IAES Inter national J our nal of Articial Intelligence (IJ-AI) V ol. 14, No. 2, April 2025, pp. 1260 ∼ 1270 ISSN: 2252-8938, DOI: 10.11591/ijai.v14.i2.pp1260-1270 ❒ 1260 Enhanced intrusion detection thr ough dual r eduction and r ob ust mean Ar chi T aha, Mohammed Benattou LaRI Computer Science Research Laboratory , Ibn T of ail Uni v ersity , K enitra, Morocco Article Inf o Article history: Recei v ed Jun 26, 2024 Re vised No v 5, 2024 Accepted No v 14, 2024 K eyw ords: Intrusion detection system Linear discriminent analysis Principal component analysis Rob ust intrusion detection system UNSW -NB15 ABSTRA CT The e xponent ial gro wth of online netw orks necessitates a paradigm shift in intru- sion detection systems (IDS). T raditional m ethods f alter under the massi v e inux of dat a, resulting i n high f alse positi v es and reduced detection accurac y . This research introduces a no v el approach combining principal component analysis (PCA) and linear discriminant analysis (LD A), augmented by rob ust generalized sample mean, to enhance IDS performance. PCA ef ciently reduces data dimen- sionality , while LD A e xtracts critical features that dif ferentiate normal netw ork traf c from anomalies. The rob ust generalized sample m ean counteracts the inuence of outliers, ensuring accurate and reliable analysis. Implemented on the UNSW -NB15 dataset, our method achie v es an a v erage 6% reduction in f alse positi v es and a 10% increase in detection rate. Additionally , our testing method- ology closely mirrors real-w orld conditions, making the results more represen- tati v e of practical scenarios compared to e xisting w ork. These adv ancements demonstrate substantial impro v ements in IDS performance and rob ustness o v er e xisting techniques. This is an open access article under the CC BY -SA license . Corresponding A uthor: T aha Archi LaRI Computer Science Research Laboratory , Ibn T of ail Uni v ersity K enitra, Morocco Email: architaha1@gmail.com 1. INTR ODUCTION In today’ s digital landscape, the protection of online domains ag ainst c yber threats has become increasingly critical. Intrusion detection systems (IDS) serv e as a vital line of defense, designed to identify and thw art unauthorized acti vities within netw orks. These systems emplo y a wide array of techniques, from traditional rule-based methods to cutting-edge machine learning algori thms, to safe guard digital infrastruc- tures. The signicance of IDS lies in their capacity for continuous monitoring and alerting, which is essential to staying ahead of increasingly sophisticate d c yber adv ersaries [1]. As c yber threats e v olv e, the inte gration of articial intelligence (AI) and adv anced data analytics into IDS has become indispensable [2]. Ho we v er , the rapid e xpansion of data and the gro wing comple xity of digital netw orks ha v e intensied the necessity for more rob ust IDS to counter emer ging c yber threats [3]. Adv ersaries continuously e xploit vulnerabilities, necessitating more agile and adapti v e IDS solutions. T raditional rule-based systems, while ef fecti v e in certain scenarios, often rely on static signatures and predened rules, which are inadequate in the f ace of dynamic and e v olving threats. This limitation can result in increased f alse positi v es and missed detections, lea ving netw orks vulnerable to undetected breaches [4]. T o address these shortcomings, the incorporation of machine learning techniques into IDS frame w orks has ushered in a ne w era of threat detection. Deep learning, particularly through con v olutional neural netw orks J ournal homepage: http://ijai.iaescor e .com Evaluation Warning : The document was created with Spire.PDF for Python.
Int J Artif Intell ISSN: 2252-8938 ❒ 1261 (CNNs), has emer ged as a po werful tool for identifying comple x patterns and anomalies within lar ge datasets. These model s enable IDS to adapt and learn from e v olving attack strate gies with greater precision. Hybrid classication approaches, which combine multiple machine learning techniques, ha v e further enhanced IDS performance, sho wcasing the potential of machine learning to signicantly impro v e netw ork security [5], [6]. Additionally , the application of deep learning in specialized en vironments, such as mobile ad hoc netw orks (MANET), has sho wn promising results [7]. Despite these adv ancements, the sheer v olume and high dimensionality of netw ork traf c data pres ent signicant challenges for machine learning-based IDS. Managing such lar ge-scale data can o v erwhelm these systems, compromising their ef cienc y and accurac y . Moreo v er , machine learning-based IDS must contend with issues such as handl ing di v erse data sources, pri v ac y concerns, susceptibility to adv ersarial attacks, and the comple xities of deplo yment in lar ge-scale en vironments [8], [9]. The presence of noise and irrele v ant features within datasets e xacerbates these challenges, leading to decreased performance [10]. T o mitig ate these issues, dimensionality reduction techniques l ik e principal component analysis (PCA) and linear discriminant analysis (LD A) are essential [11], [12]. PCA helps reduce dimensions by capturing the most signicant v ariance, while LD A impro v es classication by maximizing class separability . Ho we v er , both techniques ha v e inherent limitations—PCA is sensiti v e to outliers, and LD A assumes linear separability , which may not al w ays be applicable in comple x datasets [13], [14]. Combining dimensionality reduction with adv anced machine learning methods can signi cantly enhance the performance of IDS [15]. Ho we v er , outliers and irre gularities in datasets remain a persistent challenge. Outliers can distort data structures, ne g ati v ely impacting both dimensionality reduction and machine learning techniques. T o alle viate these ef fects, preprocessing steps such as outlier remo v al and the application of rob ust statistical methods are crucial [16], [17]. T echniques lik e the generalized sample mean (GSM) can enhance IDS rob ustness, ensuring more accurate threat detection [18]. Achie ving rob ust netw ork security requires the inte gration of machine learning, dimens ionality reduction, and rob ust statistical methods. By le v eraging the strengths of each approach while addressing their weaknesses, IDS can e v olv e into formidable defenses ag ainst increasingly sophisticated c yber threats [19], [20]. As the threat landscape continues to e v olv e, the demand for inno v ati v e, adapti v e IDS solutions to protect digital infrastructures becomes e v er more pressing. Our research tackl es these critical challenges by de v eloping an IDS frame w ork that inte grates PCA and LD A [21]. This inno v ati v e frame w ork combines the strengths of both dimensionality reduction techniques to enhance the ef fecti v eness of IDS in managing lar ge dat asets. By incorporating the GSM into both PCA and LD A, we aim to impro v e IDS rob ustness ag ainst outliers, thereby addressing a signicant g ap in current IDS methodologies. Our approach is designed to yield results that closely mirror real-life scenarios, achie ving a high detection rate (DR) and a lo wer f alse positi v e rate (FPR) in a realistic setting using the UNSW -NB15 dataset. This demonstrates superior performance and rob ustness compared to traditional methods. This paper consists of the follo wing: section 2 of fers a detailed theoretical foundation for GSM and its inte gration with PCA-LD A, pro viding insights into ho w these techniques can be ef fecti v ely applied to real- w orld data. Section 3 presents an o v ervie w of our IDS model, detailing the implementation and the specic contrib utions of each component. In section 4, we rigorously e v aluate the performance and rob ustness of the proposed method through e xtensi v e e xperimentation and analysis. Finally , section 5 summarizes the k e y ndings from our e v aluation and suggests potential directions for future research, emphasizing the ongoing need for inno v ation in IDS methodologies to k eep pace with the e v er -e v olving c yber threat landscape. 2. FORMAL MODEL This section e xplores the application of the GSM to enhance the rob ustnes s of PCA and LD A ag a inst outliers. W e be gin by e xamining the mathematical foundations of GSM and demonstrating its ef fecti v eness in mitig ating the impact of anomalous data points. Subsequently , we outline the o v erarching strate gy for our com- bined PCA-LD A approach, e xplaining the rationale behind its inte gration. By combining the outlier -resistant properties of GSM with the complementary strengths of PCA and LD A, we aim to signicantly impro v e the performance of our IDS. 2.1. Generalized sample mean In v arious elds, data analysis and optimization techniques often seek rob ustness to enhance reli ability . The generalized mean emer ges as a po werful tool in this conte xt, pro viding e xibility and adaptability through Enhanced intrusion detection thr ough dual r eduction and r ob ust mean (Ar c hi T aha) Evaluation Warning : The document was created with Spire.PDF for Python.
1262 ❒ ISSN: 2252-8938 its parameter p, which controls the emphasis on dif ferent parts of the dataset. Unlik e traditional means, which may be sensiti v e to outliers and de viations from the norm, the generalized mean can adjust to di v erse data characteristics by v arying p. Consider a v ector V of M positi v e v alues: V = ( v 1 , v 2 , . . . , v M ) , where v i > 0 for i = 1 , 2 , . . . , M The generalized mean G m of V , for a po wer p with p ̸ = 0 , is dened as (1): G m =   1 M M X i =1 v p i ! 1 p (1) − When p = 1 , the generalized mean reduces to the arithmetic mean. − When p = 0 , it approaches the geometric mean (with a slight modication to account for zero v alues) − When p = − 1 , it becomes the harmonic mean. The research in [22], [23] propose a signicant im pro v ement to PCA by le v eraging the GSM. This approach replaces the traditional, outlier -sensiti v e mean with the generalize d mean, enhancing the rob ustness of mean estimation. By adjusting the parameter ’p, ’ which controls the inuence of indi vidual data points, this method ef fecti v ely mitig ates the impact of outliers. The traditional sample mean, is vie wed as the centroid in terms of least squares, as gi v en in (2), where m being the v ector mean. S m = arg min m " 1 M M X i =1 ∥ v i − m ∥ 2 2 # (2) In (2) highlights a critical is sue: the objecti v e function’ s reliance on squared distances amplies the inuence of outliers in training samples. T o address this challenge and achie v e more rob ust sample mean estimation in the presence of outliers, a no v el optimization approach is proposed. This approach in v olv es replacing the arithmetic mean used in (2) with the generalized mean. g sm = arg min   1 M M X i =1  ∥ v i − m ∥ 2 2 p 1 p ! (3) When p = 1 , this problem becomes equi v alent to (2). As the v alue of p decreases, the inuence of lar ge numbers on the objecti v e function diminishes. This demonstrates that setting p greater than 1 ( p > 1 ) mitig ates the adv erse impact of outliers. W e can le v erage the property that x p is a monotonically increasing function for positi v e v alues of x ( x > 0 ) to reformulate this problem for p > 0 as (4): g sm = arg min   M X i =1 ∥ v j − m ∥ 2 2 p ! (4) T o qualify as a local minimum, g sm requires the gradient of the objecti v e function in (4) with respect to m to reach zero. In simpler terms as (5): ∂ ∂ m M X j =1 ∥ v j − m ∥ 2 2 p = 0 (5) Unfortunately , nding a closed-form solution for the equation abo v e pro v es challenging. The research in [22], [23] of fers a v aluable insight: the generalized mean of pos iti v e numbers can be e xpressed as a non-ne g ati v e linear combination of the elements in the set. This e xpression can be further simplied as sho wn in (6): M X i =1 a p i = b 1 a 1 + · · · + b M a M with b i = a p − 1 i and i = 1 , . . . , M (6) In the deri v ation, we decompose (4) into the form of (6) and consider the weight b i in (6) as a constant. Then, in (4) can be approximated by a quadratic function of ∥ v i − m ∥ 2 2 , which can easily be optimized. Int J Artif Intell, V ol. 14, No. 2, April 2025: 1260–1270 Evaluation Warning : The document was created with Spire.PDF for Python.
Int J Artif Intell ISSN: 2252-8938 ❒ 1263 M X j =1 ∥ v j − m ∥ 2 2 p ≈ M X j =1 γ ( iter ) j ∥ v j − m ∥ 2 2 (7) Where: γ j ( iter ) = ( v j − m ( iter ) 2 2 ) p − 1 (8) The approximation reaches its peak accurac y when m = m ( iter ) . The ne xt step in v olv es nding the v alue of g ( iter +1) sm that minimizes the approximated function. This minimization considers the pre viously computed v alues of γ ( iter ) j . The solution is gi v en by (9): g ( iter +1) sm = 1 P M j =1 γ j ( iter ) M X j =1 γ j ( iter ) v j (9) The follo wing algorithm pro vides a summary of the steps to nd the GSM. Algorithm 1 Generalized sample mean Requir e: matrix data and p 1: T ← 0 2: g ( T ) sm ← m 3: r epeat 4: A ppr oximation: for x ed g ( T ) sm , compute γ ( T ) j using (8) 5: Minimization: Using the computed γ ( T ) j , update g ( T +1) sm according to (9) 6: T ← T + 1 7: until a termination condition is met Ensur e: g sm = g ( T ) sm T o illustrate the ef fect of the GSM, we generate 100 random data points follo wing a Gaussian dist ri- b ution. These points reside in a tw o-dimensional space. Here, we introduce 30 outliers, a considerable portion of the total 100 data points, outliers are mark ed red on the plot for easy identication. The script calculates tw o dif ferent means: the arithmetic mean and the GSM (using only one iterati on). W e observ e in Figure 1, that the ari thmetic mean is hea vily inuenced by the outliers. In contrast, the GSM, calculated with po wer v alues of p = 0.3 and p = 0.7, sho ws less sensiti vity to outliers. Interestingly , the mean with p = 0.3 is closer to the ”normal” points compared to p = 0.7. This demonstrates that the GSM is less af fected by outliers, and the po wer parameter (p) has a signicant impact on the calculated mean. Figure 1. V isualization of data distrib ution with outliers and mean comparisons Enhanced intrusion detection thr ough dual r eduction and r ob ust mean (Ar c hi T aha) Evaluation Warning : The document was created with Spire.PDF for Python.
1264 ❒ ISSN: 2252-8938 2.2. Principal component analysis-linear discriminant analysis (GSM) combination appr oach PCA for dimensionality reduction comes with trade-of fs. It e xcels at capturing the most v ariable aspects of data, b ut it ignores class labels. This can lead to features that are not ideal for classication, potentially k eeping irrele v ant information instead of focusing on what separates the classes. LD A tackles classication by maximizing separation between classes. Ho we v er , it mak es ass umptions about the data that may not be true in practice, lik e normally dis trib uted classes with similar properties. These unrealistic assumptions can hinder LD A ’ s performance. Additionally , outliers can signicantly impact LD A ’ s results, reducing its ef fecti v eness. A combined approach using PCA and LD A can address these limitations. By using PCA rst, we can reduce the number of features and lessen the impact of noise. Then, LD A tak es o v er to maximize class separation in the lo wer -dimensional space. This tw o-step process ensures we k eep the most informati v e features while making them highly rele v ant for classifying the data. Furthermore, incorporating a rob ust mean, lik e the GSM, strengthens this combined method. This specic type of mean is less af fected by outliers and non-normal data distrib utions, making the o v erall ap- proach more reliable and accurate. The follo wing steps outline the GSM PCA-LD A process for dimensionality reduction. a. Extract k e y features: Compute the principal components of the data matrix Y using GSM-PCA. b . Select informati v e components: Retain the top m principal components with the highest v ariance, where m denes the tar get dimensionality . c. Project data to lo wer dimension: Obtain a lo wer -dimensional representation R by project ing the dat a using the selected components. d. Calculate class-wise central tendenc y: Compute the GSM for each class in the projected data R , representing the center of each class. e. Compute class separation: Calculate the between-class and within-class scatter matrices using the generalized means, capturing the distrib ution of data points within and between classes. f. Find optimal transformation: Obtain the projection matrix Z via eigen v alue decomposition of the scatter matrices, identifying the best direction to project the data for class separation. g. T ransform data to nal representation: T ransform the data to the ne w subspace using Z to obtain the nal reduced-dimensional representation Z d . 3. CLASSIFICA TION METHOD T o e v aluate the impact of training data size on IDS performance, we manipulate the v olume of training data. A k e y challenge in IDS training is dif ferentiating between v arious attack types, often due to inherent similarities among them. W e address this challenge by treating each attack type as a separate class, in addition to a class for normal netw ork connections. W e then incrementally increase the number of connections for both normal and attack types within each class, applying the same approach to the testing data. This method allo ws us to systematically assess ho w data quantity inuences the ef fecti v eness of IDS models in identifying di v erse netw ork security threats. The UNSW -NB15 dataset serv es as a critical resource for this research. It of fers a unique blend of real-w orld netw ork traf c captured from a controlled en vironment and synthetically generated contemporary attacks, reecting the modern threat landscape [24]. This combination mak es UNSW -NB15 ideal for training and e v aluating machine learning models for ef fecti v e IDS de v elopment [25]. The dataset encompasses a wide range of attack cate gories, including denial-of-service (DoS), e xploits, w orms, backdoors, reconnaissance, analysis, shellcode, and generic attacks. This v ariety allo ws researchers to b uild rob ust IDS models capable of detecting a broad spectrum of netw ork security threats. Despite its strengths, UNSW -NB15 assumes a normal data distrib ution, potentially af fecting results due to outliers. As the number of features in the UNSW -NB15 dataset can be high (49 features, reaching 211 features after one-hot encoding), we emplo y a dimensionality reduction process to reduce the feature set to a more manageable size. This helps impro v e the ef cienc y and accurac y of machine learning algorithms . W e utilize a Int J Artif Intell, V ol. 14, No. 2, April 2025: 1260–1270 Evaluation Warning : The document was created with Spire.PDF for Python.
Int J Artif Intell ISSN: 2252-8938 ❒ 1265 tw o-step approach for this purpose. First, we perform PCA-GSM to reduce the number of features from 211 to 10. Subsequently , we apply LD A-GSM to further reduce the features to 2 dimensions. Figure 2 gi v es an o v ervie w about the IDS model. The process be gins by di viding the data into training and testing matrices, both containing normal traf c and attack samples. These matrices under go dimensionality reduction through PCA-GSM, creating projected v ersions of each. The y then under goes a second reduction using LD A-GSM, further rening the features. This dual reduction approach results in compact, information- rich repres entations of both test and training data. A classier is then trained on the training reduced matrice, learning to distinguish between normal netw ork acti vity and v arious c yber threats such as DoS attacks, e xploits, w orms, and backdoors. Figure 2. IDS model based on the combination of PCA-LD A (GSM) 4. FINDINGS AND AN AL YSIS This section e v aluates the performance of our proposed PCA-LD A (GSM) method compared to tra- ditional PCA. T o assess the ef fecti v eness of these approaches, we emplo y tw o standard metrics: DR and FPR. These metrics quantitati v ely measur e the system’ s ability to accurately identify intrusions while minimizing f alse alarms. F or our e xperiments, we utilize decision trees, re gression trees, and k-nearest neighbors (KNN) as classication models. W e partition the dataset into training and testing matrices to e v aluate model performance under v arious conditions. Specically , we incrementally increase the size of both the training and test sets to assess the impact of data v olume on model accurac y . T o enhance the reliability and generalizability of our results, each performance metric for a gi v en training set size is the a v erage of 30 independent test runs. This approach mitig ates the inuence of random uctuations and pro vides a more rob ust performance estimate. T o address the class imbalance in the UNSW -NB15 dataset, we increase the training data for all attack cate gories while maintaining a x ed representation of the underrepresented attack types. Specically , we set 400 instances each for analysis and backdoor , 200 instances for shellcode, and 30 instances for w orms. The remaining at tack cate gories (fuzzers, DoS, e xploits, generic, and reconnaissance) are assigned an equal number of instances to ensure a balanced dataset. This approach allo ws us to enhance the model’ s learning of underrepresented attacks while maintaining an equitable distrib ution across all attack types, thereby impro ving the model’ s o v erall accurac y and rob ustness. The test data constitutes 10% of the training set, maintaining a consistent representation of underrepresented attack cate gories. T o ensure a comprehensi v e e v aluation, we iterati v ely test each scenario 30 times, co v ering a di v erse range of cases. This approach enhances the model’ s ability to generalize across dif ferent netw ork attacks, thereby impro ving both accurac y and rob ustness in real-w orld scenarios. W e in v esti g at e the inuence of the GSM’ s po wer parameter (p) on both PCA and LD A. T o achie v e rob ust results, we conduct tests with p-v alues of 0.3 and 0.7. The DR and FPR are subsequently calculated as a v erages of thirty randomly selected e v aluations for each training data size, demonstrating the consistenc y of results for lar ge datasets. 4.1. Detection rate classication In this section, we analyze the DR using PCA and a combination of rob ust PCA and LD A. The DR is a crucial metric for assessing the performance of an IDS, as it precisely quanties the system’ s ability to accurately ident ify malicious acti vities. By compari ng DR v alues obtained fr o m dif ferent me thodologies and classication models, we can e v aluate their ef fecti v eness in detecting di v erse attack types and identify the optimal approach for enhancing intrusion detection capabilities. It is calculated using the follo wing formula: Enhanced intrusion detection thr ough dual r eduction and r ob ust mean (Ar c hi T aha) Evaluation Warning : The document was created with Spire.PDF for Python.
1266 ❒ ISSN: 2252-8938 D R = T P T P + F N × 100 Where: T rue positi v es (TP): Instances where the model correctly identies positi v e cases. F alse ne g ati v es (FN): Cases where the model incorrectly identies ne g ati v e cases. By e xamining the DR, we can assess the ef fecti v eness of each model in accurately identifying dif ferent types of attacks. This analysis helps us understand the strengths of PCA and the rob ust PCA-LD A combination in detecting each specic attack cate gory . Across Figures 3 to 5, a consistent trend emer ges in the DR% depicted, sho wcasing similar outcomes o v erall. Notably , the inte gration of PCA-LD A (GSM) yields a signicant impro v ement in DR% across all tree classication methods. P articularly striking are the results observ ed in pure DR% with re gression tree classi- cation, where DR% ranges impressi v ely from 80% to 90%, compared to a lo wer 66% with PCA, peaking at 78% optimally . Furthermore, emplo ying the combination approach with re gression trees results in a remarkable 15% increase in DR%. Figure 3. DR with decision tree Figure 4. DR with re gression tree Int J Artif Intell, V ol. 14, No. 2, April 2025: 1260–1270 Evaluation Warning : The document was created with Spire.PDF for Python.
Int J Artif Intell ISSN: 2252-8938 ❒ 1267 Figure 5. DR with KNN Con v ersely , KNN e xhibits the least f a v orable performance in both DR% and the o v erall enhancement achie v ed through the PCA-LD A combination. Starting at a modest 66%, KNN reaches a maximum of 82%, compared to PCA ’ s initial 58%, which only climbs to 70%. Ho we v er , despite this, the combined methodology boosts the o v erall DR% by 10%. In the case of decision trees, PCA-LD A be gins with a 71% DR%, reaching up to 81%, while PCA starts at 55%, ascending only to 62%, marking the lo west DR% among the three cases. Notably , decision trees demonstrate the highest o v erall boost in DR%, a v eraging o v er 20%, emphasizing ho w the combination of PCA- LD A (GSM) can enhance DR% e v en in unf a v orable conditions. In conclusion, the inte gration of PCA-LD A (GSM) consistently impro v es DR% across all tree cases, e v en with minimal training data, yielding rob ust and reliable results. 4.2. F alse positi v e rate classication In this section, we e v aluate the FPR using PCA and the combination of rob ust PCA and LD A. The FPR is another critical metri c that quanti es the proportion of benign instances erroneously classied as malicious by the model. Minimizing the FPR is essential to reduce the number of f alse alarms and maintain system ef cienc y while ensuring adequate security . It is calculated using the follo wing formula: F P R = F P F P + T N × 100 Where: F alse positi v es (FP): Situations where the model incorrectly identies positi v e cases. T rue ne g ati v es (TN): Scenarios where the model correctly identies ne g ati v e cases. Analyzing the FPR is essential to ensure that the IDS does not produce an e xcessi v e number of f al se alarms, which can lead to unnecessary interv entions and reduced trust in the system. This section compares the performance of PCA and the rob ust PCA-LD A combination in minimizing f alse positi v es across dif ferent attack cate gories. When e xamining the FPR across Figures 6 to 8, the combination of PCA-LD A (GSM) consistently yields superior FP R across all classication methods. It’ s notable that the FPR in the case of re gression tree tends to be higher compared to both decision tree and KNN methods. Specically , when emplo ying PCA, the FPR be gins at 16% and decreases to 10%, while the combination method starts at 9% and decreases to less than 4%. Ov erall PCA-LD A (GSM) reduces the FPR by an a v erage of 6%. Enhanced intrusion detection thr ough dual r eduction and r ob ust mean (Ar c hi T aha) Evaluation Warning : The document was created with Spire.PDF for Python.
1268 ❒ ISSN: 2252-8938 Figure 6. FPR with decision tree Figure 7. FPR with re gression tree Figure 8. FPR with KNN Int J Artif Intell, V ol. 14, No. 2, April 2025: 1260–1270 Evaluation Warning : The document was created with Spire.PDF for Python.
Int J Artif Intell ISSN: 2252-8938 ❒ 1269 Switching to decision tree classication, the FPR starts at 7% with PCA and diminishes to 1%, whereas emplo ying the PCA-LD A (GSM) combination initiates at 5% and declines to 0.5%. It’ s e vident that the PCA-LD A (GSM) combinati on consistently yields a superior FPR, a v eraging at 1.5%. In the case of KNN classication, PCA start at a 7% FPR, while the PCA-LD A (GSM) combination starts at 5%. W ith an increase in training data, both methods con v er ge to nearly identical FPRs of 0.5%. Ov erall, the combination approach reduces the FPR by 2% in this scenario. 5. CONCLUSION This study in v estig ated the ef fecti v eness of a combined PCA and LD A for IDS. The goal of combining PCA and LD A w as to reduce dimensionality while retaining the most cri tical information for intrusion detec- tion. The GSM, a rob ust mean, further impro v es performance when handling lar ge datasets by mitig ating the impact of outliers. The parameter ‘p‘ in the GSM plays a crucial role in achie ving this by lessening the inu- ence of outliers in the process. The ndings of the study are compelling. The PCA-LD A (GSM) combination consistently led to signicant impro v ements across all three class ication methods (re gression tree, decision tree, and KNN) compared to using PCA alone. These impro v ements manifested as increased DR, reduced FPR for training set sizes. Notably , the impro v ement w as most pronounced for re gression trees, sho wcasing a remarkable 15% increase in DR. One of the most signicant aspects of this study is the f act that the consistent impro v ement in performance across v arious metrics (DR, FPR, and accurac y) w as achie v ed while handling lar ge datasets. The ndings held true e v en with repeated e v aluations (30 times for each training data size). This strengthens the v alidity of the PCA-LD A (GSM) approach for real-w orld IDS applications, which typically deal with massi v e amounts of netw ork traf c data. REFERENCES [1] Amarudin, R. Ferdiana, and W idya w an, “ A systematic literature re vie w of intrusion detection system for netw ork security: research trends, datasets and methods, ” in 2020 4th International Confer ence on Informatics and Computational Sciences (ICICoS) , IEEE, 2020, pp. 1–6, doi: 10.1109/ICICoS51170.2020.9299068. [2] H. V . V o, H. P . Du, and H. N. Nguyen, “ AI-po wered intrusi on detection in lar ge-scale traf c netw orks based on o w sensing strate gy and parallel deep analysis, ” J ournal of Network and Computer Applications , v ol. 220, 2023, doi: 10.1016/j.jnca.2023.103735. [3] K. M. Sudar , P . Nag araj, P . Deepalakshmi, and P . Chinnasamy , “ Analysis of intruder detection in big data analytics, ” in 2021 International Confer ence on Computer Communication and Informatics (ICCCI) , IEEE, 2021, pp. 1–5, doi: 10.1109/IC- CCI50826.2021.9402402. [4] O. H. Abdulg aniyu, T . A. Tchak oucht, and Y . K. Saheed, “ A systematic literature re vie w for netw ork intrusion detection system (IDS), ” International J ournal of Information Security , v ol. 22, no. 5, pp. 1125–1162, 2023, doi: 10.1007/s10207-023-00682-2. [5] A. Khraisat, I. Gondal, P . V ample w , and J. Kamruzzaman, “Surv e y of intrusion detect ion systems: techniques, datasets and chal- lenges, ” Cyber security , v ol. 2, no. 1, 2019, doi: 10.1186/s42400-019-0038-7. [6] S. Choudhary and N. K ess w ani, “ A h ybrid classication approach for intrusion detection in IoT netw ork, ” J ournal of Scient ic and Industrial Resear c h , v ol. 80, no. 9, pp. 809–816, 2021, doi: 10.56042/jsir .v80i09.43878. [7] S. Laqtib, K. El Y assini, and M. L. Hasnaoui, “ A deep learning methods for intrus ion detection systems based machine learning in manet, ” in Pr oceedings of the 4th International Confer ence on Smart City Applications , Ne w Y ork, USA: A CM, 2019, pp. 1–8, doi: 10.1145/3368756.3369021. [8] M. Sarhan, S. Laye gh y , N. Moustaf a, M. Gallagher , and M. Portmann, “Feature e xtraction for machine learning-based intrusion detection in IoT netw orks, ” Digital Communications and Networks , v ol. 10, no. 1, pp. 205–216, 2024, doi: 10.1016/j.dcan.2022.08.012. [9] A. Thakkar and R. Lohiya, “ A re vie w on challenges and future research directions for machine learning-based intrusion detection systems, ” Ar c hives of Computational Methods in Engineering , v ol. 30, no. 7, pp. 4245–4269, 2023, doi: 10.1007/s11831-023- 09943-8. [10] M. A. Umar , Z. Chen, K. Shuaib, and Y . Liu, “Ef fects of feature selection and normalization on netw ork intrusi on detection, ” T ec hRxiv , pp. 1–18, 2024, doi: 10.36227/techrxi v .12480425.v3. [11] T . K urita, “Principal component analysis (PCA), ” in Computer V ision , Cham: Springer International Publishing, 2020, pp. 1–4, doi: 10.1007/978-3-030-03243-2 649-1. [12] S. Balakrishnama and A. Ganapathiraju, “Linear discriminant analysis-a brief tutorial, ” Institute for Signal and Information Pr o- cessing , Departme nt of Electri cal and Comput er Engi neering, Mississippi State Uni v ersity , Mississippi, United States of America, 1998. [13] A. T aha and B. Mohammed, “ An automatic truncated mean approach for PC A in intrusion detection systems, ” in 2023 10th In- ternational Confer ence on W ir eless Networks and Mobile Communications (WINCOM) , IEEE, 2023, pp. 1–6, doi: 10.1109/WIN- COM59760.2023.10323011. [14] R. Abdulhammed, H. Musafer , A. Alessa, M. F aezipour , and A. Ab uzneid, “Features dimensionality reduction approaches for machine learning based netw ork intrusion detection, ” Electr onics , v ol. 8, no. 3, 2019, doi: 10.3390/electronics8030322. [15] G. Lu and X. T ian, “ An ef cient communication intrusion detection scheme in AMI combining feature dimensionality reduction and impro v ed LSTM, ” Security and Communication Networks , v ol. 2021, 2021, doi: 10.1155/2021/6631075. Enhanced intrusion detection thr ough dual r eduction and r ob ust mean (Ar c hi T aha) Evaluation Warning : The document was created with Spire.PDF for Python.