
u
m
o
f
w
eig
h
ted
e
n
tr
o
p
y
o
f
ea
ch
c
h
ild
n
o
d
e.
T
h
e
tak
i
n
g
w
eig
h
t
is
i
m
p
o
r
tan
t b
ec
au
s
e
n
o
d
es o
f
te
n
h
av
e
d
i
f
f
er
e
n
t t
h
e
n
u
m
b
er
s
o
f
p
o
in
ts
.
(
)
∑
(
)
(
3
)
Step
3
: Calcu
late
i
n
f
o
r
m
atio
n
g
ain
v
al
u
e
b
ased
o
n
f
ea
t
u
r
e
.
(
)
(
)
(
)
(
4
)
3
.
3
.
3
.
F
ea
t
ure
o
ptim
iza
t
io
n
u
s
ing
princi
pa
l c
o
m
po
nent
a
n
a
ly
s
is
m
et
ho
d
P
r
in
cip
al
co
m
p
o
n
e
n
t
a
n
al
y
s
is
(
P
C
A
)
is
a
m
eth
o
d
o
f
f
in
d
i
n
g
a
n
e
w
b
as
is
s
o
t
h
at
t
h
e
in
f
o
r
m
ati
o
n
o
f
th
e
d
ata
is
m
ai
n
l
y
co
n
ce
n
tr
a
ted
in
s
e
v
er
al
co
o
r
d
in
ates,
t
h
e
r
e
m
ai
n
d
er
o
n
l
y
co
n
tai
n
s
a
s
m
al
l
a
m
o
u
n
t
o
f
i
n
f
o
r
m
atio
n
.
T
o
s
i
m
p
lify
th
e
c
alcu
latio
n
,
P
C
A
w
il
l
lo
o
k
f
o
r
an
o
r
th
o
n
o
r
m
al
b
asi
s
to
m
ak
e
a
n
e
w
b
asi
s
s
o
th
at
in
t
h
is
s
y
s
te
m
,
t
h
e
m
o
s
t
i
m
p
o
r
tan
t
co
m
p
o
n
e
n
ts
ar
e
i
n
s
o
m
e
co
o
r
d
in
ates
o
f
th
e
f
ir
s
t
co
m
p
o
n
en
t
[
2
6
]
.
W
e
ca
n
s
ee
th
e
s
tep
s
f
o
r
i
m
p
le
m
e
n
ti
n
g
P
C
A
as
f
o
llo
w
s
[
2
6
, 2
7
]:
Step
1
:
C
alcu
late
th
e
m
ea
n
v
ec
to
r
o
f
a
ll d
ata.
̅
∑
(
5
)
Step
2
:
Su
b
tr
ac
t th
e
m
ea
n
v
ec
to
r
f
r
o
m
ea
ch
d
ata
p
o
in
t.
̂
̅
(
6
)
Step
3
:
C
alcu
late
th
e
co
v
ar
ia
n
ce
m
atr
i
x
:
̂
̂
(
7
)
Step
4
:
C
alcu
late
eig
e
n
v
a
lu
e
s
an
d
eig
en
v
ec
to
r
s
w
it
h
n
o
r
m
eq
u
al
to
1
o
f
th
is
m
atr
i
x
,
ar
r
an
g
e
th
e
m
i
n
th
e
d
escen
d
i
n
g
o
r
d
er
o
f
eig
en
v
alu
e
s
.
Step
5
:
Select
K
ei
g
en
v
ec
to
r
s
w
it
h
K
h
i
g
h
est
eig
e
n
v
alu
e
s
to
b
u
ild
th
e
m
atr
i
x
U
K
w
h
o
s
e
co
l
u
m
n
s
f
o
r
m
a
n
o
r
th
o
g
o
n
al.
T
h
ese
K
v
ec
to
r
s
ar
e
also
ca
lled
k
e
y
co
m
p
o
n
en
ts
t
h
at
f
o
r
m
a
s
u
b
s
p
ac
e
cl
o
s
e
to
th
e
d
is
tr
ib
u
tio
n
o
f
th
e
n
o
r
m
alize
d
o
r
ig
in
al
d
ata.
Step
6
:
P
r
o
j
ec
t th
e
n
o
r
m
a
lized
o
r
ig
in
a
l d
ata
̂
d
o
w
n
to
th
e
f
o
u
n
d
s
u
b
s
p
ac
e.
Step
7
:
C
alcu
late
th
e
co
o
r
d
in
ates
o
f
t
h
e
n
e
w
d
ata.
T
h
e
n
e
w
d
ata
is
th
e
co
o
r
d
in
ates
o
f
t
h
e
d
ata
p
o
in
ts
o
n
th
e
n
e
w
s
p
ac
e
ac
co
r
d
in
g
to
th
e
f
o
r
m
u
la
(
8
)
.
̂
(
8
)
T
h
e
o
r
ig
in
al
d
ata
ca
n
b
e
ap
p
r
o
x
i
m
at
ed
ac
c
o
r
d
in
g
to
th
e
n
e
w
d
ata
as
in
f
o
r
m
u
la
(
9
)
.
̅
(
9
)
4.
E
XP
E
R
I
M
I
M
E
NT
S AN
D
E
VALUA
T
I
O
N
S
4
.
1
.
E
x
peri
m
e
nt
a
nd
ev
a
lua
t
io
n o
f
a
bn
o
r
m
a
l det
ec
t
io
n
m
et
h
o
d
4
.
1
.
1
.
E
x
peri
m
ent
a
l scena
rio
s
T
h
e
ex
p
er
i
m
en
ta
l
d
ataset
i
n
o
u
r
p
ap
er
in
clu
d
es
2
,
5
4
0
,
0
4
7
r
ec
o
r
d
s
co
n
s
is
ti
n
g
o
f
2
,
2
1
8
,
7
6
4
n
o
r
m
al
r
ec
o
r
d
s
an
d
3
2
1
,
2
8
3
attac
k
r
ec
o
r
d
s
.
W
e
w
ill d
i
v
id
e
th
e
ab
o
v
e
d
ataset
in
to
ex
p
er
i
m
en
ta
l d
atasets
as
f
o
llo
w
s
:
-
Data
s
et
A
: c
o
n
s
is
t o
f
3
2
2
,
1
0
6
n
o
r
m
al
r
ec
o
r
d
s
an
d
3
2
1
,
2
8
3
a
b
n
o
r
m
al
r
ec
o
r
d
s
.
-
Data
s
et
B
: c
o
n
s
i
s
t o
f
9
6
4
,
9
7
1
n
o
r
m
al
r
ec
o
r
d
s
an
d
3
2
1
,
2
8
3
a
b
n
o
r
m
al
r
ec
o
r
d
s
.
-
Data
s
et
C
: c
o
n
s
i
s
t o
f
2
,
2
1
8
,
7
6
4
n
o
r
m
a
l r
ec
o
r
d
s
an
d
3
2
1
,
2
8
3
ab
n
o
r
m
al
r
ec
o
r
d
s
.
E
ac
h
s
m
all
d
ataset
ab
o
v
e
i
s
d
iv
id
ed
in
to
t
w
o
p
ar
ts
i
n
a
r
ati
o
o
f
7
:3
to
co
n
d
u
ct
tr
ain
i
n
g
a
n
d
test
i
n
g
.
Fo
r
th
e
c
lass
if
ica
tio
n
a
lg
o
r
it
h
m
,
to
e
v
a
l
u
ate
t
h
e
e
f
f
ec
ti
v
e
n
es
s
o
f
th
e
R
F a
l
g
o
r
ith
m
o
n
ea
c
h
d
ataset
A
,
B
,
C
,
w
e
ch
an
g
e
t
h
e
p
ar
a
m
eter
s
r
ep
r
es
en
ti
n
g
t
h
e
n
u
m
b
er
o
f
d
ec
is
io
n
tr
ee
s
i
n
th
e
R
F
al
g
o
r
ith
m
.
T
h
e
m
o
d
el
w
ill
b
e
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J
E
lec
&
C
o
m
p
E
n
g
I
SS
N:
2
0
8
8
-
8708
Op
timiz
a
tio
n
o
f n
etw
o
r
k
tr
a
ffi
c
a
n
o
ma
ly
d
etec
tio
n
u
s
in
g
ma
ch
in
e
lea
r
n
in
g
(
C
h
o
Do
X
u
a
n
)
2365
test
ed
w
ith
t
h
e
n
u
m
b
er
o
f
d
ec
is
io
n
tr
ee
s
u
s
ed
as
{1
0
,
4
0
,
6
0
,
8
0
,
1
0
0
}.
B
esid
es,
w
e
also
co
n
d
u
ct
e
x
p
er
i
m
e
n
t
s
to
co
m
p
ar
e
th
e
R
F
al
g
o
r
ith
m
w
it
h
s
o
m
e
alg
o
r
it
h
m
s
o
f
o
th
er
s
tu
d
ies
i
n
clu
d
i
n
g
d
ec
is
io
n
tr
e
e
(
J
4
8
)
[
9
,
2
1
]
an
d
L
ST
M
[
2
1
,
2
8
]
alg
o
r
ith
m
s
.
I
n
th
e
s
t
u
d
y
[
1
5
]
,
th
e
au
t
h
o
r
s
h
av
e
p
r
o
v
en
t
h
at
th
e
K
NN
an
d
lo
g
is
tic
r
eg
r
e
s
s
io
n
alg
o
r
ith
m
s
b
o
th
h
a
v
e
le
s
s
e
f
f
i
cien
c
y
th
a
n
t
h
e
d
ec
is
io
n
tr
ee
alg
o
r
ith
m
,
s
o
to
s
ee
th
e
e
f
f
ec
tiv
e
n
ess
o
f
t
h
e
RF
alg
o
r
ith
m
,
w
e
w
ill o
n
l
y
co
m
p
ar
e
it
w
it
h
d
ec
is
io
n
tr
ee
a
n
d
L
ST
M
alg
o
r
ith
m
s
4
.
1
.
2
.
E
v
a
lua
t
io
n c
rit
er
ia
I
n
th
i
s
p
ap
er
,
w
e
s
p
ec
if
y
th
a
t
th
e
ab
n
o
r
m
al
r
ec
o
r
d
is
la
b
eled
as
p
o
s
itive
,
an
d
n
o
r
m
al
r
ec
o
r
d
s
ar
e
lab
eled
as
n
e
g
a
tive.
T
h
e
m
etr
ics
u
s
ed
to
ev
alu
ate
t
h
e
ef
f
ec
t
iv
en
e
s
s
o
f
t
h
e
ab
n
o
r
m
al
d
etec
tio
n
m
et
h
o
d
in
o
u
r
p
ap
er
in
clu
d
e:
A
cc
u
r
ac
y
:
t
h
e
r
atio
b
et
w
ee
n
th
e
n
u
m
b
er
o
f
p
o
in
ts
co
r
r
ec
tl
y
p
r
ed
icted
an
d
th
e
to
tal
n
u
m
b
er
o
f
p
o
in
ts
in
t
h
e
test
d
ataset.
(
10
)
P
r
ec
is
io
n
:
th
e
r
atio
o
f
t
h
e
n
u
m
b
er
o
f
tr
u
e
p
o
s
iti
v
e
p
o
in
ts
a
m
o
n
g
th
o
s
e
c
lass
if
ied
as
p
o
s
itive
(
T
P
+
FP
)
.
Hig
h
P
r
ec
is
io
n
v
alu
e
m
ea
n
s
t
h
at
t
h
e
ac
cu
r
ac
y
o
f
t
h
e
f
o
u
n
d
p
o
in
t
s
i
s
h
i
g
h
.
(
11
)
R
ec
all
i
s
d
e
f
in
ed
a
s
t
h
e
r
at
io
o
f
t
h
e
n
u
m
b
er
o
f
tr
u
e
p
o
s
iti
v
e
p
o
in
ts
a
m
o
n
g
t
h
o
s
e
t
h
at
ar
e
a
ctu
all
y
p
o
s
itive
(
T
P
+
FN)
.
Hig
h
r
ec
all
v
alu
e
m
ea
n
s
th
at
t
h
e
tr
u
e
p
o
s
iti
v
e
r
ate
(
T
P
R
)
is
h
ig
h
m
ea
n
i
n
g
th
at
th
e
r
ate
o
f
m
is
s
i
n
g
t
h
e
ac
t
u
al
p
o
s
iti
v
e
p
o
in
ts
i
s
lo
w
.
(
12
)
I
n
w
h
ich
,
T
r
u
e
p
o
s
itiv
e
(
T
P)
is
t
h
e
n
u
m
b
er
o
f
ab
n
o
r
m
a
l
r
e
co
r
d
s
th
at
ar
e
co
r
r
ec
tl
y
p
r
ed
icted
;
Fals
e
p
o
s
itiv
e
(
FP
)
is
th
e
n
u
m
b
er
o
f
n
o
r
m
al
r
ec
o
r
d
s
th
at
ar
e
in
co
r
r
ec
tl
y
p
r
ed
icted
;
T
r
u
e
n
eg
ati
v
e
(
T
N)
is
th
e
n
u
m
b
er
o
f
n
o
r
m
al
r
ec
o
r
d
s
co
r
r
ec
tl
y
p
r
ed
icted
; False
n
e
g
ati
v
e
(
FN)
is
t
h
e
n
u
m
b
er
o
f
ab
n
o
r
m
al
r
ec
o
r
d
s
th
a
t a
r
e
in
co
r
r
ec
tl
y
p
r
ed
icted
.
C
o
n
f
u
s
io
n
m
atr
i
x
:
T
h
is
m
atr
i
x
w
i
ll
s
h
o
w
h
o
w
m
a
n
y
d
ata
p
o
in
ts
ac
t
u
a
ll
y
b
elo
n
g
to
w
h
ic
h
c
lass
a
n
d
h
o
w
m
an
y
d
ata
p
o
in
ts
ar
e
p
r
ed
icted
to
b
elo
n
g
to
w
h
ic
h
cla
s
s
.
I
n
ad
d
i
tio
n
,
t
h
e
T
P
R
,
FNR
,
FP
R
,
T
NR
(R
-
R
ate)
cr
iter
ia
ar
e
ca
lcu
lat
ed
b
ased
o
n
th
e
n
o
r
m
alize
d
co
n
f
u
s
io
n
m
atr
i
x
.
T
ab
le
1
d
escr
ib
es
th
e
ca
lcu
latio
n
f
o
r
m
u
la
s
o
f
t
h
e
ab
o
v
e
p
ar
am
e
ter
s
.
T
ab
le
1
.
C
o
n
f
u
s
io
n
m
atr
i
x
P
r
e
d
i
c
t
e
d
a
s
a
b
n
o
r
mal
P
r
e
d
i
c
t
e
d
a
s
n
o
r
mal
A
c
t
u
a
l
a
b
n
o
r
mal
(
)
(
)
A
c
t
u
a
l
n
o
r
mal
(
)
(
)
4
.
1
.
3
.
E
x
peri
m
ent
a
l r
esu
lt
s
a.
E
x
p
er
i
m
e
n
tal
r
es
u
lts
w
i
th
d
ata
s
et
A
Fro
m
T
ab
le
2
,
w
e
ca
n
s
ee
th
at
w
h
e
n
th
e
n
u
m
b
er
o
f
d
ec
is
io
n
tr
ee
s
is
4
0
,
th
e
alg
o
r
ith
m
h
a
s
th
e
h
i
g
h
e
s
t
ac
cu
r
ac
y
an
d
p
r
ec
is
io
n
w
h
ich
ar
e
9
9
.
2
9
9
%
an
d
9
8
.
6
1
9
% r
esp
ec
tiv
el
y
.
B
esid
es,
w
h
e
n
ch
a
n
g
in
g
t
h
e
n
u
m
b
er
o
f
d
ec
is
io
n
tr
ee
s
f
r
o
m
1
0
to
1
0
0
,
th
e
ac
cu
r
ac
y
o
f
th
e
al
g
o
r
ith
m
d
o
esn
'
t
c
h
an
g
e
m
u
c
h
.
T
h
is
s
h
o
w
s
t
h
at
w
it
h
a
d
ataset
b
alan
ce
d
ab
o
u
t
t
h
e
r
ati
o
o
f
n
o
r
m
al
a
n
d
ab
n
o
r
m
al
r
ec
o
r
d
s
,
th
e
R
F
al
g
o
r
it
h
m
d
etec
t
s
w
el
l
an
d
s
tead
il
y
.
Ho
w
e
v
er
,
w
h
e
n
t
h
e
n
u
m
b
e
r
o
f
d
e
c
i
s
i
o
n
t
r
e
e
s
i
n
c
r
e
a
s
e
s
,
t
r
a
i
n
i
n
g
a
n
d
t
e
s
t
i
n
g
t
i
m
e
a
l
s
o
i
n
c
r
e
a
s
e
s
.
T
a
b
l
e
3
s
h
o
w
s
t
h
e
e
v
a
l
u
a
t
i
o
n
r
e
s
u
l
t
o
f
t
h
e
c
o
n
f
u
s
i
o
n
m
a
t
r
i
x
i
n
c
a
s
e
o
f
t
h
e
n
u
m
b
e
r
o
f
d
e
c
i
s
i
o
n
t
r
e
e
s
o
f
4
0
.
F
r
o
m
T
a
b
l
e
3
,
w
e
c
a
n
s
e
e
t
h
a
t
t
h
e
p
r
e
d
i
c
t
i
o
n
m
o
d
e
l
a
c
h
i
e
v
e
d
v
e
r
y
h
i
g
h
a
c
c
u
r
a
c
y
i
n
b
o
t
h
n
o
r
m
a
l
a
n
d
a
n
o
m
a
l
y
p
r
ed
i
ctio
n
s
.
b
.
E
x
p
er
i
m
e
n
tal
r
es
u
lts
w
i
th
d
ata
s
et
B
Fro
m
T
ab
le
2
an
d
T
ab
le
4
,
w
e
ca
n
s
ee
t
h
at
t
h
e
ac
c
u
r
ac
y
a
n
d
p
r
ec
is
io
n
o
f
d
ataset
B
ar
e
lo
wer
th
an
t
h
e
d
ataset
A
.
Ho
w
e
v
er
,
t
h
e
r
ec
all
v
al
u
es
d
o
n
'
t
c
h
a
n
g
e
m
u
c
h
.
I
n
ad
d
itio
n
,
t
h
e
tr
ai
n
i
n
g
ti
m
e
o
f
d
ataset
B
is
1
.
3
to
1
.
5
tim
e
s
h
ig
h
er
t
h
an
th
e
d
ataset
A
.
Fo
r
t
h
e
R
F
al
g
o
r
ith
m
in
d
ataset
B
,
th
e
h
i
g
h
e
s
t
ac
c
u
r
ac
y
(
9
8
.
9
4
4
%)
is
ac
h
iev
ed
w
h
e
n
t
h
e
n
u
m
b
er
o
f
d
ec
is
io
n
tr
ee
s
i
s
6
0
an
d
8
0
.
Ho
w
e
v
er
,
th
e
h
i
g
h
e
s
t
p
r
ec
is
io
n
(
9
5
.
9
6
5
%)
is
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
0
8
8
-
8708
I
n
t J
E
lec
&
C
o
m
p
E
n
g
,
Vo
l.
11
,
No
.
3
,
J
u
n
e
2
0
2
1
:
2
3
6
0
-
2370
2366
ac
h
iev
ed
in
ca
s
e
o
f
t
h
e
n
u
m
b
er
o
f
d
ec
is
io
n
tr
ee
s
o
f
4
0
.
T
a
b
le
5
s
h
o
w
s
th
e
r
esu
lt
o
f
th
e
co
n
f
u
s
io
n
m
atr
ix
i
n
ca
s
e
o
f
th
e
n
u
m
b
er
o
f
d
ec
is
io
n
tr
ee
s
o
f
4
0
.
T
ab
le
2
.
E
x
p
er
im
e
n
tal
r
esu
lts
w
it
h
d
ataset
a
u
s
i
n
g
R
F a
l
g
o
r
it
h
m
A
l
g
o
r
i
t
h
m
A
c
c
u
r
a
c
y
%
P
r
e
c
i
si
o
n
%
R
e
c
a
l
l
%
F
P
R
%
T
N
R
%
F
N
R
%
T
r
a
i
n
i
n
g
t
i
me
(
s)
R
a
n
d
o
m F
o
r
e
st
w
i
t
h
t
h
e
n
u
m
b
e
r
o
f
t
r
e
e
s a
s
10
9
9
.
2
9
8
9
8
.
6
1
7
9
9
.
9
9
6
1
.
3
9
9
9
8
.
6
0
1
0
.
0
0
4
1
1
1
.
0
5
1
40
9
9
.
2
9
9
9
8
.
6
1
9
9
9
.
9
9
7
1
.
3
9
7
9
8
.
6
0
3
0
.
0
0
3
1
1
7
.
4
0
2
60
9
9
.
2
9
6
9
8
.
6
1
4
9
9
.
9
9
6
1
.
4
0
2
9
8
.
5
9
8
0
.
0
0
4
1
2
5
.
9
5
4
80
9
9
.
2
9
9
9
8
.
6
1
8
9
9
.
9
9
7
1
.
3
9
8
9
8
.
6
0
2
0
.
0
0
3
1
3
1
.
7
5
5
1
0
0
9
9
.
2
9
6
9
8
.
6
1
5
9
9
.
9
9
4
1
.
4
0
1
9
8
.
5
9
9
0
.
0
0
6
1
3
8
.
9
2
4
J4
8
[
1
2
,
2
0
]
9
8
.
4
7
3
8
9
.
2
4
2
9
9
.
9
8
1
1
.
7
4
5
9
8
.
2
5
5
0
.
0
1
9
9
8
.
2
0
9
L
S
T
M
[
2
0
,
2
7
]
9
7
.
6
8
2
9
6
.
8
8
8
9
8
.
5
2
2
3
.
1
5
6
9
6
.
8
4
4
1
.
4
7
8
1
6
5
.
4
5
3
T
ab
le
3
.
C
o
n
f
u
s
io
n
m
atr
i
x
r
es
u
lt
w
it
h
t
h
e
n
u
m
b
er
o
f
d
ec
is
io
n
tr
ee
s
o
f
4
0
o
n
d
ataset
A
P
r
e
d
i
c
t
e
d
a
s
a
b
n
o
r
mal
P
r
e
d
i
c
t
e
d
a
s
n
o
r
mal
A
c
t
u
a
l
a
b
n
o
r
mal
9
5
3
0
3
1
3
5
0
A
c
t
u
a
l
n
o
r
mal
3
9
6
4
3
1
T
ab
le
4
.
E
x
p
er
im
e
n
tal
r
esu
lts
w
it
h
d
ataset
B
A
l
g
o
r
i
t
h
m
A
c
c
u
r
a
c
y
%
P
r
e
c
i
si
o
n
%
R
e
c
a
l
l
%
F
P
R
%
T
N
R
%
F
N
R
%
T
r
a
i
n
i
n
g
t
i
me
(
s)
R
a
n
d
o
m F
o
r
e
st
w
i
t
h
t
h
e
n
u
m
b
e
r
o
f
t
r
e
e
s a
s
10
9
8
.
9
4
2
9
5
.
9
5
7
9
9
.
9
7
7
1
.
4
0
4
9
8
.
5
9
6
0
.
0
2
3
1
1
1
.
3
9
7
40
9
8
.
9
4
3
9
5
.
9
6
5
9
9
.
9
7
3
1
.
4
0
1
9
8
.
5
9
9
0
.
0
2
7
1
2
7
.
1
4
3
60
9
8
.
9
4
4
9
5
.
9
5
4
9
9
.
9
9
0
1
.
4
0
5
9
8
.
5
9
5
0
.
0
1
0
1
4
2
.
8
4
80
9
8
.
9
4
4
9
5
.
9
5
8
9
9
.
9
8
7
1
.
4
0
3
9
8
.
5
9
7
0
.
0
1
3
1
5
6
.
9
3
9
1
0
0
9
8
.
9
4
3
9
5
.
9
5
6
9
9
.
9
8
4
1
.
4
0
4
9
8
.
5
9
6
0
.
0
1
6
1
7
2
.
4
4
4
J4
8
[
9
,
2
1
]
9
8
.
0
1
2
9
3
.
0
3
7
9
9
.
4
8
9
2
.
4
7
9
9
7
.
5
2
1
0
.
5
1
1
1
0
3
.
5
1
4
L
S
T
M
[
2
1
,
2
8
]
9
6
.
5
7
9
9
4
.
8
0
1
9
1
.
3
1
3
1
.
6
6
7
9
8
.
3
3
3
8
.
6
8
7
2
0
1
.
2
T
ab
le
5
.
C
o
n
f
u
s
io
n
m
atr
i
x
r
es
u
lt
w
it
h
t
h
e
n
u
m
b
er
o
f
d
ec
is
io
n
tr
ee
s
o
f
4
0
o
n
d
ataset
B
P
r
e
d
i
c
t
e
d
a
s
a
b
n
o
r
mal
P
r
e
d
i
c
t
e
d
a
s
n
o
r
mal
A
c
t
u
a
l
a
b
n
o
r
mal
9
6
4
2
2
12
A
c
t
u
a
l
n
o
r
mal
4
0
6
7
2
8
5
3
2
9
c.
E
x
p
er
i
m
e
n
tal
r
es
u
lts
w
i
th
d
ata
s
et
C
W
h
en
t
h
e
n
u
m
b
er
o
f
ab
n
o
r
m
al
r
ec
o
r
d
s
an
d
th
e
n
u
m
b
er
o
f
n
o
r
m
al
r
ec
o
r
d
s
h
av
e
t
h
e
lar
g
est
d
if
f
er
e
n
ce
,
all
ex
p
er
i
m
e
n
tal
v
alu
e
s
g
i
v
e
p
o
o
r
er
r
esu
lts
t
h
a
n
o
th
er
s
ce
n
ar
io
s
.
T
h
is
is
r
ea
s
o
n
ab
le
b
ec
au
s
e
th
is
i
s
th
e
n
at
u
r
e
o
f
th
e
clas
s
if
icatio
n
p
r
o
ce
s
s
.
I
f
th
e
d
is
p
ar
it
y
i
n
th
e
d
atase
t
is
to
o
lar
g
e,
th
e
class
i
f
icatio
n
m
o
d
el
w
il
l
o
v
er
f
it
.
Fro
m
T
ab
le
6
it
ca
n
b
e
s
ee
n
t
h
at:
w
it
h
a
p
ar
a
m
eter
o
f
th
e
n
u
m
b
er
o
f
d
ec
is
io
n
tr
ee
s
o
f
1
0
,
t
h
e
h
i
g
h
e
s
t
A
cc
u
r
ac
y
an
d
P
r
ec
is
io
n
ar
e
r
esp
ec
tiv
el
y
9
9
.
0
1
6
%
an
d
9
4
.
8
2
5
%.
T
h
e
co
n
f
u
s
io
n
m
a
tr
ix
v
alu
e
s
ar
e
s
h
o
w
n
i
n
T
ab
le
7
.
T
ab
le
6
.
E
x
p
er
im
e
n
tal
r
esu
lts
w
it
h
d
ataset
C
A
l
g
o
r
i
t
h
m
A
c
c
u
r
a
c
y
%
P
r
e
c
i
si
o
n
%
R
e
c
a
l
l
%
F
P
R
%
T
N
R
%
F
N
R
%
T
r
a
i
n
i
n
g
t
i
me
(
s)
R
a
n
d
o
m
F
o
r
e
st
w
i
t
h
t
h
e
n
u
m
b
e
r
o
f
t
r
e
e
s a
s
10
9
9
.
0
1
6
9
4
.
8
2
5
9
7
.
5
4
7
0
.
7
7
1
9
9
.
2
2
9
2
.
4
5
3
1
3
6
.
0
6
5
40
9
8
.
8
7
7
9
2
.
2
5
4
9
9
.
4
7
3
1
.
2
0
9
9
8
.
7
9
1
0
.
5
2
7
1
6
8
.
0
2
7
60
9
8
.
8
6
9
9
2
.
1
1
4
9
9
.
5
8
3
1
.
2
3
4
9
8
.
7
6
6
0
.
4
1
7
2
0
5
.
8
6
9
80
9
8
.
7
8
6
9
1
.
2
6
2
9
9
.
9
7
1
1
.
3
8
6
9
8
.
6
1
4
0
.
0
2
9
2
4
3
.
1
0
9
1
0
0
9
8
.
8
6
9
9
2
.
0
9
0
9
9
.
6
1
2
1
.
2
3
9
9
8
.
7
6
1
0
.
3
8
8
2
7
3
.
6
1
2
J4
8
[
9
,
2
1
]
9
7
.
6
8
1
8
5
.
4
1
6
9
8
.
4
8
2
2
.
4
3
5
9
7
.
5
6
5
1
.
5
1
8
1
2
8
.
0
3
L
S
T
M
[
2
1
,
2
8
]
9
4
.
7
5
2
8
8
.
9
3
9
9
0
.
2
0
9
3
.
7
3
5
9
6
.
2
6
5
9
.
7
9
1
4
0
0
.
6
4
2
T
ab
le
7
.
C
o
n
f
u
s
io
n
m
atr
i
x
r
es
u
lt
w
it
h
t
h
e
n
u
m
b
er
o
f
d
ec
is
io
n
tr
ee
s
o
f
1
0
o
n
d
ataset
C
P
r
e
d
i
c
t
e
d
a
s
a
b
n
o
r
mal
P
r
e
d
i
c
t
e
d
a
s
n
o
r
mal
A
c
t
u
a
l
a
b
n
o
r
mal
9
4
0
6
8
2
3
6
6
A
c
t
u
a
l
n
o
r
mal
5
1
3
4
6
6
0
8
3
9
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J
E
lec
&
C
o
m
p
E
n
g
I
SS
N:
2
0
8
8
-
8708
Op
timiz
a
tio
n
o
f n
etw
o
r
k
tr
a
ffi
c
a
n
o
ma
ly
d
etec
tio
n
u
s
in
g
ma
ch
in
e
lea
r
n
in
g
(
C
h
o
Do
X
u
a
n
)
2367
d
.
Dis
cu
s
s
io
n
Fro
m
th
e
e
x
p
e
r
i
m
e
n
tal
r
e
s
u
l
ts
in
T
ab
les
2
,
4
an
d
6
,
w
e
ca
n
s
ee
th
at
t
h
e
R
F
al
g
o
r
ith
m
g
av
e
g
o
o
d
an
d
s
tab
le
clas
s
if
icatio
n
r
e
s
u
l
ts
a
lth
o
u
g
h
t
h
er
e
is
a
v
er
y
lar
g
e
d
if
f
er
en
ce
a
m
o
n
g
t
h
e
d
atas
ets.
T
h
e
lo
w
er
t
h
e
i
m
b
alan
ce
o
f
t
h
e
d
ataset
is
,
th
e
h
i
g
h
er
t
h
e
m
ea
s
u
r
es
o
f
t
h
e
c
o
r
r
ec
t
d
etec
tio
n
r
ate
ar
e.
B
esi
d
es,
f
o
r
J
4
8
[
9
,
2
1
]
an
d
L
ST
M
[
2
1
,
2
8
]
alg
o
r
ith
m
s
,
w
h
e
n
t
h
e
d
ataset
ch
an
g
e
s
,
th
e
d
etec
tio
n
r
esu
lt
s
an
d
d
etec
tio
n
ti
m
e
also
ch
an
g
e.
T
h
e
J
4
8
alg
o
r
ith
m
h
a
s
th
e
ad
v
a
n
tag
e
o
f
th
e
lo
w
est
ti
m
e
f
o
r
d
etec
tio
n
an
d
class
i
f
i
ca
tio
n
d
u
e
to
u
s
i
n
g
o
n
l
y
o
n
e
tr
ee
f
o
r
ev
al
u
atio
n
.
Ho
w
e
v
er
,
th
is
al
g
o
r
ith
m
h
as
t
h
e
d
is
ad
v
a
n
ta
g
e
th
at
its
ac
cu
r
ac
y
o
n
all
m
ea
s
u
r
e
m
e
n
t
s
is
lo
w
er
t
h
an
t
h
e
R
F
al
g
o
r
ith
m
.
W
ith
th
e
L
ST
M
alg
o
r
ith
m
[
2
1
,
2
8
]
,
th
e
d
etec
tio
n
ef
f
icien
c
y
h
as b
ee
n
i
m
p
r
o
v
ed
b
u
t t
h
e
p
r
o
ce
s
s
i
n
g
t
i
m
e
is
to
o
s
lo
w
co
m
p
ar
ed
w
it
h
o
th
er
al
g
o
r
ith
m
s
.
T
h
en
ce
it c
a
n
s
ee
t
h
at
th
e
L
ST
M
alg
o
r
ith
m
i
s
n
o
t
r
ea
ll
y
s
u
itab
le
f
o
r
d
atasets
w
it
h
o
u
t
ti
m
e
p
ar
a
m
eter
s
.
B
ased
o
n
th
e
s
e
r
esu
lt
s
,
w
e
p
r
o
v
id
ed
s
o
m
e
cr
iter
ia
a
n
d
b
asis
f
o
r
c
y
b
er
-
attac
k
d
etec
tio
n
s
y
s
te
m
s
to
c
h
o
o
s
e
i
n
o
r
d
er
to
b
alan
ce
b
et
w
ee
n
d
etec
tio
n
p
er
f
o
r
m
an
ce
a
n
d
ti
m
e
co
s
t
.
4
.
2
.
E
v
a
lua
t
io
n o
f
f
ea
t
ure
o
pti
m
i
za
t
io
n
m
et
ho
ds
Fro
m
T
ab
le
6
,
w
e
s
elec
t
a
p
ar
a
m
eter
o
f
th
e
n
u
m
b
er
o
f
d
ec
is
io
n
tr
ee
s
o
f
8
0
to
co
n
d
u
ct
ex
p
er
im
e
n
t
s
an
d
ev
a
lu
ate
t
h
e
f
ea
tu
r
e
o
p
tim
izatio
n
m
et
h
o
d
.
W
e
ch
o
s
e
t
h
is
s
ce
n
ar
io
b
ec
au
s
e
t
h
e
d
atas
et
C
a
n
d
t
h
e
n
u
m
b
er
o
f
d
ec
is
io
n
tr
ee
s
o
f
8
0
g
i
v
e
t
h
e
lo
w
est ac
c
u
r
ac
y
a
n
d
p
r
ec
is
io
n
.
4
.
2
.
1
.
F
ea
t
ure
s
elec
t
io
n
us
ing
co
rr
ela
t
io
n c
o
e
f
f
icient
m
et
h
o
d
a.
E
x
p
er
i
m
en
ta
l r
esu
l
ts
o
f
f
ea
t
u
r
e
d
i
m
e
n
s
io
n
r
ed
u
c
tio
n
A
cc
o
r
d
in
g
to
t
h
e
r
u
le
o
f
s
ele
ctin
g
an
d
e
v
al
u
ati
n
g
f
ea
t
u
r
es
o
f
th
e
co
r
r
elatio
n
co
e
f
f
icie
n
t
m
et
h
o
d
,
if
th
e
t
w
o
f
ea
tu
r
es
h
a
v
e
a
lar
g
e
c
o
r
r
elatio
n
co
ef
f
icie
n
t,
o
n
e
o
f
t
h
e
t
w
o
f
ea
t
u
r
es
s
h
o
u
ld
b
e
r
em
o
v
ed
.
T
h
e
r
ea
s
o
n
is
th
at
i
f
b
o
th
f
ea
t
u
r
es
ar
e
k
ep
t
,
th
er
e
is
n
o
t
m
ea
n
m
u
c
h
ab
o
u
t
ter
m
s
o
f
v
alu
e.
Acc
o
r
d
in
g
l
y
,
f
r
o
m
Fi
g
u
r
e
1
,
w
e
s
p
ec
if
y
t
h
at
if
t
w
o
f
ea
t
u
r
es
h
a
v
e
t
h
e
co
r
r
elatio
n
co
ef
f
icie
n
t
g
r
ea
ter
t
h
an
o
r
eq
u
al
to
0
.
9
,
o
r
less
th
a
n
o
r
eq
u
al
to
-
0
.
9
,
o
n
e
o
f
th
e
t
w
o
f
ea
t
u
r
e
s
w
i
ll
b
e
r
em
o
v
ed
.
B
y
d
o
in
g
t
h
is
,
w
e
r
e
m
o
v
ed
1
2
f
ea
tu
r
es
c
o
n
s
is
tin
g
o
f
s
lo
s
s
,
ct_
s
ta
te_
ttl,
s
yn
a
ck
,
ct_
d
s
t_
s
r
c_
ltm,
Dp
kts,
d
w
in
,
a
ck
d
a
t,
ct_
s
r
v_
d
s
t,
Lti
me,
d
lo
s
s
,
an
d
c
t_
s
r
c_
ltm.
So
f
r
o
m
Fig
u
r
e
1
,
th
e
n
u
m
b
er
o
f
r
e
m
ai
n
in
g
f
ea
t
u
r
es is
3
1
.
Fig
u
r
e
1
.
C
o
r
r
elatio
n
co
ef
f
ic
ie
n
t
m
a
tr
ix
a
m
o
n
g
f
ea
tu
r
es i
n
a
d
ataset
b
.
R
esu
lt o
f
class
if
ica
tio
n
u
s
i
n
g
co
r
r
elatio
n
co
ef
f
icien
t
m
et
h
o
d
E
x
p
er
i
m
e
n
tal
r
es
u
lt
s
o
f
d
atas
et
C
w
it
h
3
1
s
elec
ted
f
ea
tu
r
e
s
ar
e
p
r
esen
ted
in
T
ab
le
8
.
C
o
m
p
ar
in
g
T
ab
le
8
w
it
h
T
ab
le
6
,
w
e
s
ee
th
at
t
h
e
i
m
p
o
r
tan
t
m
etr
ic
s
s
u
c
h
as
ac
cu
r
ac
y
,
p
r
ec
is
io
n
,
an
d
t
r
ain
in
g
ti
m
e
ar
e
all
i
m
p
r
o
v
ed
,
b
ein
g
t
h
e
f
o
llo
w
i
n
g
:
A
cc
u
r
ac
y
v
al
u
e
i
n
cr
ea
s
ed
b
y
0
.
0
1
5
%
;
P
r
ec
is
io
n
v
alu
e
i
n
c
r
ea
s
ed
b
y
0
.
1
4
6
%;
T
r
ain
in
g
ti
m
e
r
ed
u
ce
d
b
y
5
2
.
9
5
4
s
ec
o
n
d
s
.
T
ab
le
8
.
E
x
p
er
im
e
n
tal
r
esu
lts
o
f
d
ataset
C
w
it
h
3
1
f
ea
t
u
r
es
A
c
c
u
r
a
c
y
%
P
r
e
c
i
si
o
n
%
R
e
c
a
l
l
%
F
P
R
%
T
N
R
%
F
N
R
%
T
r
a
i
n
i
n
g
T
i
me
(
s)
9
8
.
8
0
1
9
1
.
4
0
8
9
9
.
9
4
5
1
.
3
6
5
9
8
.
6
3
5
0
.
0
5
5
1
9
0
.
1
5
5
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
0
8
8
-
8708
I
n
t J
E
lec
&
C
o
m
p
E
n
g
,
Vo
l.
11
,
No
.
3
,
J
u
n
e
2
0
2
1
:
2
3
6
0
-
2370
2368
4
.
2
.
2
.
F
ea
t
ure
s
elec
t
io
n us
ing
I
G
m
et
ho
d
a.
E
x
p
er
i
m
en
tal
r
esu
lts
o
f
f
ea
t
u
r
e
d
im
e
n
s
io
n
r
ed
u
ctio
n
T
h
e
Fig
u
r
e
2
s
h
o
w
s
t
h
e
i
m
p
o
r
tan
ce
o
f
ea
ch
f
ea
t
u
r
e
w
h
e
n
u
s
in
g
t
h
e
I
G
ev
al
u
atio
n
m
et
h
o
d
.
Featu
r
es
w
it
h
lo
w
i
m
p
o
r
ta
n
ce
s
co
r
es
(
less
th
a
n
0
.
0
1
)
w
ill
b
e
r
e
m
o
v
e
d
to
r
e
d
u
ce
th
e
n
u
m
b
er
o
f
f
ea
t
u
r
es.
B
y
d
o
in
g
t
h
i
s
,
w
e
r
e
m
o
v
ed
1
5
f
ea
tu
r
es:
d
lo
s
s
,
d
w
in
,
s
tcp
b
,
d
tcp
b
,
tr
a
n
s
_
d
ep
th
,
r
es_
b
d
y_
len
,
S
jit,
Djit,
S
time,
Lti
me,
is
_
s
m_
ip
s
_
p
o
r
ts
,
ct_
flw
_
h
ttp
_
mth
d
,
is
_
ftp
_
lo
g
in
,
ct_
ftp
_
cmd
,
ct_
s
r
c_
ltm.
b.
R
es
u
lt o
f
cla
s
s
i
f
icatio
n
u
s
i
n
g
I
G
m
et
h
o
d
E
x
p
er
i
m
e
n
tal
r
es
u
lt
s
o
f
d
atas
et
C
w
it
h
2
8
s
elec
ted
f
ea
tu
r
e
s
ar
e
p
r
esen
ted
in
T
ab
le
9
.
C
o
m
p
ar
in
g
T
ab
le
9
w
i
th
T
ab
les
8
a
n
d
6
,
w
e
s
ee
t
h
at
th
e
i
m
p
o
r
ta
n
t
m
et
r
ics
s
u
ch
as
ac
c
u
r
ac
y
,
p
r
ec
is
io
n
,
an
d
tr
ain
i
n
g
ti
m
e
ar
e
all
m
u
c
h
b
etter
,
b
ein
g
th
e
f
o
llo
w
in
g
:
A
cc
u
r
ac
y
v
alu
e
i
n
cr
ea
s
ed
b
y
0
.
1
9
3
%;
Pre
cisi
o
n
v
alu
e
i
n
cr
ea
s
ed
b
y
2
.
3
3
3
%;
T
r
ain
in
g
ti
m
e
r
ed
u
ce
d
b
y
2
9
.
6
9
9
s
ec
o
n
d
s
.
T
ab
le
9
.
E
x
p
er
im
e
n
tal
r
esu
lts
o
f
d
ataset
C
w
it
h
2
8
f
ea
t
u
r
es
A
c
c
u
r
a
c
y
%
P
r
e
c
i
si
o
n
%
R
e
c
a
l
l
%
F
P
R
%
T
N
R
%
F
N
R
%
T
r
a
i
n
i
n
g
T
i
me
(
s)
9
8
.
9
7
9
%
9
3
.
5
9
5
%
9
8
.
7
0
9
%
0
.
9
8
2
%
9
9
.
0
1
8
1
.
2
9
1
2
1
3
.
4
1
0
Fig
u
r
e
2
.
Gr
ap
h
o
f
f
ea
t
u
r
e
v
al
u
es b
y
I
G
m
et
h
o
d
4
.
2
.
3
.
F
ea
t
ure
s
elec
t
io
n us
ing
P
CA
m
et
ho
d
a.
E
x
p
er
i
m
en
tal
r
esu
lts
o
f
f
ea
t
u
r
e
d
im
e
n
s
io
n
r
ed
u
ctio
n
W
e
ch
o
o
s
e
to
k
ee
p
t
h
e
n
u
m
b
er
o
f
f
ea
tu
r
es
in
d
ataset
C
at
3
1
.
A
f
ter
th
e
ex
p
er
i
m
en
ta
l
p
r
o
ce
s
s
,
P
C
A
m
et
h
o
d
h
as
r
e
m
o
v
ed
1
2
f
ea
tu
r
es
co
n
s
i
s
ti
n
g
o
f
Dp
k
ts
,
d
w
i
n
,
ac
k
d
at,
ct_
s
r
v
_
d
s
t,
L
ti
m
e,
d
lo
s
s
,
tr
an
s
_
d
ep
th
,
r
es_
b
d
y
_
len
,
Sj
it,
Dj
it,
Sti
m
e,
L
ti
m
e,
is
_
s
m
_
ip
s
_
p
o
r
ts
,
an
d
ct_
f
l
w
_
h
t
tp
_
m
t
h
d
.
b.
R
es
u
lt o
f
clas
s
i
f
icatio
n
u
s
in
g
P
C
A
m
et
h
o
d
E
x
p
er
i
m
e
n
tal
r
es
u
lt
s
o
f
d
atas
et
C
w
it
h
3
1
s
elec
ted
f
ea
t
u
r
e
s
ar
e
p
r
esen
ted
in
T
ab
le
1
0
.
C
o
m
p
ar
in
g
w
it
h
t
h
e
i
n
itial
f
ea
t
u
r
e
s
et,
t
h
i
s
ex
p
er
i
m
e
n
tal
s
ce
n
ar
io
also
h
as
b
etter
ac
cu
r
ac
y
,
p
r
ec
is
io
n
,
an
d
tr
ain
i
n
g
ti
m
e
v
alu
e
s
.
F
u
r
th
er
m
o
r
e,
r
ed
u
ci
n
g
th
e
f
ea
t
u
r
e
d
i
m
e
n
s
io
n
b
y
P
C
A
m
et
h
o
d
h
as
h
ig
h
er
ac
cu
r
ac
y
an
d
p
r
ec
is
io
n
t
h
a
n
th
e
f
ea
t
u
r
e
s
elec
t
io
n
u
s
i
n
g
co
r
r
ela
tio
n
co
ef
f
icie
n
t
m
et
h
o
d
,
b
u
t
tr
ai
n
in
g
t
i
m
e
is
m
o
r
e
t
h
a
n
3
4
.
3
7
7
s
ec
o
n
d
s
.
C
o
m
p
ar
in
g
t
h
e
e
x
p
er
i
m
e
n
tal
r
esu
lt
s
i
n
T
ab
le
1
0
w
i
th
T
ab
le
9
,
th
e
P
C
A
m
et
h
o
d
is
n
't
as
ef
f
ec
tiv
e
as
t
h
e
I
G
m
et
h
o
d
.
T
h
e
r
ea
s
o
n
i
s
t
h
at
th
e
P
C
A
m
et
h
o
d
co
m
p
r
ess
e
s
d
at
a
th
at
co
u
ld
lead
to
t
h
e
lo
s
s
o
f
i
m
p
o
r
tan
t
f
ea
tu
r
e
s
,
an
d
th
e
I
G
m
e
th
o
d
p
er
f
o
r
m
s
w
ei
g
h
t
e
v
alu
a
tio
n
to
s
elec
t
f
ea
tu
r
es.
T
h
er
ef
o
r
e,
if
t
h
e
d
ata
s
et
is
lar
g
er
,
t
h
e
u
s
e
o
f
th
e
P
C
A
m
e
th
o
d
w
ill b
e
m
o
r
e
ef
f
ec
tiv
e.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J
E
lec
&
C
o
m
p
E
n
g
I
SS
N:
2
0
8
8
-
8708
Op
timiz
a
tio
n
o
f n
etw
o
r
k
tr
a
ffi
c
a
n
o
ma
ly
d
etec
tio
n
u
s
in
g
ma
ch
in
e
lea
r
n
in
g
(
C
h
o
Do
X
u
a
n
)
2369
T
ab
le
1
0
.
E
x
p
er
i
m
en
tal
r
es
u
lt
s
o
f
d
ataset
C
w
it
h
3
1
f
ea
tu
r
e
s
A
c
c
u
r
a
c
y
%
P
r
e
c
i
si
o
n
%
R
e
c
a
l
l
%
F
P
R
%
T
N
R
%
F
N
R
%
T
r
a
i
n
i
n
g
T
i
me
(
s)
9
8
.
8
0
4
%
9
1
.
9
2
6
%
9
9
.
2
9
3
%
1
.
2
6
7
%
9
8
.
7
3
3
%
0
.
7
0
7
%
2
2
4
.
5
3
2
4
.
2
.
4
.
Dis
cus
s
io
n
T
h
e
ex
p
er
i
m
e
n
tal
r
esu
lts
in
T
ab
les
8
–
1
0
s
h
o
w
t
h
at
th
e
f
ea
tu
r
e
d
i
m
en
s
io
n
r
ed
u
ctio
n
a
lg
o
r
ith
m
s
b
r
o
u
g
h
t
g
o
o
d
ef
f
icie
n
c
y
i
n
b
o
th
2
p
r
o
b
le
m
s
:
i
m
p
r
o
v
i
n
g
t
h
e
ef
f
icien
c
y
o
f
t
h
e
d
etec
tio
n
p
r
o
ce
s
s
,
an
d
ti
m
e
f
o
r
d
etec
tio
n
an
d
w
ar
n
i
n
g
.
Ho
wev
er
,
b
ased
o
n
th
e
d
if
f
er
en
t
ef
f
ic
ien
c
y
o
f
t
h
e
f
ea
t
u
r
e
d
i
m
en
s
io
n
r
ed
u
ct
io
n
m
et
h
o
d
s
,
w
e
n
o
ticed
th
a
t
c
y
b
er
-
attac
k
m
o
n
ito
r
in
g
an
d
d
ete
ctio
n
s
y
s
te
m
s
n
ee
d
a
tr
ad
e
-
o
f
f
b
et
w
ee
n
d
etec
tio
n
ef
f
icien
c
y
a
n
d
d
etec
tio
n
ti
m
e.
T
h
e
I
G
an
d
co
r
r
elatio
n
co
ef
f
ic
ien
t a
l
g
o
r
ith
m
s
ca
n
g
i
v
e
b
etter
r
esu
lt
s
i
n
ter
m
s
o
f
d
etec
tio
n
ti
m
e
an
d
e
f
f
icie
n
c
y
if
w
e
co
n
ti
n
u
e
to
c
h
o
o
s
e
t
h
r
esh
o
ld
s
to
r
ed
u
ce
t
h
e
d
i
m
e
n
s
io
n
.
Ho
w
e
v
er
,
i
f
r
ed
u
cin
g
t
h
e
n
u
m
b
er
o
f
f
ea
t
u
r
es
to
o
lar
g
e,
it
w
ill
lead
t
o
th
e
lo
s
s
o
f
d
ata
c
h
ar
ac
ter
i
s
tics
.
B
es
id
es,
t
h
ese
alg
o
r
ith
m
s
ar
e
o
n
l
y
s
u
itab
le
f
o
r
s
m
al
l
an
d
m
ed
i
u
m
d
ataset
s
.
Fo
r
lar
g
e
d
atasets
,
it
is
n
ec
ess
ar
y
to
u
s
e
th
e
P
C
A
m
et
h
o
d
.
T
h
er
ef
o
r
e,
w
e
t
h
in
k
th
at
m
o
n
ito
r
i
n
g
s
y
s
te
m
s
n
ee
d
to
co
n
s
tan
tl
y
u
p
d
ate
an
d
r
ee
v
alu
a
te
th
e
tr
ai
n
i
n
g
m
o
d
el
to
ch
a
n
g
e
th
e
v
al
u
es a
n
d
r
o
les o
f
f
ea
tu
r
es to
en
s
u
r
e
th
at
all
u
s
e
f
u
l f
ea
tu
r
es a
r
e
u
s
ed
.
5.
CO
NCLU
SI
O
N
C
y
b
er
-
a
ttack
tech
n
iq
u
e
s
h
av
e
al
w
a
y
s
b
ee
n
a
n
d
w
ill
al
wa
y
s
b
e
m
aj
o
r
ch
allen
g
es
f
o
r
in
tr
u
s
io
n
m
o
n
ito
r
i
n
g
a
n
d
d
etec
tio
n
s
y
s
te
m
s
.
W
it
h
th
e
g
o
al
o
f
o
p
ti
m
izin
g
th
e
c
y
b
er
-
attac
k
d
etec
ti
o
n
p
r
o
ce
s
s
,
in
o
u
r
r
esear
ch
,
w
e
p
r
o
p
o
s
ed
t
w
o
m
ai
n
p
r
o
b
le
m
s
:
o
p
ti
m
izin
g
th
e
at
tack
d
etec
tio
n
m
e
th
o
d
b
y
u
s
in
g
th
e
R
F
s
u
p
er
v
i
s
ed
lear
n
i
n
g
al
g
o
r
ith
m
an
d
o
p
ti
m
izi
n
g
f
ea
t
u
r
es
b
ase
d
o
n
f
ea
t
u
r
e
d
i
m
e
n
s
io
n
r
ed
u
ct
io
n
tech
n
iq
u
es.
T
h
e
ex
p
er
i
m
e
n
tal
r
e
s
u
l
ts
ab
o
u
t
d
etec
tin
g
c
y
b
er
-
attac
k
s
u
s
i
n
g
th
e
R
F
a
lg
o
r
it
h
m
s
h
o
w
t
h
at
th
e
R
F
al
g
o
r
ith
m
h
as
b
ee
n
ef
f
ec
ti
v
e
n
o
t
o
n
l
y
f
o
r
th
e
ab
ilit
y
to
ac
cu
r
atel
y
d
ete
ct
attac
k
s
b
u
t
al
s
o
f
o
r
t
h
e
ab
i
li
t
y
to
l
i
m
it
t
h
e
f
al
s
e
d
etec
tio
n
o
f
a
ttack
s
w
h
e
n
t
h
e
ex
p
er
i
m
e
n
tal
d
ataset
h
as
a
l
ar
g
e
d
if
f
er
en
ce
b
et
w
ee
n
n
o
r
m
al
d
ata
a
n
d
c
y
b
er
-
attac
k
d
ata.
Fo
r
th
e
f
ea
tu
r
e
o
p
tim
izatio
n
p
r
o
ce
s
s
,
f
ea
t
u
r
e
d
im
e
n
s
io
n
r
ed
u
ctio
n
m
et
h
o
d
s
r
em
o
v
ed
m
an
y
f
ea
t
u
r
es.
I
n
p
ar
ticu
lar
,
th
e
co
r
r
elatio
n
co
ef
f
icien
t
m
et
h
o
d
d
ec
r
ea
s
ed
b
y
2
6
%,
I
G
d
ec
r
ea
s
ed
b
y
3
2
%,
an
d
P
C
A
d
ec
r
ea
s
ed
b
y
4
3
%
o
f
th
e
n
u
m
b
er
o
f
f
ea
t
u
r
es.
Alth
o
u
g
h
t
h
e
n
u
m
b
er
o
f
f
ea
tu
r
es
is
r
ed
u
ce
d
,
th
e
d
etec
tio
n
m
et
h
o
d
s
till
en
s
u
r
es
t
h
e
ef
f
ic
ien
c
y
o
f
ac
c
u
r
ac
y
as
w
ell
as
th
e
d
etec
tio
n
ti
m
e.
T
h
is
s
h
o
ws
th
at
d
i
m
e
n
s
io
n
al
r
ed
u
ctio
n
m
et
h
o
d
s
s
elec
ted
an
d
elim
i
n
ated
ac
cu
r
atel
y
r
ed
u
n
d
an
t
f
ea
t
u
r
es.
W
ith
th
e
r
es
u
lts
,
o
u
r
p
a
p
er
h
as
n
o
t
o
n
l
y
p
r
o
v
id
ed
n
et
w
o
r
k
attac
k
m
o
n
ito
r
in
g
an
d
d
etec
tio
n
s
y
s
te
m
s
w
it
h
cr
iter
ia
to
ch
o
o
s
e
f
r
o
m
to
en
s
u
r
e
th
e
ti
m
e
an
d
e
f
f
icien
c
y
o
f
t
h
e
d
etec
tio
n
p
r
o
ce
s
s
b
u
t
also
p
r
o
v
ed
t
h
at:
to
o
p
ti
m
ize
th
e
d
etec
tio
n
o
f
c
y
b
er
-
attac
k
s
,
i
t
is
n
o
t
n
ec
e
s
s
ar
y
to
u
s
e
ad
v
a
n
ce
d
alg
o
r
ith
m
s
w
it
h
co
m
p
lex
an
d
cu
m
b
er
s
o
m
e
co
m
p
u
tatio
n
al
r
eq
u
ir
e
m
e
n
t
s
,
it
m
u
s
t
d
ep
en
d
o
n
th
e
m
o
n
ito
r
in
g
d
ata
f
o
r
s
elec
ti
n
g
th
e
r
ea
s
o
n
ab
le
f
ea
t
u
r
e
ex
tr
ac
tio
n
an
d
o
p
tim
iza
tio
n
alg
o
r
ith
m
as
w
el
l
as
t
h
e
ap
p
r
o
p
r
iate
attac
k
d
etec
tio
n
alg
o
r
i
th
m
s
.
I
n
t
h
e
f
u
t
u
r
e,
w
e
w
ill
c
o
n
tin
u
e
to
r
esear
ch
an
d
p
r
o
p
o
s
e
to
a
p
p
ly
o
u
r
ap
p
r
o
ac
h
o
n
o
th
er
ex
p
er
im
e
n
ta
l
d
ata
s
ets
o
f
cy
b
er
-
at
tack
s
s
u
ch
as
I
DS
2
0
1
8
,
C
T
U
1
3
,
etc.
B
esid
es,
w
e
w
ill
i
m
p
r
o
v
e
d
ata
d
i
m
e
n
s
io
n
r
ed
u
ctio
n
s
o
l
u
tio
n
s
b
a
s
ed
o
n
i
n
f
o
r
m
atio
n
r
ep
r
esen
tatio
n
m
et
h
o
d
s
o
f
f
ea
t
u
r
es o
r
u
s
i
n
g
g
r
ap
h
t
h
eo
r
y
.
RE
F
E
R
E
NC
E
S
[1
]
R
.
M
a
rk
u
s
,
e
t
a
l.
,
“
A
su
rv
e
y
o
f
n
e
tw
o
rk
-
b
a
s
e
d
in
tru
si
o
n
d
e
tec
ti
o
n
d
a
ta
se
ts,
”
Co
mp
u
t
e
rs
&
se
c
u
rity
,
v
o
l.
8
,
n
o
.
6
,
p
p
.
1
4
7
-
1
6
7
,
2
0
1
9
.
[2
]
Kh
.
A
n
sa
m
,
e
t
a
l.
,
“
S
u
rv
e
y
o
f
i
n
tru
si
o
n
d
e
tec
ti
o
n
sy
ste
m
s:
t
e
c
h
n
iq
u
e
s,
d
a
tas
e
ts
a
n
d
c
h
a
ll
e
n
g
e
s,
”
Cy
b
e
rs
e
c
u
rity
,
v
o
l.
2
0
,
p
p
.
2
-
2
0
,
2
0
1
9
.
[3
]
A.
T
.
A
d
m
a
ss
u
,
a
n
d
S
.
N.
P
ra
m
o
d
.
,
“
A
r
e
v
ie
w
o
n
so
f
t
w
a
r
e
d
e
f
in
e
d
n
e
tw
o
rk
se
c
u
rit
y
ris
k
s
a
n
d
c
h
a
ll
e
n
g
e
s,
”
T
EL
KOM
NIKA
T
e
lec
o
mm
u
n
ic
a
ti
o
n
,
C
o
mp
u
ti
n
g
,
El
e
c
tro
n
ics
a
n
d
Co
n
tro
l,
v
o
l.
1
7
,
n
o
.
6
,
p
p
.
3
1
6
8
-
3
1
7
4
,
2
0
1
9
.
[4
]
C
y
b
e
r
Ed
g
e
Gro
u
p
,
“
2
0
1
9
C
y
b
e
rth
re
a
t
De
fe
n
se
Re
p
o
rt,
”
Imp
e
rv
a
,
2
0
1
9
.
[
O
n
li
n
e
]
.
A
v
a
il
a
b
le:
h
tt
p
s:/
/www
.
i
m
p
e
rv
a
.
c
o
m
/re
so
u
rc
e
s/re
p
o
rts/Cy
b
e
rEd
g
e
-
2019
-
CD
R
-
Re
p
o
rt
-
v
1
.
1
.
p
d
f
.
[5
]
Jo
e
L
e
v
y
,
“
S
o
p
h
o
s
2
0
2
0
T
h
re
a
t
Re
p
o
rt,
”
S
o
p
h
o
s
,
2
0
1
9
,
[
O
n
li
n
e
]
.
A
v
a
il
a
b
le:
h
tt
p
s://
ww
w
.
so
p
h
o
s.co
m
/en
-
u
s/m
e
d
ialib
ra
r
y
/P
DFs/t
e
c
h
n
ica
l
-
p
a
p
e
rs/so
p
h
o
sla
b
s
-
u
n
c
u
t
-
2
0
2
0
-
t
h
re
a
t
-
re
p
o
rt.
p
d
f
.
[6
]
A
.
M
o
h
iu
d
d
i
n
,
M
.
A
b
d
u
n
,
H.
Jia
n
k
u
n
,
“
A
S
u
rv
e
y
o
f
N
e
t
w
o
rk
A
n
o
m
a
l
y
D
e
tec
ti
o
n
T
e
c
h
n
iq
u
e
s,
”
J
o
u
rn
a
l
o
f
Ne
two
rk
a
n
d
Co
m
p
u
ter
A
p
p
li
c
a
ti
o
n
s
,
v
o
l
.
6
0
.
p
p
.
1
9
-
3
1
,
2
0
1
5
.
[7
]
J.
J.
A
rth
u
r,
e
t
a
l.
,
“
Re
v
ie
w
o
f
t
h
e
m
a
c
h
in
e
lea
rn
in
g
m
e
th
o
d
s
in
th
e
c
las
si
f
ica
ti
o
n
o
f
p
h
ish
in
g
a
tt
a
c
k
,
”
Bu
ll
e
ti
n
o
f
El
e
c
trica
l
En
g
in
e
e
rin
g
a
n
d
In
f
o
r
ma
ti
c
s
(
BE
EI)
,
v
o
l.
8
,
v
o
.
4
,
p
p
.
1
5
4
5
-
1
5
5
5
,
2
0
1
9
.
[8
]
D.
X.
Ch
o
,
e
t
a
l
.
“
A
n
a
d
a
p
ti
v
e
a
n
o
m
a
l
y
re
q
u
e
st
d
e
tec
ti
o
n
f
ra
m
e
wo
rk
b
a
se
d
o
n
d
y
n
a
m
ic
w
e
b
a
p
p
li
c
a
ti
o
n
p
ro
f
il
e
s,
”
In
ter
n
a
t
io
n
a
l
J
o
u
rn
a
l
o
f
E
lec
trica
l
a
n
d
C
o
mp
u
ter
En
g
in
e
e
rin
g
(
IJ
ECE
)
,
v
o
l.
1
0
,
n
o
.
5
,
p
p
.
5
3
3
5
-
5
3
4
6
,
2
0
2
0
.
[9
]
T
h
e
UN
S
W
-
NB1
5
Da
tas
e
t
De
sc
rip
ti
o
n
,
“
Un
iv
e
rsity
o
f
N
e
w
S
o
u
th
W
a
les
C
a
n
b
e
rra
,
”
2
0
2
0
.
[
O
n
li
n
e
]
.
A
v
a
il
a
b
le:
h
tt
p
s:/
/www
.
u
n
sw
.
a
d
f
a
.
e
d
u
.
a
u
/u
n
sw
-
c
a
n
b
e
rra
-
c
y
b
e
r/c
y
b
e
r
se
c
u
r
it
y
/
A
DF
A
-
NB1
5
-
Da
tas
e
ts/.
[1
0
]
K.
V
ik
a
sh
.
,
e
t
a
l.
,
“
A
n
in
teg
ra
ted
ru
le
b
a
se
d
in
tru
si
o
n
d
e
tec
ti
o
n
sy
ste
m
:
a
n
a
l
y
sis
o
n
UN
S
W
-
NB1
5
d
a
ta
se
t
a
n
d
th
e
re
a
l
ti
m
e
o
n
li
n
e
d
a
tas
e
t,
”
Clu
ste
r
Co
mp
u
t
in
g
,
v
o
l
.
2
3
,
p
p
.
1
3
9
7
-
1
4
1
8
,
2
0
1
9
.
Evaluation Warning : The document was created with Spire.PDF for Python.