I
nte
rna
t
io
na
l J
o
urna
l o
f
E
lect
rica
l a
nd
Co
m
pu
t
er
E
ng
ineering
(
I
J
E
CE
)
Vo
l.
15
,
No
.
6
,
Decem
b
er
20
25
,
p
p
.
5
5
7
0
~
5
5
8
3
I
SS
N:
2088
-
8
7
0
8
,
DOI
: 1
0
.
1
1
5
9
1
/ijece.
v
15
i
6
.
pp
5
5
7
0
-
5
5
8
3
5570
J
o
ur
na
l ho
m
ep
a
g
e
:
h
ttp
:
//ij
ec
e.
ia
esco
r
e.
co
m
Im
pro
v
ing
netwo
rk securi
ty using
deep learning
for
intrusio
n
detec
tion
M
o
ha
m
m
ed
Al
-
Sh
a
bi
1
,
Anm
a
r
Abuh
a
m
da
h
1
,
M
a
lek
Alza
qeba
h
2,
3
1
D
e
p
a
r
t
me
n
t
o
f
M
a
n
a
g
e
me
n
t
I
n
f
o
r
ma
t
i
o
n
S
y
st
e
m,
C
o
l
l
e
g
e
o
f
B
u
s
i
n
e
ss A
d
m
i
n
i
st
r
a
t
i
o
n
,
Ta
i
b
a
h
U
n
i
v
e
r
si
t
y
,
A
l
M
a
d
i
n
a
h
A
l
M
u
n
a
w
w
a
r
a
h
,
S
a
u
d
i
A
r
a
b
i
a
2
D
e
p
a
r
t
me
n
t
o
f
M
a
t
h
e
m
a
t
i
c
s
,
C
o
l
l
e
g
e
o
f
S
c
i
e
n
c
e
,
I
mam
A
b
d
u
l
r
a
h
ma
n
B
i
n
F
a
i
sa
l
U
n
i
v
e
r
si
t
y
,
D
a
mm
a
m
,
S
a
u
d
i
A
r
a
b
i
a
3
B
a
s
i
c
a
n
d
A
p
p
l
i
e
d
S
c
i
e
n
t
i
f
i
c
R
e
se
a
r
c
h
C
e
n
t
e
r
,
I
mam
A
b
d
u
l
r
a
h
m
a
n
B
i
n
F
a
i
sal
U
n
i
v
e
r
s
i
t
y
,
D
a
mm
a
m,
S
a
u
d
i
A
r
a
b
i
a
Art
icle
I
nfo
AB
S
T
RAC
T
A
r
ticle
his
to
r
y:
R
ec
eiv
ed
No
v
2
2
,
2
0
2
4
R
ev
is
ed
Ap
r
1
2
,
2
0
2
5
Acc
ep
ted
Ma
y
2
4
,
2
0
2
5
As
c
y
b
e
r
th
re
a
ts
a
n
d
n
e
two
r
k
c
o
m
p
lex
it
y
g
ro
w,
it
is
c
ru
c
ial
t
o
imp
lem
e
n
t
e
ffe
c
ti
v
e
in
tru
si
o
n
d
e
tec
ti
o
n
sy
st
e
m
s
(IDS)
to
sa
fe
g
u
a
rd
se
n
si
ti
v
e
d
a
ta
a
n
d
in
fra
stru
c
tu
re
.
Trad
it
io
n
a
l
m
e
th
o
d
s
o
fte
n
str
u
g
g
le
t
o
i
d
e
n
ti
f
y
s
o
p
h
isti
c
a
ted
a
tt
a
c
k
s,
n
e
c
e
ss
it
a
ti
n
g
a
d
v
a
n
c
e
d
a
p
p
r
o
a
c
h
e
s
li
k
e
m
a
c
h
in
e
lea
rn
i
n
g
(M
L)
a
n
d
d
e
e
p
lea
rn
i
n
g
(DL
).
T
h
is
st
u
d
y
e
x
p
l
o
re
s
th
e
a
p
p
li
c
a
ti
o
n
o
f
M
L
a
n
d
DL
a
lg
o
rit
h
m
s
in
IDS.
F
e
a
tu
re
se
lec
ti
o
n
tec
h
n
iq
u
e
s,
su
c
h
a
s
c
o
rre
latio
n
a
n
d
v
a
rian
c
e
a
n
a
ly
sis,
we
re
e
m
p
lo
y
e
d
to
i
d
e
n
ti
f
y
k
e
y
fa
c
to
rs
c
o
n
tr
ib
u
ti
n
g
to
a
c
c
u
ra
te
c
las
sifica
ti
o
n
.
T
o
o
ls
li
k
e
WE
KA
a
n
d
M
ATLAB
su
p
p
o
rted
d
a
ta
p
re
-
p
ro
c
e
ss
in
g
a
n
d
m
o
d
e
l
d
e
v
e
lo
p
m
e
n
t.
Us
i
n
g
th
e
UN
S
W
-
NB1
5
a
n
d
NSL
-
KD
D d
a
tas
e
ts,
th
e
stu
d
y
h
ig
h
li
g
h
ts t
h
e
su
p
e
ri
o
r
p
e
rf
o
rm
a
n
c
e
o
f
ra
n
d
o
m
fo
re
st
(RF
)
a
n
d
m
u
lt
i
-
lay
e
r
p
e
r
c
e
p
tro
n
(M
LP
)
a
lg
o
rit
h
m
s.
RF
e
n
se
m
b
le
d
e
c
isio
n
tree
s
a
n
d
M
LP
m
u
lt
i
-
l
a
y
e
re
d
a
rc
h
it
e
c
tu
re
e
n
a
b
le
a
c
c
u
ra
te
a
tt
a
c
k
d
e
tec
ti
o
n
,
d
e
m
o
n
stra
ti
n
g
t
h
e
p
o
ten
ti
a
l
o
f
t
h
e
se
a
d
v
a
n
c
e
d
tec
h
n
iq
u
e
s
f
o
r
e
n
h
a
n
c
e
d
n
e
two
rk
se
c
u
rit
y
.
K
ey
w
o
r
d
s
:
Dee
p
l
ea
r
n
in
g
I
n
tr
u
s
io
n
d
etec
tio
n
Ma
ch
in
e
l
ea
r
n
in
g
Netwo
r
k
s
ec
u
r
ity
R
an
d
o
m
f
o
r
est
T
h
is i
s
a
n
o
p
e
n
a
c
c
e
ss
a
rticle
u
n
d
e
r th
e
CC B
Y
-
SA
li
c
e
n
se
.
C
o
r
r
e
s
p
o
nd
ing
A
uth
o
r
:
An
m
ar
Ab
u
h
am
d
ah
Dep
ar
tm
en
t o
f
Ma
n
ag
em
e
n
t I
n
f
o
r
m
atio
n
Sy
s
tem
,
C
o
lleg
e
o
f
B
u
s
in
ess
Ad
m
in
is
tr
atio
n
,
T
aib
ah
Un
iv
er
s
ity
4
2
3
5
3
Me
d
in
a,
al
-
Ma
d
in
ah
al
-
Mu
n
aww
ar
ah
,
Kin
g
d
o
m
o
f
Sa
u
d
i A
r
ab
ia
E
m
ail:
aa
b
u
h
am
d
ah
@
taib
ah
u
.
ed
u
.
s
a
1.
I
NT
RO
D
UCT
I
O
N
T
h
e
r
ap
id
g
r
o
wth
in
d
ata,
te
ch
n
o
lo
g
y
,
a
n
d
s
m
ar
t
d
ev
ices
h
as
s
ig
n
if
ican
tly
in
cr
ea
s
ed
r
elian
ce
o
n
in
ter
n
et
-
co
n
n
ec
ted
s
y
s
tem
s
,
wh
ich
ar
e
n
o
w
i
n
teg
r
al
t
o
v
ar
io
u
s
asp
ec
ts
o
f
d
aily
life
[
1
]
–
[
3
]
.
As
a
r
esu
lt,
en
s
u
r
in
g
t
h
e
in
teg
r
atio
n
an
d
p
r
eser
v
atio
n
o
f
d
ata
o
n
lin
e
h
as
b
ec
o
m
e
a
cr
itical
r
e
q
u
ir
e
m
en
t
f
o
r
an
y
s
y
s
tem
o
p
er
atin
g
in
an
o
n
lin
e
en
v
ir
o
n
m
en
t.
Netwo
r
k
ad
m
in
is
tr
a
to
r
s
f
ac
e
i
n
cr
ea
s
in
g
c
h
allen
g
es
in
m
ain
tain
in
g
s
ec
u
r
ity
an
d
s
h
ield
in
g
d
ata
ag
ain
s
t
m
alwa
r
e
an
d
cy
b
e
r
a
ttack
s
[
2
]
,
[
3
]
.
T
h
e
e
v
er
-
e
v
o
lv
in
g
v
ar
iety
a
n
d
s
o
p
h
is
ticatio
n
o
f
t
h
ese
th
r
ea
t
s
n
ec
ess
itate
a
co
n
tin
u
o
u
s
e
n
h
an
ce
m
e
n
t
o
f
s
ec
u
r
ity
s
y
s
te
m
s
to
en
s
u
r
e
d
ata
co
n
f
id
en
tiality
,
i
n
teg
r
ity
,
a
n
d
s
ea
m
less
ac
ce
s
s
ib
ilit
y
.
Ar
tific
ial
in
tellig
en
ce
h
as
p
la
y
ed
a
p
iv
o
tal
r
o
le
in
an
o
m
al
y
d
etec
tio
n
b
y
em
p
lo
y
in
g
cla
s
s
if
icatio
n
tech
n
iq
u
es.
W
id
ely
av
ailab
le
d
atasets
lik
e
UNS
W
-
NB
1
5
,
NSL
-
KDD,
C
I
C
I
DS2
0
1
7
,
an
d
KDD
-
C
u
p
’
9
9
(
KDDCUP9
9
)
h
av
e
s
ig
n
if
ican
tly
co
n
tr
ib
u
ted
to
th
e
e
v
alu
atio
n
o
f
m
ac
h
in
e
lear
n
in
g
(
ML
)
alg
o
r
ith
m
s
an
d
ad
v
an
ce
m
e
n
t
o
f
a
cy
b
e
r
s
ec
u
r
i
ty
m
ea
s
u
r
es
[
4
]
,
[
5
]
.
Dee
p
l
ea
r
n
in
g
(
DL
)
tech
n
iq
u
es
o
f
te
n
o
u
tp
er
f
o
r
m
s
h
allo
w
m
eth
o
d
s
wh
en
ag
g
r
eg
atin
g
s
ev
er
al
lear
n
in
g
m
o
d
els.
T
h
is
m
eth
o
d
p
er
m
its
th
e
d
is
co
v
er
y
an
d
e
x
p
lo
itatio
n
o
f
s
tr
en
g
th
s
in
ea
ch
m
o
d
el.
T
h
e
r
ef
o
r
e,
class
if
icatio
n
ac
cu
r
ac
y
in
cr
ea
s
es
a
n
d
co
m
p
le
x
atta
ck
p
atter
n
s
ca
n
b
e
d
etec
ted
b
etter
[
6
]
–
[
8
]
.
T
h
e
d
if
f
icu
lty
in
in
tr
u
s
io
n
d
e
tectio
n
lies
in
h
ig
h
-
d
im
en
s
io
n
al,
im
b
alan
ce
d
d
ataset,
wh
ich
r
ed
u
ce
s
class
if
icatio
n
ac
cu
r
ac
y
an
d
r
e
s
u
lts
in
h
ig
h
co
m
p
u
tatio
n
al
co
s
t
[
9
]
–
[
1
1
]
.
Mo
r
eo
v
e
r
,
tr
ad
it
io
n
al
ML
s
o
lu
tio
n
s
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J E
lec
&
C
o
m
p
E
n
g
I
SS
N:
2088
-
8
7
0
8
I
mp
r
o
vin
g
n
etw
o
r
k
s
ec
u
r
ity
u
s
in
g
d
ee
p
lea
r
n
in
g
fo
r
in
tr
u
s
io
n
d
etec
tio
n
(
Mo
h
a
mme
d
A
l
-
S
h
a
b
i
)
5571
d
o
n
o
t
g
e
n
er
alize
well
to
d
iv
er
s
e
attac
k
ty
p
es,
esp
ec
ially
ze
r
o
-
d
a
y
attac
k
s
[
1
2
]
,
[
1
3
]
.
T
h
is
p
ap
er
ai
m
s
to
ad
d
r
ess
th
ese
lim
itatio
n
s
b
y
u
tili
zin
g
f
ea
tu
r
e
s
elec
tio
n
m
eth
o
d
s
an
d
h
y
b
r
id
ML
-
DL
m
o
d
els
to
im
p
r
o
v
e
d
etec
tio
n
ac
cu
r
ac
y
an
d
d
ec
r
ea
s
e
f
alse p
o
s
itiv
es.
Giv
en
th
e
h
ig
h
v
o
l
u
m
e
o
f
ac
ce
s
s
attem
p
ts
with
in
n
etwo
r
k
s
,
ef
f
ec
tiv
e
lo
g
g
in
g
o
f
ac
tiv
iti
es
is
v
ital.
T
h
is
ca
n
b
e
ac
h
iev
ed
th
r
o
u
g
h
s
o
f
twar
e,
h
ar
d
war
e,
o
r
a
co
m
b
in
atio
n
o
f
b
o
th
.
I
n
tr
u
s
io
n
d
et
ec
tio
n
n
ee
d
s
r
o
b
u
s
t
ap
p
r
o
ac
h
es,
in
clu
d
in
g
th
e
ex
p
lo
itatio
n
o
f
co
n
s
tan
tly
u
p
d
ate
d
n
etwo
r
k
s
er
v
ices
an
d
d
ata
b
a
s
es,
to
s
tay
alig
n
ed
with
th
e
in
cr
ea
s
in
g
d
iv
er
s
ity
o
f
attac
k
s
.
T
h
is
also
r
eq
u
ir
es k
n
o
wled
g
e
in
b
o
th
in
tr
u
s
io
n
an
d
an
o
m
aly
d
etec
tio
n
[
1
4
]
.
T
h
e
p
r
o
g
r
ess
io
n
o
f
m
alic
io
u
s
m
eth
o
d
s
h
ig
h
lig
h
ts
th
e
n
e
ce
s
s
ity
f
o
r
s
ec
u
r
ity
s
y
s
tem
s
th
at
n
o
t o
n
l
y
s
u
p
p
o
r
t
co
n
f
id
en
tiality
,
in
teg
r
ity
,
a
n
d
ac
ce
s
s
ib
ilit
y
b
u
t
also
g
u
ar
an
te
e
o
p
e
r
atio
n
al
c
o
n
tin
u
ity
o
v
er
ac
cu
r
ate
lo
g
g
in
g
o
f
n
etwo
r
k
ac
tiv
ities
.
T
h
is
co
m
p
r
is
es
co
n
s
is
ten
t
u
p
d
ates
t
o
n
etwo
r
k
s
er
v
er
s
an
d
d
ata
b
ases
an
d
tailo
r
in
g
co
n
f
ig
u
r
atio
n
s
to
alig
n
with
s
p
ec
if
ic
s
ec
u
r
ity
o
b
jectiv
es
[
1
5
]
.
T
h
e
p
r
im
ar
y
g
o
al
o
f
th
is
s
tu
d
y
is
to
en
h
an
ce
th
e
d
etec
tio
n
o
f
in
tr
u
s
io
n
s
in
co
m
p
u
ter
n
etwo
r
k
s
th
r
o
u
g
h
th
e
u
s
e
o
f
ML
an
d
DL
-
b
ased
alg
o
r
ith
m
s
.
Pre
cisely
,
we
s
ee
k
to
o
p
tim
ize
ch
ar
ac
ter
is
tic
s
e
lectio
n
,
co
n
tr
ast
th
e
b
eh
av
io
r
o
f
ML
an
d
DL
alg
o
r
ith
m
s
an
d
p
r
o
p
o
s
e
an
ef
f
icien
t
m
o
d
el
th
at
d
etec
ts
th
e
d
if
f
er
en
t
ca
teg
o
r
ies o
f
n
etwo
r
k
attac
k
s
.
Desig
n
in
g
an
in
tr
u
s
io
n
d
etec
ti
o
n
s
y
s
tem
class
ically
in
v
o
lv
es f
o
u
r
n
ec
ess
ar
y
s
tep
s
[
4
]
.
T
h
ese
in
clu
d
e:
a.
Data
co
llectio
n
b
y
g
ath
er
in
g
d
etailed
n
etwo
r
k
tr
af
f
ic
in
f
o
r
m
atio
n
,
in
clu
d
in
g
tr
af
f
ic
ty
p
e
,
h
o
s
t,
p
r
o
to
co
l,
an
d
o
th
e
r
r
elev
a
n
t d
etails.
b.
Featu
r
e
ex
tr
ac
tio
n
b
y
f
ilter
in
g
th
e
co
llected
d
ata
to
r
etain
o
n
ly
th
e
m
o
s
t r
elev
a
n
t f
ea
tu
r
es f
o
r
an
aly
s
is
.
c.
Data
an
aly
s
is
to
ev
alu
ate
th
e
s
elec
ted
f
ea
tu
r
es
to
d
eter
m
i
n
e
wh
eth
er
th
e
d
ata
r
ep
r
esen
ts
n
o
r
m
al
tr
af
f
ic
o
r
a
p
o
ten
tial a
ttack
.
d.
Actio
n
im
p
lem
en
tatio
n
th
at
t
ak
es
ap
p
r
o
p
r
iate
m
ea
s
u
r
es
b
ased
o
n
th
e
an
aly
s
is
r
esu
lts
,
s
u
ch
as
is
s
u
in
g
aler
ts
to
ad
m
in
is
tr
ato
r
s
o
r
m
iti
g
atin
g
th
r
ea
ts
b
y
b
lo
c
k
in
g
n
etwo
r
k
p
o
r
ts
o
r
h
altin
g
o
p
e
r
atio
n
s
tem
p
o
r
ar
ily
.
e.
Featu
r
e
s
elec
tio
n
an
d
ex
tr
ac
tio
n
ar
e
cr
u
cial
s
tep
s
in
d
ata
cl
ea
n
s
in
g
f
o
r
in
t
r
u
s
io
n
d
etec
tio
n
s
y
s
tem
s
(
I
DS)
.
Ap
p
r
o
ac
h
es
s
u
ch
as
ML
-
b
a
s
ed
f
ilter
in
g
o
r
en
s
em
b
le
lear
n
in
g
ar
e
co
m
m
o
n
l
y
em
p
lo
y
ed
.
E
n
s
em
b
le
lear
n
in
g
,
w
h
ich
co
llectio
n
s
p
r
ed
ictio
n
s
f
r
o
m
s
ev
er
al
al
g
o
r
i
th
m
s
,
h
as
r
ec
o
g
n
ized
e
f
f
ec
tiv
e
in
im
p
r
o
v
in
g
ac
cu
r
ac
y
an
d
ac
co
m
p
lis
h
in
g
b
etter
r
esu
lts
[
1
5
]
.
T
h
is
r
esear
ch
ad
d
s
to
t
h
e
liter
atu
r
e
b
y
ass
ess
in
g
an
d
c
o
m
p
a
r
in
g
th
e
p
er
f
o
r
m
a
n
ce
o
f
tr
a
d
itio
n
al
ML
v
er
s
u
s
DL
f
o
r
in
tr
u
s
io
n
d
etec
tio
n
.
W
e
u
s
e
co
r
r
elatio
n
b
ase
d
an
d
v
a
r
ian
ce
f
ea
tu
r
e
s
elec
tio
n
m
ec
h
a
n
is
m
s
to
im
p
r
o
v
e
class
if
icatio
n
ac
cu
r
ac
y
.
Seco
n
d
,
we
ev
alu
ate
o
u
r
s
o
lu
tio
n
s
o
n
two
p
u
b
licly
k
n
o
w
n
d
atasets
,
UNSW
-
NB
1
5
an
d
NSL
-
KDD
,
an
d
s
h
o
w
th
at
DL
b
ased
m
o
d
els,
n
o
tab
ly
ML
P
an
d
r
a
n
d
o
m
f
o
r
est
(
RF
)
o
u
ts
tr
ip
th
eir
tr
ad
itio
n
al
co
u
n
ter
p
ar
ts
f
r
o
m
d
etec
tio
n
ac
cu
r
ac
y
an
d
F1
-
s
co
r
e
p
er
s
p
ec
tiv
es.
T
h
e
f
o
c
u
s
o
f
th
is
s
tu
d
y
is
to
i
m
p
r
o
v
e
s
ec
u
r
ity
b
r
ea
ch
d
etec
t
io
n
in
co
m
p
u
ter
n
etwo
r
k
s
wit
h
ML
an
d
DL
alg
o
r
ith
m
s
.
I
n
p
a
r
ticu
lar
,
we
wan
t
to
ass
e
s
s
th
eir
ef
f
ec
tiv
en
ess
o
n
th
e
UNSW
-
N
B
1
5
an
d
NSL
-
KDD
d
atasets
,
s
o
th
at
th
eir
d
etec
tio
n
r
ate
is
m
a
x
im
ized
a
n
d
th
e
c
o
m
p
u
tatio
n
al
o
v
e
r
h
ea
d
is
also
m
in
im
ized
.
T
h
ese
in
itiativ
es
illu
s
tr
ate
h
o
w
s
ec
u
r
ity
is
s
u
es
ar
e
ch
an
g
in
g
o
v
e
r
tim
e.
ML
an
d
DL
ar
e
a
n
in
teg
r
a
l
p
ar
t
in
co
m
b
atin
g
th
ese
th
r
ea
ts
.
L
ea
r
n
in
g
f
r
o
m
n
ew
d
ata
allo
ws
th
em
to
r
ea
c
t
to
an
d
d
etec
t
n
ew
an
d
a
d
v
a
n
ce
d
cy
b
e
r
-
attac
k
s
ev
en
if
th
ey
ar
e
m
er
ely
n
o
m
i
n
al
to
o
ls
in
d
o
in
g
s
o
.
T
h
e
r
em
ain
d
er
o
f
th
e
p
ap
e
r
is
o
r
g
an
ized
as:
s
ec
tio
n
2
p
r
esen
ts
r
elate
d
wo
r
k
s
,
s
ec
tio
n
3
d
escr
ib
es
th
e
m
eth
o
d
,
s
ec
tio
n
4
p
r
esen
ts
th
e
r
esu
lts
a
n
d
d
is
cu
s
s
io
n
,
an
d
s
ec
tio
n
5
,
f
in
ally
we
c
o
n
clu
d
e
with
th
e
d
is
cu
s
s
io
n
an
d
th
e
f
u
t
u
r
e
wo
r
k
.
2.
RE
L
AT
E
D
WO
RK
S
T
h
e
g
r
o
win
g
d
en
s
ity
a
n
d
co
m
p
lex
ity
o
f
n
etwo
r
k
attac
k
s
,
co
m
b
in
ed
with
th
e
g
r
o
win
g
ca
p
ab
ilit
ies
o
f
cy
b
er
cr
im
in
als,
h
a
v
e
m
ad
e
s
e
cu
r
in
g
n
etwo
r
k
s
a
cr
itical
im
p
o
r
tan
ce
f
o
r
o
r
g
a
n
izatio
n
s
.
E
f
f
e
ctiv
e
d
is
r
u
p
tio
n
s
o
f
n
etwo
r
k
s
an
d
we
b
s
ites
b
y
h
ac
k
er
s
h
ig
h
lig
h
t
t
h
e
p
er
s
is
ten
t
n
ee
d
f
o
r
r
eliab
le
I
DS.
T
h
ese
p
r
o
g
r
ess
io
n
s
in
h
ac
k
in
g
m
eth
o
d
s
h
a
v
e
f
u
r
th
er
u
n
d
er
lin
e
d
th
e
im
p
licatio
n
o
f
I
DS in
m
o
d
er
n
cy
b
er
s
ec
u
r
ity
[
1
6
]
–
[
1
8
]
.
T
h
is
s
tu
d
y
co
n
tr
ib
u
tes
to
th
e
f
ield
b
y
ev
al
u
atin
g
an
d
co
m
p
ar
in
g
th
e
p
er
f
o
r
m
an
ce
o
f
tr
ad
itio
n
al
ML
alg
o
r
ith
m
s
ag
ai
n
s
t
DL
m
eth
o
d
s
f
o
r
in
tr
u
s
io
n
d
etec
tio
n
.
I
t
f
o
cu
s
es
o
n
h
o
w
t
h
ese
m
o
d
els
p
er
f
o
r
m
o
n
s
tan
d
a
r
d
d
atasets
s
u
ch
as
UNS
W
-
N
B
1
5
an
d
NSL
-
KDD.
T
h
e
f
in
d
in
g
s
p
r
o
v
i
d
e
in
s
ig
h
ts
in
to
th
e
ef
f
ec
tiv
en
ess
o
f
d
if
f
er
en
t
ap
p
r
o
ac
h
es
in
d
etec
tin
g
n
etwo
r
k
in
tr
u
s
io
n
s
.
I
t
al
s
o
o
b
s
er
v
es
h
o
w
ac
cu
r
ac
y
ca
n
b
e
e
n
h
an
ce
d
b
y
ex
p
lo
itin
g
ad
v
a
n
ce
d
f
ea
tu
r
e
e
x
tr
ac
tio
n
m
eth
o
d
s
.
T
o
p
r
o
v
id
e
a
c
o
m
p
lete
co
m
p
a
r
is
o
n
,
th
e
r
esear
ch
u
s
es
two
n
o
ticea
b
le
d
atasets
,
co
n
ce
n
tr
atin
g
o
n
p
r
ep
r
o
ce
s
s
in
g
p
r
o
c
ess
es
th
at
s
h
o
w
an
es
s
en
tial
r
o
le
in
im
p
r
o
v
in
g
d
etec
tio
n
ac
cu
r
ac
y
.
Nu
m
er
o
u
s
s
tu
d
ies
h
av
e
ex
p
lo
r
ed
th
e
u
s
e
o
f
a
r
tific
ial
in
tellig
en
ce
-
b
ased
ap
p
r
o
ac
h
es
f
o
r
I
DS,
p
ar
ticu
lar
ly
le
v
er
ag
in
g
ML
an
d
DL
tech
n
iq
u
es.
W
e
p
r
esen
t
an
u
p
-
to
-
d
ate
s
tr
u
ctu
r
e
d
r
e
v
iew
o
f
r
ec
en
t
p
ap
er
s
,
ad
d
r
ess
in
g
th
e
an
al
y
s
is
o
f
m
et
h
o
d
o
lo
g
y
,
r
esu
lts
,
s
tr
en
g
th
s
,
a
n
d
lim
itatio
n
s
.
a.
A
s
tu
d
y
in
[
6
]
o
f
f
er
ed
a
h
y
b
r
id
lear
n
in
g
m
eth
o
d
th
at
was
p
ar
am
etr
ic
a
n
d
n
o
n
-
p
ar
a
m
etr
ic
class
if
ier
co
m
b
in
atio
n
f
o
r
I
DS.
T
h
is
m
e
th
o
d
ac
h
iev
e
d
a
co
n
s
id
er
a
b
le
im
p
r
o
v
e
m
en
t o
f
d
etec
tio
n
ac
cu
r
ac
y
an
d
ab
ilit
y
o
f
r
ed
u
cin
g
f
alse p
o
s
itiv
es,
p
a
r
ticu
lar
ly
o
n
u
n
b
alan
ce
d
c
o
r
p
u
s
as UN
S
W
-
NB
1
5
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
0
8
8
-
8
7
0
8
I
n
t J E
lec
&
C
o
m
p
E
n
g
,
Vo
l.
15
,
No
.
6
,
Decem
b
e
r
20
25
:
5
5
7
0
-
5
5
8
3
5572
b.
On
e
m
o
r
e
wo
r
k
in
[
7
]
,
p
r
ef
er
r
ed
en
s
em
b
le
b
ased
DL
m
o
d
el
s
f
o
r
I
o
T
I
DS.
Ho
wev
er
,
b
y
c
o
m
b
in
in
g
C
NNs
an
d
R
NNs th
e
s
y
s
tem
h
ad
in
cr
ea
s
ed
p
r
ec
is
io
n
an
d
r
ec
all,
b
u
t it
was c
o
m
p
u
tatio
n
ally
ex
p
en
s
iv
e.
c.
I
n
[
8
]
,
p
r
esen
ted
a
s
y
s
tem
atic
liter
atu
r
e
r
e
v
iew
o
n
th
e
DL
tech
n
iq
u
es
f
o
r
c
y
b
er
th
r
ea
t
d
etec
tio
n
in
I
o
T
n
etwo
r
k
s
.
I
t
d
r
ew
atten
tio
n
to
th
e
v
alu
e
o
f
f
ea
tu
r
e
e
x
tr
a
ctio
n
an
d
tem
p
o
r
al
m
o
d
elin
g
,
an
d
in
d
icate
d
cir
cu
m
s
tan
ce
s
in
wh
ich
DL
ca
n
s
u
r
p
ass
class
ical
ML
.
d.
I
n
[
9
]
,
also
s
u
g
g
ested
im
p
r
o
v
in
g
I
DS
u
s
in
g
DL
a
n
d
d
ata
au
g
m
en
tatio
n
tech
n
iq
u
es.
T
h
eir
ap
p
r
o
ac
h
en
h
an
ce
d
th
e
d
etec
tio
n
o
f
m
in
o
r
ity
class
es a
lb
eit
at
th
e
co
s
t o
f
m
o
d
el
co
m
p
le
x
ity
.
e.
C
o
m
p
ar
is
o
n
o
f
b
in
ar
y
an
d
m
u
lti
-
class
clas
s
if
icatio
n
p
er
f
o
r
m
an
ce
o
f
ML
&
DL
m
o
d
els
was
s
tu
d
ied
in
[
1
0
]
.
T
h
e
r
esu
lts
s
h
o
wed
th
at
d
ee
p
m
o
d
els,
s
u
ch
as
M
L
P
an
d
L
STM
,
o
b
tain
ed
b
et
ter
p
er
f
o
r
m
an
ce
(
ac
cu
r
ac
y
a
n
d
F1
-
s
co
r
e)
th
a
n
co
n
v
en
tio
n
al
class
if
ier
s
.
f.
R
ef
er
en
ce
[
1
1
]
p
e
r
f
o
r
m
ed
in
-
d
ep
th
an
aly
s
is
o
f
ML
tech
n
iq
u
es
f
o
r
class
im
b
alan
ce
in
I
DS.
Me
th
o
d
s
in
clu
d
in
g
SMOT
E
an
d
c
o
s
t
-
s
en
s
itiv
e
lear
n
in
g
wer
e
in
d
icat
ed
to
im
p
r
o
v
e
ac
cu
r
ac
y
o
n
u
n
d
er
-
r
e
p
r
esen
ted
attac
k
ty
p
es.
g.
T
h
e
u
n
s
u
p
er
v
is
ed
lear
n
i
n
g
f
o
r
th
e
d
etec
tio
n
o
f
th
e
ze
r
o
-
d
ay
attac
k
s
is
also
p
r
o
p
o
s
ed
in
[
1
2
]
.
T
h
e
m
o
d
el
was
ef
f
ec
tiv
e
in
d
etec
tin
g
an
o
m
alies,
h
o
wev
e
r
o
p
er
atio
n
al
p
r
o
b
lem
s
wer
e
d
u
e
to
t
h
e
f
ac
t
th
at
it
was
r
eq
u
ir
ed
to
tu
n
e
th
r
esh
o
ld
s
.
h.
A
cr
itical
r
ev
iew
in
[
1
3
]
,
p
r
esen
ted
AI
-
b
ased
I
DS
s
o
lu
tio
n
s
,
h
ig
h
lig
h
tin
g
th
e
im
p
o
r
tan
ce
o
f
th
e
ad
ap
tiv
e
an
d
s
ca
lab
le
s
o
lu
tio
n
s
.
I
t
p
o
in
ted
o
u
t
th
at
th
e
DL
m
o
d
els
ar
e
v
er
y
p
o
wer
f
u
l,
b
u
t
th
ey
ar
e
d
ata
h
u
n
g
r
y
a
n
d
b
ig
lab
eled
d
atasets
d
o
n
o
t e
x
i
s
t.
i.
I
n
[
1
8
]
,
th
e
ANNs
wer
e
u
s
ed
to
class
if
y
n
etwo
r
k
in
tr
u
s
io
n
o
n
t
h
e
NSL
-
KDD
d
ataset.
T
h
eir
m
o
d
el
was
ab
le
to
d
etec
t
HDP
with
9
5
%
ac
cu
r
ac
y
.
T
h
is
ap
p
r
o
ac
h
wo
r
k
ed
r
ea
s
o
n
ab
ly
well
b
u
t
h
ad
d
if
f
ic
u
lty
with
h
ig
h
d
im
e
n
s
io
n
al
f
ea
tu
r
es a
n
d
g
en
er
aliza
tio
n
to
n
ew
ty
p
es o
f
attac
k
.
j.
R
ef
er
en
ce
[
1
9
]
p
r
esen
ted
a
two
-
s
tag
e
m
o
d
el
b
ased
o
n
d
e
cisi
o
n
tr
ee
alg
o
r
ith
m
s
f
o
r
n
e
two
r
k
in
tr
u
s
io
n
d
etec
tio
n
alth
o
u
g
h
th
e
C
I
C
I
DS2
0
1
7
ac
h
ie
v
ed
a
class
if
icatio
n
ac
cu
r
ac
y
o
f
9
2
.
6
%
th
at
was
b
etter
th
an
th
e
ex
is
tin
g
m
eth
o
d
s
.
B
u
t it
was c
o
m
p
u
tatio
n
ally
h
ea
v
y
an
d
was n
o
t scala
b
le
in
r
ea
l
-
tim
e
a
p
p
li
ca
tio
n
s
.
k.
R
ef
er
en
ce
[
2
0
]
p
r
esen
ted
a
n
a
n
aly
s
is
o
f
s
ev
er
al
ML
-
b
ased
I
DS m
o
d
els,
s
p
ec
ializin
g
in
d
e
cisi
o
n
tr
ee
s
(
DT
)
with
th
e
UGR
'
1
6
d
ataset.
DT
ac
h
iev
ed
m
o
r
e
th
a
n
9
4
%
ac
cu
r
ac
y
f
o
r
co
r
r
ec
tly
class
if
y
in
g
n
ew
co
n
ten
t,
im
p
ly
in
g
r
esil
ien
ce
to
k
n
o
w
n
attac
k
s
at
th
e
co
s
t o
f
its
in
ab
ilit
y
to
r
ec
o
g
n
ize
ze
r
o
-
d
ay
attac
k
s
.
l.
R
ef
er
en
ce
[
2
1
]
p
r
o
p
o
s
ed
th
e
DE
HO
m
o
d
el
f
o
r
th
e
d
etec
tio
n
d
is
tr
ib
u
ted
d
e
n
ial
-
of
-
s
er
v
ice
(
DDo
S)
attac
k
s
in
clo
u
d
.
DE
HO
ac
h
iev
ed
b
et
ter
ac
cu
r
ac
y
th
an
o
th
er
class
if
ier
s
o
n
f
o
u
r
d
atasets
.
I
ts
h
y
b
r
id
ar
ch
itectu
r
e
was b
en
ef
icial
to
th
e
d
etec
tio
n
b
u
t d
em
a
n
d
ed
a
lo
n
g
tr
ain
in
g
tim
e.
m.
I
n
[
2
2
]
,
d
esig
n
ed
a
s
tack
ed
L
STM
with
au
to
en
co
d
e
r
en
cr
y
p
tio
n
to
e
n
h
an
ce
DL
f
u
n
ctio
n
ality
in
in
tr
u
s
io
n
d
etec
tio
n
.
Alth
o
u
g
h
th
e
m
o
d
e
l
d
ec
r
ea
s
ed
th
e
am
o
u
n
t
o
f
er
r
o
r
s
in
p
r
ed
ictin
g
,
an
d
m
a
d
e
tr
af
f
ic
d
ec
is
io
n
s
m
o
r
e
ac
cu
r
ate,
it lac
k
ed
in
te
r
p
r
etab
ilit
y
,
an
d
c
o
s
t to
o
m
u
c
h
t
o
d
ep
lo
y
.
n.
I
n
s
tu
d
y
[
2
3
]
,
p
r
esen
ts
th
e
UNSW
-
N
B
1
5
d
ataset
wh
ich
h
as
also
em
er
g
ed
as
a
p
o
p
u
lar
tar
g
et
f
o
r
b
en
ch
m
ar
k
in
g
n
etwo
r
k
.
O
n
e
o
f
th
e
m
o
s
t
im
p
o
r
tan
t
b
en
e
f
its
o
f
th
is
d
ataset
is
th
at
it
co
v
er
s
a
v
ar
iety
o
f
m
o
d
er
n
attac
k
ty
p
es
f
r
o
m
r
ea
l
n
etwo
r
k
tr
af
f
ic
b
y
u
p
-
to
-
d
ate
to
o
ls
an
d
p
r
o
v
id
es
a
m
o
r
e
r
ea
lis
tic
en
v
ir
o
n
m
en
t
t
h
an
o
ld
er
d
atase
ts
s
u
ch
as
KDD9
9
.
I
t'
s
also
p
a
ck
ed
with
well
-
d
esig
n
ed
ca
p
a
b
ilit
ies
to
m
ak
e
tr
ain
in
g
an
d
e
v
alu
atin
g
m
ac
h
i
n
e
lear
n
in
g
m
o
d
els
ea
s
y
.
B
u
t
o
n
e
o
f
th
e
m
o
s
t
s
ig
n
if
ican
t
f
laws
is
th
e
class
im
b
alan
ce
in
th
e
d
ataset,
wh
i
ch
m
ig
h
t
b
ias
lear
n
in
g
alg
o
r
it
h
m
s
an
d
d
ec
r
ea
s
e
th
e
d
etec
ti
o
n
p
e
r
f
o
r
m
an
ce
r
eg
ar
d
in
g
m
in
o
r
ity
attac
k
ty
p
es.
Fu
r
th
er
m
o
r
e,
th
e
d
ataset
h
as
b
ee
n
g
en
er
ated
in
2
0
1
5
an
d
th
er
ef
o
r
e
m
ay
n
o
t
ad
e
q
u
ately
r
ep
r
esen
t
th
e
m
o
s
t
r
ec
en
t
t
h
r
ea
t
lan
d
s
ca
p
es
an
d
m
o
r
e
ad
v
a
n
ce
d
c
y
b
er
-
attac
k
s
o
cc
u
r
r
in
g
in
m
o
r
e
r
ec
e
n
t y
ea
r
s
.
o.
I
n
r
ef
e
r
en
ce
[
2
4
]
,
th
e
KDDC
UP9
9
,
th
e
NSL
-
KDD,
an
d
U
NSW
-
N
B
1
5
d
atasets
wer
e
an
aly
ze
d
in
i
n
ter
n
et
o
f
th
in
g
s
(
I
o
T
)
c
o
n
tex
ts
u
s
in
g
DL
.
3
.
I
t
also
h
ig
h
lig
h
te
d
th
at
th
e
m
o
r
e
r
ec
en
t
d
atasets
,
f
o
r
e
x
am
p
le,
UNSW
-
N
B
1
5
h
av
e
m
o
r
e
v
ali
d
ev
alu
atio
n
s
th
a
n
f
o
r
ex
am
p
le
KDDCU
P9
9
.
p.
Au
th
o
r
s
in
[
2
5
]
p
r
o
p
o
s
ed
a
g
u
id
elin
es
f
o
r
tr
ai
n
in
g
b
ased
o
n
KDD
-
C
u
p
'
9
9
an
d
NSL
-
KDD
d
ataset
f
o
r
tr
ain
in
g
o
f
an
o
m
aly
-
b
ased
I
D
S.
W
h
ile
v
alu
ab
le,
th
ese
d
atasets
ar
e
n
o
w
b
eliev
ed
less
r
elev
an
t
to
th
e
wa
y
m
o
d
er
n
attac
k
s
o
p
er
ate.
T
h
e
liter
atu
r
e
s
u
r
v
ey
s
h
o
ws
a
clea
r
m
ig
r
atio
n
to
war
d
th
e
d
ep
lo
y
m
en
t
o
f
DL
-
b
ased
I
DS
esp
ec
ially
with
th
e
u
s
e
o
f
b
o
th
h
y
b
r
i
d
ar
ch
itectu
r
e
an
d
en
s
em
b
le
m
eth
o
d
s
.
T
h
ese
m
o
d
els
ar
e
g
e
n
er
ally
b
etter
th
an
class
ical
ML
alg
o
r
ith
m
s
in
t
h
e
d
etec
tio
n
ac
cu
r
ac
y
,
p
r
ec
is
io
n
an
d
F1
-
s
co
r
e
s
p
ec
if
ically
wh
en
tr
ain
ed
with
r
ec
en
t
d
atasets
as
UNSW
-
NB
1
5
.
B
u
t
th
er
e
ar
e
s
till
s
o
m
e
lim
itatio
n
s
s
u
ch
as
h
u
g
e
co
m
p
u
tatio
n
al
c
o
s
t,
n
o
in
ter
p
r
etatio
n
an
d
p
o
o
r
e
f
f
ec
t
s
f
o
r
im
b
alan
ce
d
d
ata.
T
h
e
r
e
ce
n
t
liter
atu
r
e
h
ig
h
lig
h
ts
th
at
d
ata
au
g
m
e
n
tatio
n
,
f
ea
tu
r
e
s
elec
tio
n
an
d
u
n
s
u
p
er
v
is
ed
lear
n
in
g
ar
e
cr
u
cial
to
d
e
alin
g
with
th
ese
p
r
o
b
lem
s
.
Fu
t
u
r
e
wo
r
k
will
lo
o
k
in
to
co
p
in
g
with
r
ea
l
-
tim
e
ad
a
p
tatio
n
,
lig
h
tweig
h
t
DL
m
o
d
el
s
,
an
d
cr
o
s
s
-
d
ataset
g
en
er
aliza
tio
n
in
an
e
f
f
o
r
t
to
ac
h
iev
e
a
co
m
p
lete
ad
ap
tab
ilit
y
ag
ain
s
t in
co
m
in
g
th
r
ea
ts
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J E
lec
&
C
o
m
p
E
n
g
I
SS
N:
2088
-
8
7
0
8
I
mp
r
o
vin
g
n
etw
o
r
k
s
ec
u
r
ity
u
s
in
g
d
ee
p
lea
r
n
in
g
fo
r
in
tr
u
s
io
n
d
etec
tio
n
(
Mo
h
a
mme
d
A
l
-
S
h
a
b
i
)
5573
3.
M
E
T
H
O
D
T
h
e
ef
f
icien
cy
o
f
ML
a
n
d
D
L
alg
o
r
ith
m
s
f
o
r
in
tr
u
s
io
n
d
et
ec
tio
n
is
in
v
esti
g
ated
in
th
is
p
ap
er
with
two
well
-
k
n
o
wn
b
en
c
h
m
ar
k
d
atasets
:
UN
SW
-
N
B
1
5
an
d
NSL
-
KDD
[
2
3
]
,
[
2
4
]
,
b
o
th
u
s
u
ally
ap
p
lied
i
n
n
etwo
r
k
s
ec
u
r
ity
r
esear
ch
u
n
d
er
co
n
tr
o
lled
e
x
p
er
im
e
n
tal
co
n
d
itio
n
s
.
T
h
ese
d
atasets
ca
p
tu
r
e
a
d
iv
er
s
ity
o
f
n
etwo
r
k
ac
tiv
ities
an
d
attac
k
t
y
p
es.
T
h
e
r
esear
ch
ap
p
lies
to
a
co
m
b
in
atio
n
o
f
ML
m
o
d
els
an
d
DL
tech
n
iq
u
es,
s
u
ch
as
R
F
an
d
ML
P.
T
o
en
h
an
ce
class
if
icatio
n
p
er
f
o
r
m
a
n
ce
,
th
e
d
atasets
u
n
d
er
wen
t
p
r
ep
r
o
ce
s
s
in
g
,
an
d
f
ea
tu
r
e
s
elec
tio
n
tech
n
i
q
u
es we
r
e
em
p
lo
y
e
d
to
id
e
n
tify
th
e
m
o
s
t sig
n
if
ican
t a
ttrib
u
tes.
UNSW
-
N
B
1
5
d
ataset
is
a
b
en
ch
m
ar
k
co
m
m
o
n
ly
u
s
ed
in
c
y
b
er
s
ec
u
r
ity
r
esear
ch
f
o
r
ass
ess
in
g
I
DS.
Fo
u
n
d
ed
at
th
e
A
u
s
tr
alian
C
en
ter
f
o
r
C
y
b
er
Secu
r
ity
in
2
0
1
5
to
o
v
er
c
o
m
e
th
e
lim
itatio
n
s
o
f
leg
ac
y
d
atasets
in
clu
d
in
g
NSL
-
KDD
an
d
KD
DC
UP9
9
,
m
ain
ly
in
ex
p
r
ess
i
v
e
m
o
d
er
n
n
etwo
r
k
b
e
h
av
io
r
s
an
d
d
iv
er
s
e
attac
k
s
ce
n
ar
io
s
[
2
3
]
–
[
2
6
]
.
T
h
e
d
ata
s
et
s
im
u
lates
r
ea
lis
tic
n
etwo
r
k
tr
af
f
ic,
b
le
n
d
in
g
n
o
r
m
al
ac
tiv
ities
an
d
n
u
m
er
o
u
s
m
o
d
er
n
attac
k
p
atter
n
s
,
to
ev
a
lu
ate
I
DS m
o
d
els ef
f
ec
tiv
ely
.
W
h
er
e
th
e
d
ataset
s
tr
u
ctu
r
e
as:
T
h
e
d
ataset
co
n
tain
s
4
9
f
ea
tu
r
es
r
ep
r
esen
tin
g
v
a
r
io
u
s
n
etwo
r
k
attr
ib
u
tes
s
u
ch
as
I
P
ad
d
r
ess
es,
p
o
r
ts
,
p
r
o
to
co
ls
,
p
ac
k
et
s
izes,
an
d
ti
m
estam
p
s
.
I
t c
o
m
p
r
is
es a
p
p
r
o
x
im
ately
2
.
5
m
illi
o
n
r
ec
o
r
d
s
,
d
iv
i
d
ed
in
to
n
o
r
m
al
tr
a
f
f
ic
an
d
attac
k
tr
af
f
ic.
I
t in
clu
d
es a
r
an
g
e
o
f
attac
k
ca
teg
o
r
ies th
at
r
ef
lect
r
ea
l
-
wo
r
ld
s
ce
n
ar
io
s
,
s
u
ch
as:
a.
Fu
zz
er
s
:
s
en
d
in
g
r
an
d
o
m
i
n
p
u
ts
to
d
is
co
v
er
v
u
l
n
er
ab
ilit
ies.
b.
An
aly
s
is
:
p
o
r
t
s
ca
n
n
in
g
an
d
o
t
h
er
p
r
o
b
in
g
tech
n
iq
u
es.
c.
B
ac
k
d
o
o
r
s
:
u
n
a
u
th
o
r
ize
d
ac
ce
s
s
th
r
o
u
g
h
c
o
v
er
t c
h
a
n
n
els.
d.
Den
ial
o
f
s
er
v
ice
(
Do
S):
o
v
er
wh
elm
in
g
a
n
etwo
r
k
o
r
s
er
v
er
with
tr
af
f
ic.
e.
E
x
p
lo
its
:
u
s
in
g
s
o
f
twar
e
v
u
ln
e
r
ab
ilit
ies to
co
m
p
r
o
m
is
e
s
y
s
tem
s
.
f.
Gen
er
ic:
p
latf
o
r
m
-
ag
n
o
s
tic
attac
k
s
,
lik
e
p
ass
wo
r
d
cr
ac
k
i
n
g
.
g.
R
ec
o
n
n
aiss
an
ce
:
g
ath
er
in
g
in
f
o
r
m
atio
n
f
o
r
p
o
ten
tial f
u
t
u
r
e
a
ttack
s
.
h.
Sh
ellco
d
e:
m
alicio
u
s
co
d
e
d
esig
n
ed
to
e
x
p
lo
it
v
u
ln
er
a
b
ilit
ies
in
s
o
f
twar
e
to
ex
ec
u
te
u
n
au
t
h
o
r
ize
d
co
m
m
an
d
s
o
n
a
tar
g
et
s
y
s
tem
.
i.
W
o
r
m
s
:
s
elf
-
r
ep
licatin
g
m
alwa
r
e
s
p
r
ea
d
in
g
ac
r
o
s
s
n
etwo
r
k
s
.
UNSW
-
N
B
1
5
k
ey
attr
ib
u
tes
a
r
e
th
e
attac
k
-
cat
:
s
p
ec
if
ies
th
e
ty
p
e
o
f
attac
k
in
th
e
d
ataset
(
e.
g
.
,
D
o
S,
E
x
p
lo
it),
l
ab
el:
s
p
ec
if
ies
wh
eth
er
th
e
r
e
co
r
d
is
n
o
r
m
al
(
0
)
o
r
an
attac
k
(
1
)
,
an
d
d
is
tr
ib
u
tio
n
:
t
h
e
d
at
aset
h
as
an
alm
o
s
t
eq
u
al
b
alan
ce
b
etwe
en
n
o
r
m
al
an
d
attac
k
tr
a
f
f
ic
to
r
e
d
u
ce
b
ias in
class
if
icatio
n
.
Fig
u
r
e
1
p
r
esen
ts
th
e
d
ataset,
wh
ich
c
o
n
s
is
ts
o
f
2
,
5
4
0
,
0
4
4
r
ec
o
r
d
s
alo
n
g
with
two
cla
s
s
if
icatio
n
to
o
ls
:
attac
k
-
ca
t
an
d
lab
el.
T
h
e
'
d
elay
'
attr
ib
u
te
in
d
icate
s
th
e
p
r
esen
ce
o
f
a
d
ef
ec
t,
with
a
v
alu
e
o
f
0
f
o
r
n
o
r
m
al
r
ec
o
r
d
s
an
d
1
f
o
r
d
ef
ec
tiv
e
r
e
co
r
d
s
.
T
h
e
g
en
e
r
al
class
if
icati
o
n
ca
n
b
e
p
er
f
o
r
m
ed
u
s
in
g
ei
th
er
o
r
b
o
th
o
f
th
e
class
if
icatio
n
to
o
ls
,
lead
in
g
to
id
en
tical
class
if
icatio
n
r
esu
lt
s
.
I
n
o
u
r
r
esear
ch
,
th
e
UNSW
-
NB
1
5
attr
ib
u
te
is
id
en
tifie
d
as th
e
m
o
s
t im
p
o
r
ta
n
t f
ea
tu
r
e.
Fig
u
r
e
1
.
Per
ce
n
ta
g
e
d
is
tr
ib
u
ti
o
n
o
f
r
ec
o
r
d
s
in
th
e
UNSW
-
NB
1
5
d
ataset
A
d
etailed
o
v
er
v
iew
o
f
t
h
e
d
a
taset
'
s
f
ea
tu
r
es
i
s
p
r
o
v
id
ed
in
Fig
u
r
e
2
.
NSL
-
KDD
d
ataset
i
s
a
wid
ely
u
s
ed
r
eso
u
r
ce
f
o
r
ev
alu
atin
g
I
DS.
I
t
is
d
er
iv
ed
f
r
o
m
th
e
KDDCU
P9
9
d
ataset
an
d
a
d
d
r
ess
es
s
ev
er
al
is
s
u
es
p
r
esen
t
in
th
e
o
r
ig
i
n
al
v
er
s
io
n
b
y
r
em
o
v
i
n
g
r
ed
u
n
d
an
t
r
ec
o
r
d
s
[
1
]
,
[
2
5
]
.
T
h
is
m
o
d
if
icatio
n
r
esu
lts
in
a
m
o
r
e
b
alan
ce
d
d
ataset
an
d
m
in
im
iz
es b
ias th
at
class
if
ier
s
m
ig
h
t o
th
er
wis
e
d
ev
elo
p
.
T
h
e
NSL
-
KDD
d
ataset
co
n
tai
n
s
4
1
attr
ib
u
tes,
alo
n
g
with
a
class
at
tr
ib
u
te
th
at
ca
teg
o
r
izes t
h
e
ty
p
e
o
f
co
n
n
ec
tio
n
b
etwe
en
two
r
ec
o
r
d
s
(
i.e
.
No
r
m
al
an
d
A
b
n
o
r
m
al
(
attac
k
)
tr
a
f
f
ic)
.
T
ab
l
e
1
illu
s
tr
ates
th
e
p
er
ce
n
tag
e
d
is
tr
ib
u
tio
n
o
f
r
ec
o
r
d
s
in
t
h
is
d
atab
ase
(
i.e
.
#
in
d
icate
th
e
n
u
m
b
e
r
o
f
r
ec
o
r
d
s
,
w
h
er
e
%
in
d
icate
th
e
p
er
ce
n
tag
e
o
f
r
ec
o
r
d
s
o
v
er
all
)
.
I
t
in
clu
d
es
b
o
th
n
o
r
m
al
a
n
d
ab
n
o
r
m
al
(
attac
k
)
r
ec
o
r
d
s
,
wh
ich
ar
e
class
if
ied
in
to
f
iv
e
ca
teg
o
r
ies
[
2
4
]
–
[
2
6
]
:
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
0
8
8
-
8
7
0
8
I
n
t J E
lec
&
C
o
m
p
E
n
g
,
Vo
l.
15
,
No
.
6
,
Decem
b
e
r
20
25
:
5
5
7
0
-
5
5
8
3
5574
a.
n
o
r
m
al
t
r
af
f
ic
.
b.
Do
s
: a
ttem
p
ts
to
m
ak
e
th
e
d
e
v
ice
u
n
av
ailab
le
to
its
u
s
er
s
.
c.
P
r
o
b
e:
e
f
f
o
r
ts
to
g
ath
er
in
f
o
r
m
atio
n
to
id
en
tif
y
p
o
te
n
tial v
u
ln
er
ab
ilit
ies
.
d.
U
s
er
2
r
o
o
t (
U
2
R
)
:
u
n
au
th
o
r
iz
ed
ac
ce
s
s
to
th
e
s
y
s
tem
is
o
b
tain
ed
.
e.
R
em
o
te
to
l
o
ca
l (
R
2
L
)
:
t
h
e
att
ac
k
er
g
ain
s
u
n
au
th
o
r
ized
ac
ce
s
s
f
r
o
m
a
r
em
o
te
m
ac
h
in
e
.
T
h
e
NSL
-
KDD
d
ataset
co
n
s
i
s
ts
o
f
4
1
f
ea
tu
r
es
a
n
d
o
n
e
c
lass
attr
ib
u
te
wh
ich
ch
a
r
ac
te
r
izes
ea
ch
in
s
tan
ce
as
n
o
r
m
al/
o
n
e
o
f
v
a
r
io
u
s
attac
k
ty
p
es
as
s
h
o
wn
i
n
Fig
u
r
e
3
.
T
h
ese
f
ea
tu
r
es
ar
e
g
r
o
u
p
ed
in
to
t
h
r
ee
ca
teg
o
r
ies:
b
asic
f
ea
tu
r
es,
C
o
n
ten
t
f
ea
tu
r
es,
an
d
T
r
a
f
f
ic
f
e
atu
r
es
(
f
o
r
m
o
r
e
d
etails
p
lease
r
ea
d
[
2
4
]
,
[
2
5
]
).
Featu
r
e
ex
tr
ac
tio
n
is
a
p
r
ed
ictiv
e
tech
n
iq
u
e
th
at
r
ed
u
ce
s
th
e
n
u
m
b
er
o
f
i
n
p
u
t
v
ar
ia
b
les
d
u
r
in
g
m
o
d
el
d
ev
elo
p
m
e
n
t.
B
y
elim
in
atin
g
ir
r
elev
an
t
o
r
r
ed
u
n
d
a
n
t
f
ea
tu
r
es,
th
is
p
r
o
ce
s
s
s
im
p
lifie
s
th
e
m
o
d
el
ar
ch
itectu
r
e.
As
a
r
esu
lt,
co
m
p
u
tatio
n
al
ef
f
icien
cy
im
p
r
o
v
es,
an
d
th
e
m
o
d
el
b
ec
o
m
es
m
o
r
e
ef
f
ec
tiv
e
at
id
en
tify
in
g
m
ea
n
in
g
f
u
l
p
atter
n
s
i
n
th
e
d
at
a.
I
t
is
esp
ec
ially
b
e
n
ef
icial
w
h
en
wo
r
k
in
g
with
ML
m
o
d
els
th
at
p
r
o
ce
s
s
lar
g
e
d
atasets
.
Featu
r
e
ex
tr
ac
tio
n
h
elp
s
id
en
tify
th
e
m
o
s
t
s
ig
n
if
ic
an
t
f
ea
tu
r
es
th
at
ar
e
s
tr
o
n
g
ly
co
r
r
elate
d
with
th
e
tar
g
et
v
ar
iab
le
[
2
3
]
,
[
2
7
]
.
Fig
u
r
e
2
.
Featu
r
es o
f
th
e
UNSW
-
NB
1
5
d
ataset
T
ab
le
1
.
Per
ce
n
ta
g
e
d
is
tr
ib
u
tio
n
o
f
r
e
co
r
d
s
in
t
h
e
NSL
-
KDD
d
ataset
N
S
L
-
K
D
D
R
e
c
o
r
d
Ty
p
e
K
D
D
Tr
a
i
n
+
(
Tr
a
i
n
i
n
g
S
e
t
)
K
D
D
Te
s
t
+
(
Te
s
t
i
n
g
S
e
t
)
C
o
m
b
i
n
e
d
#
%
#
%
#
%
N
o
r
mal
6
7
,
3
4
3
5
3
.
4
6
9
,
7
1
1
4
3
.
0
8
7
7
,
0
5
4
5
1
.
8
8
D
o
s
4
5
,
9
2
7
3
6
.
4
5
8
,
4
5
6
3
7
.
0
1
5
4
,
3
8
3
3
6
.
6
2
P
r
o
b
e
1
1
,
6
5
6
9
.
2
5
8
7
3
3
.
8
7
%
1
2
,
5
2
9
8
.
4
4
R
2
L
9
9
5
0
.
7
9
3
,
2
4
9
1
5
.
0
2
4
,
2
4
4
2
.
8
6
U
2
R
52
0
.
0
4
2
5
5
1
.
0
2
3
0
7
0
.
2
1
Fig
u
r
e
3
.
Featu
r
es o
f
th
e
NSL
-
KDD
d
ataset
I
n
th
is
r
esear
ch
,
co
r
r
elatio
n
,
c
o
ef
f
icien
ts
an
d
v
ar
ian
ce
ar
e
u
s
ed
to
s
elec
t
th
e
m
o
s
t
r
elev
an
t
f
ea
tu
r
es
f
o
r
ea
ch
d
ataset.
Var
ian
ce
q
u
a
n
tifie
s
th
e
ex
ten
t
to
wh
ich
f
ea
tu
r
e
v
alu
es
d
ev
iate
f
r
o
m
th
e
m
ea
n
.
I
t
s
er
v
es
as
an
in
d
icato
r
o
f
h
o
w
m
u
ch
th
e
v
a
lu
es
d
if
f
er
f
r
o
m
o
n
e
a
n
o
th
er
an
d
f
r
o
m
th
e
a
v
er
ag
e.
A
h
ig
h
v
ar
ian
ce
in
d
icate
s
th
at
th
e
v
al
u
es
ar
e
s
p
r
ea
d
a
cr
o
s
s
a
b
r
o
a
d
er
r
an
g
e
,
wh
er
ea
s
a
lo
w
v
ar
ia
n
ce
s
u
g
g
ests
th
at
th
e
v
alu
es
ar
e
clu
s
ter
ed
n
ea
r
th
e
m
ea
n
.
T
h
e
f
o
r
m
u
la
f
o
r
v
a
r
ian
ce
is
g
iv
en
b
y
(
1
)
.
(
)
=
1
/
∑
(
−
)
=
0
(
1
)
w
h
er
e:
x
is
th
e
ar
ith
m
etic
m
ea
n
o
f
n
v
alu
es,
Xi
is
th
e
n
u
m
b
e
r
o
f
s
am
p
les.
I
n
th
is
r
esear
ch
,
v
ar
ian
ce
is
em
p
lo
y
ed
to
d
eter
m
in
e
wh
ich
f
ea
tu
r
es
s
h
o
w
th
e
g
r
ea
test
s
p
r
ea
d
(
v
ar
iatio
n
)
i
n
th
eir
v
alu
es.
Featu
r
es
with
h
ig
h
er
v
ar
ian
ce
ar
e
g
en
e
r
ally
m
o
r
e
ef
f
ec
tiv
e
in
d
if
f
e
r
en
tiatin
g
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J E
lec
&
C
o
m
p
E
n
g
I
SS
N:
2088
-
8
7
0
8
I
mp
r
o
vin
g
n
etw
o
r
k
s
ec
u
r
ity
u
s
in
g
d
ee
p
lea
r
n
in
g
fo
r
in
tr
u
s
io
n
d
etec
tio
n
(
Mo
h
a
mme
d
A
l
-
S
h
a
b
i
)
5575
b
etwe
en
v
ar
io
u
s
class
es.
T
h
e
co
ef
f
icien
t
o
f
co
r
r
elatio
n
m
ea
s
u
r
es
th
e
d
e
g
r
ee
o
f
lin
ea
r
ass
o
c
iatio
n
b
etwe
en
two
o
r
m
o
r
e
v
ar
iab
les an
d
aid
s
p
r
e
d
ictio
n
o
f
o
n
e
v
ar
ia
b
le
o
n
th
e
b
asis
o
f
an
o
th
er
.
W
h
en
two
v
a
r
iab
les ar
e
s
tr
o
n
g
l
y
co
r
r
elate
d
,
k
n
o
win
g
o
n
e
ca
n
h
elp
p
r
ed
ict
th
e
o
th
e
r
.
I
f
th
e
t
wo
v
ar
iab
les
ar
e
id
en
tical,
o
n
ly
o
n
e
p
ar
am
eter
is
n
ee
d
ed
to
r
e
p
r
esen
t
b
o
th
,
as
t
h
e
s
ec
o
n
d
p
ar
am
eter
d
o
es
n
o
t
p
r
o
v
id
e
a
d
d
itio
n
al
in
f
o
r
m
ati
o
n
.
T
h
e
c
o
r
r
elatio
n
co
ef
f
icien
t is d
ef
in
e
d
b
y
th
e
f
o
llo
win
g
(
2
)
.
(
,
)
=
(
,
)
.
(
2
)
w
h
er
e,
C
o
v(
x,
y)
is
th
e
c
o
v
ar
i
an
ce
b
etwe
en
x
a
n
d
y
,
ax
r
e
p
r
esen
ts
th
e
s
tan
d
ar
d
d
e
v
iatio
n
o
f
x
,
a
n
d
ay
is
th
e
s
tan
d
ar
d
d
e
v
iatio
n
o
f
y
.
I
n
th
is
s
tu
d
y
,
th
e
co
ef
f
icien
t
o
f
co
r
r
elatio
n
is
u
tili
ze
d
to
esti
m
ate
th
e
im
p
ac
t m
ag
n
itu
d
e
o
f
f
ea
tu
r
es o
n
th
e
tar
g
et
v
ar
iab
le.
Featu
r
es w
ith
a
h
ig
h
er
ab
s
o
lu
te
c
o
r
r
elatio
n
co
ef
f
icien
t (
clo
s
er
to
1
o
r
-
1
)
ar
e
m
o
r
e
lik
ely
t
o
b
e
v
alu
a
b
le
f
o
r
class
if
icatio
n
p
u
r
p
o
s
es.
I
n
t
h
is
r
esear
ch
,
t
h
e
ad
ju
s
tm
en
t
a
n
d
c
o
r
r
elatio
n
c
o
ef
f
icien
t
m
et
h
o
d
s
wer
e
p
r
ac
tical
to
t
h
e
NSL
-
KD
D
an
d
UNSW
-
NB
1
5
d
atasets
to
class
if
y
th
e
m
o
s
t
im
p
o
r
tan
t
f
ea
tu
r
es
lin
k
ed
to
th
e
tar
g
et
class
e
s
.
T
h
is
p
r
o
ce
s
s
is
v
ital
f
o
r
im
p
r
o
v
in
g
class
if
icatio
n
ac
cu
r
ac
y
an
d
d
ec
r
ea
s
in
g
th
e
co
m
p
u
tatio
n
al
l
o
ad
th
r
o
u
g
h
o
u
t th
e
ML
p
r
o
ce
s
s
.
T
h
e
f
o
llo
win
g
s
tep
s
wer
e
f
o
llo
wed
in
th
e
f
ea
tu
r
e
ex
tr
ac
tio
n
p
r
o
ce
s
s
:
a.
T
h
e
v
ar
ian
ce
f
o
r
ea
ch
f
ea
t
u
r
e
was c
o
m
p
u
ted
to
ass
ess
its
d
is
tr
ib
u
tio
n
ac
r
o
s
s
th
e
d
ataset.
b.
T
h
e
co
r
r
elatio
n
co
e
f
f
icien
t
w
as
ca
lcu
lated
b
etwe
en
ea
c
h
f
ea
tu
r
e
an
d
th
e
tar
g
et
v
a
r
iab
le
to
ev
alu
ate
th
e
lin
ea
r
r
elatio
n
s
h
ip
.
c.
B
ased
o
n
th
e
ca
lcu
lated
v
a
r
ia
n
ce
an
d
c
o
r
r
elatio
n
v
alu
es,
th
e
f
ea
tu
r
es
m
o
s
t
r
elev
a
n
t
to
th
e
class
if
icatio
n
task
wer
e
s
elec
ted
.
Ar
tific
ial
in
tellig
en
ce
(
AI
)
is
a
f
ield
o
f
c
o
m
p
u
ter
s
cien
ce
m
o
tiv
ated
o
n
em
e
r
g
in
g
tech
n
iq
u
es
th
at
allo
w
m
ac
h
in
es
to
ac
h
ie
v
e
ta
s
k
s
class
ica
lly
r
eq
u
ir
in
g
h
u
m
an
in
tellig
en
ce
.
ML
,
a
k
e
y
f
a
cto
r
o
f
A
I
,
en
a
b
les
co
m
p
u
ter
s
y
s
tem
s
to
lear
n
s
tr
a
ig
h
t
f
r
o
m
d
ata,
e
x
am
p
les,
an
d
ex
p
er
ien
ce
s
.
Usi
n
g
p
r
o
g
r
am
m
ed
alg
o
r
ith
m
s
,
ML
an
aly
ze
s
in
p
u
t
d
ata
to
p
r
e
d
ict
o
u
tp
u
t
v
alu
es,
co
n
tin
u
o
u
s
ly
im
p
r
o
v
i
n
g
an
d
o
p
tim
izin
g
its
p
r
o
ce
s
s
es
to
en
h
a
n
ce
p
er
f
o
r
m
an
ce
an
d
d
e
v
elo
p
in
t
ellig
en
ce
o
v
er
tim
e
[
2
8
]
.
T
h
is
s
tu
d
y
ap
p
lies
b
o
th
tr
a
d
itio
n
al
ML
an
d
DL
alg
o
r
ith
m
s
f
o
r
class
if
y
in
g
n
et
wo
r
k
in
tr
u
s
io
n
s
.
So
m
e
o
f
th
e
a
lg
o
r
ith
m
s
u
s
ed
in
clu
d
e:
a.
K
-
n
ea
r
est
n
eig
h
b
o
r
s
(
K
NN)
,
a
s
im
p
le
alg
o
r
ith
m
to
class
if
y
a
d
ataset
b
ased
o
n
th
e
class
if
icatio
n
o
f
its
n
ea
r
est n
eig
h
b
o
r
s
[
5
]
.
b.
R
F,
a
clas
s
if
icatio
n
alg
o
r
ith
m
th
at
cr
ea
tes
a
co
llectio
n
o
f
DT
an
d
u
s
es
m
ajo
r
ity
v
o
ti
n
g
f
o
r
th
e
f
in
al
p
r
ed
ictio
n
[
2
9
]
.
c.
DT
,
a
d
ec
is
io
n
tr
ee
is
a
f
lo
w
c
h
ar
t
-
lik
e
tr
ee
s
tr
u
ctu
r
e,
wh
er
e
ea
ch
n
o
d
e
s
tan
d
s
f
o
r
a
f
ea
tu
r
e
,
an
d
ea
ch
leaf
r
ep
r
esen
ts
a
class
lab
el
[
3
0
]
.
d.
Naïv
e
B
ay
es (
NB
)
,
a
p
r
o
b
ab
ili
s
tic
clas
s
if
ier
b
ased
o
n
B
ay
es'
th
eo
r
em
[
3
1
]
.
e.
ML
P,
a
DL
m
o
d
el
co
m
p
o
s
ed
o
f
s
ev
er
al
lay
er
s
o
f
n
eu
r
o
n
s
:
in
p
u
t,
h
id
d
e
n
,
an
d
o
u
tp
u
t
lay
er
s
wh
er
e
ea
ch
n
eu
r
o
n
in
th
ese
lay
er
s
is
ap
p
li
ed
ac
tiv
atio
n
f
u
n
ctio
n
to
ca
p
tu
r
e
co
m
p
lex
p
atter
n
s
[
3
2
]
.
f.
L
o
n
g
s
h
o
r
t
-
ter
m
m
e
m
o
r
y
(
L
STM
)
,
a
t
y
p
e
o
f
r
ec
u
r
r
en
t
n
eu
r
al
n
etwo
r
k
(
R
NN)
th
at
is
well
-
s
u
ited
to
lear
n
in
g
f
r
o
m
s
eq
u
en
ce
s
o
f
d
a
ta,
d
u
e
to
its
ab
ilit
y
to
r
etain
in
f
o
r
m
atio
n
o
v
er
s
eq
u
en
ce
s
[
3
3
]
.
Me
asu
r
in
g
class
if
icatio
n
ac
cu
r
ac
y
alo
n
e
is
in
s
u
f
f
icien
t
t
o
ass
ess
th
e
p
er
f
o
r
m
an
ce
o
f
ea
ch
class
in
d
iv
id
u
ally
[
3
4
]
.
T
h
er
ef
o
r
e,
th
e
co
n
f
u
s
io
n
m
atr
ix
in
d
e
x
will
b
e
co
m
p
u
ted
f
o
r
th
e
d
ataset
u
s
in
g
th
e
co
r
r
elatio
n
m
atr
i
x
as in
Fig
u
r
e
4.
Fig
u
r
e
4
.
C
o
r
r
elatio
n
m
atr
ix
T
h
e
co
r
r
elatio
n
m
atr
ix
is
a
to
o
l
u
s
ed
to
ev
alu
ate
class
if
icatio
n
s
b
y
ass
ess
in
g
th
eir
ab
ilit
y
to
co
r
r
ec
tly
ca
teg
o
r
ize
s
am
p
les,
i.e
.
,
d
eter
m
in
in
g
th
e
co
r
r
ec
t
class
to
wh
ich
a
s
am
p
le
b
elo
n
g
s
.
W
h
en
c
o
m
p
ar
in
g
p
r
ed
icte
d
class
if
icatio
n
s
with
ac
tu
al
clas
s
if
icatio
n
s
,
f
o
u
r
p
o
s
s
ib
le
o
u
tco
m
es c
an
o
cc
u
r
:
a.
T
r
u
e
p
o
s
itiv
e
(
T
P),
wh
er
e
b
o
t
h
th
e
ac
tu
al
an
d
p
r
e
d
icted
class
if
icatio
n
s
ar
e
p
o
s
itiv
e.
b.
Fals
e
p
o
s
itiv
e
(
FP
)
,
r
ea
l c
lass
i
s
n
eg
ativ
e,
b
u
t
p
r
ed
icted
is
p
o
s
itiv
e.
c.
Fals
e
n
eg
ativ
e
(
FN
)
,
t
h
e
o
b
jec
t’
s
class
if
icat
io
n
is
p
o
s
itiv
e
wh
ile
th
e
p
r
ed
icte
d
is
less
th
an
0
.
5
.
d.
T
r
u
e
n
e
g
ativ
e
(
T
N)
,
w
h
er
e
b
o
t
h
th
e
ac
tu
al
an
d
p
r
e
d
icted
class
if
icatio
n
s
ar
e
n
eg
ativ
e.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
0
8
8
-
8
7
0
8
I
n
t J E
lec
&
C
o
m
p
E
n
g
,
Vo
l.
15
,
No
.
6
,
Decem
b
e
r
20
25
:
5
5
7
0
-
5
5
8
3
5576
B
y
an
aly
zin
g
th
ese
o
u
tco
m
es,
th
e
f
o
llo
win
g
p
er
f
o
r
m
an
ce
m
e
tr
ics ar
e
ca
lcu
lated
:
a.
Acc
u
r
ac
y
,
th
at
c
o
m
m
o
n
ly
u
s
e
d
m
ea
s
u
r
e
o
f
o
v
e
r
all
class
if
ier
p
er
f
o
r
m
an
ce
,
ca
lc
u
lated
u
s
in
g
(
3
).
=
+
+
+
+
(
3
)
b.
R
ec
all
m
ea
s
u
r
es
h
o
w
well
th
e
m
o
d
el
is
a
b
le
to
f
in
d
p
o
s
itiv
e
s
am
p
les.
I
t
is
th
e
n
u
m
b
er
o
f
tr
u
e
p
o
s
itiv
e
p
r
ed
ictio
n
s
d
iv
i
d
ed
b
y
th
e
to
ta
l n
u
m
b
er
o
f
ac
t
u
al
p
o
s
itiv
es.
T
h
e
r
ec
all
is
ca
lcu
lated
as in
(
4
)
.
=
(
4
)
c.
Pre
cisi
o
n
is
a
s
tati
s
tic
th
at
m
ea
s
u
r
es
th
e
f
r
ac
tio
n
o
f
th
e
m
o
d
el'
s
p
o
s
itiv
e
p
r
ed
ictio
n
s
th
a
t
ar
e
co
r
r
ec
t.
I
t
r
ef
er
s
to
th
e
n
u
m
b
e
r
o
f
tr
u
e
p
o
s
itiv
e
ca
s
es
d
iv
id
ed
b
y
th
e
s
u
m
o
f
tr
u
e
p
o
s
itiv
e
an
d
f
alse
p
o
s
itiv
e
ca
s
es.
T
h
e
p
r
ec
is
io
n
is
co
m
p
u
ted
u
s
in
g
(
5
)
.
=
(
5
)
d.
F1
Sco
r
e
is
th
e
m
etr
ics
th
at
u
s
ed
to
ass
ess
th
e
p
er
f
o
r
m
an
ce
o
f
a
class
if
icatio
n
m
o
d
el,
p
ar
ticu
lar
ly
in
s
itu
atio
n
s
with
im
b
alan
ce
d
class
d
is
tr
ib
u
tio
n
s
.
I
t
tak
es
in
to
ac
co
u
n
t
b
o
t
h
f
alse
p
o
s
itiv
e
an
d
f
alse
n
eg
ativ
e
er
r
o
r
s
,
o
f
f
er
in
g
a
b
alan
ce
d
ass
ess
m
en
t.
T
h
e
F1
Sco
r
e
is
ca
lcu
lated
u
s
in
g
th
e
f
o
llo
win
g
(
6
)
.
1
−
=
2
∗
∗
+
(
6
)
Fo
r
th
is
an
aly
s
is
,
th
e
d
ata
was
s
p
lit
in
to
tr
ain
in
g
an
d
test
in
g
d
ata
8
0
:2
0
%
to
p
r
o
v
i
d
e
s
u
f
f
i
cien
t
d
ata
f
o
r
tr
ain
in
g
m
o
d
els,
b
u
t
also
to
allo
w
a
r
o
b
u
s
t
ev
alu
atio
n
p
h
ase.
Fu
r
th
er
m
o
r
e,
1
0
-
f
o
ld
c
r
o
s
s
v
alid
atio
n
was
ad
o
p
ted
in
tr
ain
in
g
m
o
d
els
to
f
u
r
t
h
er
im
p
r
o
v
e
m
o
d
el
g
en
er
aliza
tio
n
ab
ilit
y
a
n
d
to
m
i
n
im
ize
th
e
o
v
er
f
itti
n
g
.
T
h
is
m
eth
o
d
r
e
q
u
ir
es
ea
c
h
e
x
am
p
le
in
th
e
d
ataset
to
b
e
u
s
ed
to
b
o
t
h
tr
ai
n
a
n
d
v
alid
ate
th
e
m
o
d
el
m
u
ltip
le
tim
es;
h
en
ce
,
g
iv
in
g
a
m
o
r
e
r
eliab
le
esti
m
ate
o
f
m
o
d
el
p
er
f
o
r
m
a
n
ce
in
th
e
p
r
esen
ce
o
f
v
ar
io
u
s
ty
p
es
o
f
attac
k
s
.
T
h
e
h
y
p
er
-
p
ar
am
eter
s
o
f
all
m
o
d
els
wer
e
g
r
id
s
ea
r
c
h
ed
o
v
er
t
h
e
tr
ain
in
g
s
et,
a
n
d
t
h
e
f
in
al
test
in
g
was
p
er
f
o
r
m
ed
o
n
th
e
test
s
et.
All
r
esu
lts
wer
e
av
er
ag
e
d
o
v
er
th
r
ee
in
d
ep
e
n
d
en
t
ex
p
e
r
im
en
ts
with
th
r
ee
d
if
f
er
en
t
r
an
d
o
m
s
ee
d
s
f
o
r
c
h
ec
k
in
g
co
n
s
is
ten
cy
o
f
r
esu
lts
.
Fig
u
r
e
5
d
em
o
n
s
tr
ates
a
f
lo
wch
ar
t
ex
ac
tn
ess
th
e
m
eth
o
d
o
l
o
g
y
u
s
ed
in
th
is
r
esear
ch
.
T
h
e
p
r
o
ce
s
s
b
eg
in
s
with
d
ata
clea
n
i
n
g
,
w
h
ich
is
v
ital
b
ef
o
r
e
ap
p
l
y
in
g
a
n
y
alg
o
r
ith
m
s
to
p
r
ec
is
e
d
ata
b
a
s
e
an
o
m
alies.
T
h
is
in
clu
d
es
ad
d
r
ess
in
g
lo
s
t
v
alu
es
b
ased
o
n
th
eir
n
atu
r
e
a
n
d
ad
ap
tin
g
te
x
tu
al
d
ata
in
to
n
u
m
er
ical
f
o
r
m
at
to
d
ec
r
ea
s
e
co
m
p
u
tatio
n
al
weig
h
t.
Data
n
o
r
m
aliza
tio
n
,
a
n
d
s
ig
n
if
ican
t
s
tep
s
ca
les
th
e
f
ea
tu
r
e
v
alu
es
to
a
r
a
n
g
e
o
f
[
0
,
1
]
,
f
u
r
th
er
d
r
o
p
p
in
g
co
m
p
u
tatio
n
al
d
em
an
d
s
.
T
h
e
UNSW
-
N
B
1
5
an
d
NSL
-
KDD
d
atasets
wer
e
o
r
ig
in
ally
e
x
p
o
r
ted
in
to
E
x
ce
l
f
o
r
o
r
g
a
n
ized
v
is
u
aliza
tio
n
,
b
asic
an
aly
s
is
,
an
d
p
r
e
p
r
o
ce
s
s
in
g
.
Miss
in
g
v
alu
es
an
d
d
u
p
licates
wer
e
co
n
tr
o
lled
to
p
r
ev
en
t
b
ias
o
r
n
eg
ativ
e
im
p
ac
ts
o
n
th
e
class
if
ier
.
I
n
E
x
ce
l,
attac
k
ty
p
es
wer
e
en
co
d
e
d
in
to
n
u
m
er
ical
v
alu
es to
f
ac
ilit
ate
ea
s
ier
class
if
icatio
n
with
s
elec
ted
class
if
i
er
s
.
Featu
r
e
ex
tr
ac
tio
n
,
a
s
er
io
u
s
s
tep
in
b
u
ild
in
g
an
AI
m
o
d
el,
r
ed
u
ce
s
th
e
d
im
en
s
io
n
alit
y
o
f
h
ig
h
-
d
im
en
s
io
n
al
d
ata,
allev
iatin
g
th
e
co
m
p
u
tatio
n
al
b
u
r
d
en
an
d
s
im
p
lify
in
g
th
e
m
o
d
el.
T
h
is
s
tep
is
d
y
n
am
ic
s
in
ce
in
cr
ea
s
ed
co
m
p
lex
ity
ca
n
n
e
g
ativ
ely
af
f
ec
t
tr
ain
i
n
g
a
n
d
test
in
g
tim
es,
th
u
s
im
p
ac
tin
g
th
e
ac
cu
r
ac
y
o
f
in
tr
u
s
io
n
d
etec
tio
n
.
Featu
r
e
s
elec
tio
n
,
b
ased
o
n
co
r
r
elatio
n
co
ef
f
icien
ts
,
was
u
s
ed
to
id
en
tify
th
e
m
o
s
t
r
elev
an
t
f
ea
t
u
r
es
f
o
r
t
h
e
task
.
T
h
ese
s
tep
s
c
o
n
s
titu
te
th
e
p
r
elim
in
ar
y
d
ata
p
r
ep
r
o
ce
s
s
in
g
p
h
ase,
wh
ic
h
is
cr
u
cial
f
o
r
r
e
d
u
cin
g
p
r
o
ce
s
s
in
g
an
d
class
if
icatio
n
tim
e
wh
ile
en
h
an
cin
g
class
if
icatio
n
ac
cu
r
ac
y
.
I
r
r
elev
an
t
f
ea
tu
r
es c
an
o
f
ten
h
a
v
e
a
d
etr
i
m
en
tal
ef
f
ec
t o
n
class
if
icatio
n
alg
o
r
ith
m
s
.
Af
ter
f
ea
tu
r
e
s
elec
tio
n
,
ML
al
g
o
r
ith
m
s
,
s
p
ec
if
ically
th
e
ML
P
an
d
L
STM
n
etwo
r
k
s
,
wer
e
ap
p
lied
f
o
r
class
if
icatio
n
.
T
h
e
r
esu
lts
wer
e
th
en
co
m
p
a
r
ed
with
th
o
s
e
f
r
o
m
p
r
ev
i
o
u
s
s
tu
d
ies
u
s
in
g
ass
ess
m
en
t
m
etr
ics
f
o
r
b
o
th
d
atasets
.
T
h
e
class
if
ier
s
wer
e
ad
ju
s
ted
with
s
p
ec
if
ic
p
ar
am
eter
s
,
wh
ich
m
ig
h
t
b
e
att
u
n
ed
d
ep
en
d
in
g
o
n
th
e
r
esu
lts
an
d
co
m
p
ar
is
o
n
s
.
Hy
p
er
p
ar
a
m
e
ter
s
o
f
th
e
m
a
c
h
in
e
l
ea
r
n
in
g
an
d
d
ee
p
lear
n
in
g
m
o
d
e
l
s
we
r
e
ad
ju
s
t
ed
to
m
ax
im
iz
e
th
e
p
er
f
o
r
m
an
ce
th
r
o
u
g
h
a
ca
r
ef
u
lly
d
e
s
ig
n
ed
tu
n
in
g
p
r
o
c
es
s
.
G
r
id
s
ea
r
ch
w
it
h
cr
o
s
s
-
v
a
l
id
a
tio
n
(
Gr
id
S
ea
r
ch
C
V
)
wa
s
u
s
ed
to
s
ea
r
ch
o
v
er
a
b
r
o
ad
s
e
t
o
f
h
y
p
er
p
ar
am
e
te
r
s
v
a
lu
e
s
f
o
r
ea
ch
m
eth
o
d
.
Am
o
n
g
th
e
h
y
p
er
p
ar
a
m
e
ter
s
to
b
e
tu
n
ed
w
er
e
n
u
m
b
er
o
f
t
r
ee
s
an
d
m
ax
i
m
u
m
d
ep
th
f
o
r
R
F
m
o
d
e
l,
r
eg
u
lar
iza
t
io
n
an
d
lea
r
n
in
g
r
at
e
f
o
r
lo
g
i
s
t
ic
r
eg
r
e
s
s
io
n
,
n
u
m
b
er
o
f
h
id
d
en
lay
er
s
,
a
ct
iv
a
tio
n
f
u
n
c
tio
n
an
d
le
ar
n
in
g
r
a
te
f
o
r
M
L
P
m
o
d
el
,
an
d
s
eq
u
en
ce
len
g
th
an
d
m
em
o
r
y
u
n
it
s
f
o
r
L
ST
M
m
o
d
e
l.
T
h
e
b
e
s
t
s
et
t
in
g
s
w
er
e
s
e
le
ct
ed
b
y
v
al
id
a
tio
n
ac
cu
r
a
cy
in
1
0
-
f
o
ld
cr
o
s
s
-
v
a
lid
at
io
n
.
E
ar
ly
s
to
p
p
i
n
g
wa
s
al
s
o
u
s
ed
in
t
r
a
in
in
g
t
o
av
o
id
o
v
er
fi
tt
in
g
an
d
co
m
p
u
t
at
io
n
co
s
t.
T
h
is
f
i
n
e
-
tu
n
in
g
s
tr
a
teg
y
g
u
ar
an
teed
al
l
th
e
m
o
d
e
l
s
u
n
d
e
r
w
en
t
th
e
f
in
e
-
tu
n
in
g
in
f
u
l
l
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J E
lec
&
C
o
m
p
E
n
g
I
SS
N:
2088
-
8
7
0
8
I
mp
r
o
vin
g
n
etw
o
r
k
s
ec
u
r
ity
u
s
in
g
d
ee
p
lea
r
n
in
g
fo
r
in
tr
u
s
io
n
d
etec
tio
n
(
Mo
h
a
mme
d
A
l
-
S
h
a
b
i
)
5577
to
ac
h
iev
e
b
e
s
t
d
et
ec
tio
n
p
er
f
o
r
m
an
ce
an
d
g
en
er
al
iz
at
io
n
ab
i
li
ty
.
T
h
e
h
y
p
er
p
ar
a
m
e
ter
s
ex
p
er
i
m
en
ted
f
o
r
ea
ch
a
lg
o
r
i
th
m
ar
e:
a.
R
F: Nu
m
b
er
o
f
tr
ee
s
=
1
2
0
,
lea
r
n
in
g
r
ate
=
0
.
0
1
b.
L
o
g
is
tic
r
eg
r
ess
io
n
: N
u
m
b
er
o
f
iter
atio
n
s
=
1
0
0
,
m
ax
im
u
m
d
e
p
th
o
f
d
ec
is
io
n
tr
ee
=
d
e
f
au
lt
c.
L
STM
: A
ctiv
atio
n
f
u
n
ctio
n
=
t
an
h
T
h
e
1
0
-
f
o
ld
cr
o
s
s
-
v
alid
atio
n
was u
s
ed
to
d
eter
m
in
e
th
e
o
p
tim
al
p
er
f
o
r
m
i
n
g
co
n
f
ig
u
r
atio
n
s
ac
co
r
d
in
g
to
v
alid
atio
n
ac
cu
r
ac
y
.
Fin
ally
,
ea
r
ly
s
to
p
p
i
n
g
was
also
u
s
ed
d
u
r
in
g
tr
ain
in
g
to
av
o
i
d
o
v
e
r
f
itti
n
g
an
d
to
s
av
e
co
m
p
u
tatio
n
b
u
r
d
en
.
T
h
e
s
tr
u
ctu
r
ed
tu
n
i
n
g
p
r
o
ce
d
u
r
e
was
d
esig
n
ed
to
o
b
tain
th
e
b
est
d
e
tectio
n
p
er
f
o
r
m
an
ce
an
d
g
en
e
r
aliza
tio
n
ab
ilit
y
f
o
r
a
ll m
o
d
els.
All th
e
ex
p
er
im
e
n
ts
wer
e
r
u
n
o
n
: M
AT
L
AB
R
2
0
2
1
a
an
d
W
E
KA
3
.
9
(
PHE
-
R
S)
in
an
I
n
tel
C
o
r
e
I
7
Pro
ce
s
s
o
r
an
d
R
AM
1
6
GB
,
wh
er
e
th
e
av
er
a
g
e
C
PU
u
s
ag
e
v
ar
ied
o
n
a
r
an
g
e
o
f
60
–
8
5
%,
an
d
t
h
e
m
e
m
o
r
y
was
ap
p
r
o
x
im
ately
3
.
5
a
n
d
4
.
2
G
B
(
ac
co
r
d
in
g
t
o
th
e
m
o
d
el)
.
W
in
d
o
ws
1
1
Pro
was
th
e
o
p
er
atin
g
s
y
s
tem
.
Fig
u
r
e
5
.
W
o
r
k
f
lo
w
b
o
x
d
ia
g
r
am
4.
RE
SU
L
T
S AN
D
D
I
SCU
SS
I
O
N
T
h
is
s
ec
tio
n
d
eliv
er
s
an
o
u
tli
n
e
o
f
t
h
e
r
esear
ch
m
eth
o
d
o
lo
g
y
an
d
th
e
r
esu
lts
o
b
tain
ed
.
T
h
e
r
esear
ch
co
m
p
ar
ed
th
e
in
tr
u
s
io
n
d
etec
t
io
n
ac
cu
r
ac
y
o
f
th
e
NSL
-
KDD
an
d
UNSW
-
NB
1
5
d
atasets
u
s
in
g
ML
an
d
DL
alg
o
r
ith
m
s
.
W
ek
a
an
d
MA
T
L
AB
s
o
f
twar
e
wer
e
em
p
lo
y
ed
a
t
n
u
m
er
o
u
s
s
tep
s
o
f
th
e
class
if
icatio
n
an
d
f
ea
tu
r
e
ex
tr
ac
tio
n
p
r
o
ce
s
s
es.
T
h
e
p
er
f
o
r
m
an
ce
is
m
ea
s
u
r
ed
f
ir
s
t
o
n
a
Naïv
e
B
ay
es
to
o
l
as
a
b
aselin
e
alg
o
r
ith
m
,
b
ec
au
s
e
o
f
its
an
n
o
tatio
n
s
im
p
licity
an
d
r
u
n
tim
e.
W
e
co
m
p
ar
e
later
m
o
d
els
ag
ain
s
t
th
is
b
ase
m
o
d
el
t
o
ev
alu
ate
h
o
w
it
im
p
r
o
v
es
d
et
ec
tio
n
in
ter
m
s
o
f
ac
cu
r
ac
y
,
p
r
ec
is
io
n
,
r
ec
all,
F1
-
s
co
r
e.
D
ata
p
r
ep
r
o
ce
s
s
in
g
in
E
x
ce
l
p
lay
ed
an
ess
en
tial
r
o
le
in
s
tan
d
ar
d
izin
g
t
h
e
d
at
a
f
o
r
m
at.
T
h
is
s
tep
was
ess
en
tial
f
o
r
r
ed
u
ci
n
g
p
r
o
ce
s
s
in
g
an
d
class
if
icatio
n
tim
e,
wh
ile
also
im
p
r
o
v
in
g
ac
c
u
r
ac
y
,
as
ir
r
elev
an
t
f
ea
tu
r
es
ca
n
n
eg
ativ
ely
af
f
ec
t
p
er
f
o
r
m
an
ce
.
T
h
e
p
r
e
p
r
o
ce
s
s
in
g
p
h
ase
in
v
o
lv
e
d
:
a.
Nu
m
er
ical
en
co
d
i
n
g
o
f
attac
k
ty
p
es
th
at
co
n
v
er
tin
g
attac
k
t
y
p
es
in
to
n
u
m
er
ical
co
d
es
f
ac
ilit
ated
ac
cu
r
ate
class
if
icatio
n
.
I
n
th
is
s
tu
d
y
,
att
ac
k
s
wer
e
en
c
o
d
ed
in
two
s
tag
es:
f
ir
s
t,
th
e
m
ain
attac
k
ty
p
es
wer
e
en
co
d
ed
,
f
o
llo
wed
b
y
t
h
e
s
u
b
-
attac
k
ty
p
es
f
o
r
m
o
r
e
d
etailed
id
en
tific
atio
n
.
No
r
m
al
r
ec
o
r
d
s
wer
e
e
n
co
d
ed
as
0
an
d
attac
k
r
ec
o
r
d
s
as 1
i
n
b
o
t
h
d
at
asets
.
T
h
e
s
tu
d
y
f
o
cu
s
ed
o
n
b
in
ar
y
class
if
icatio
n
.
b.
Featu
r
e
r
ed
u
ctio
n
ca
n
in
cr
ea
s
e
co
m
p
u
tatio
n
al
tim
e
an
d
r
e
d
u
ce
class
if
icatio
n
ac
cu
r
ac
y
,
m
ak
in
g
f
ea
tu
r
e
r
ed
u
ctio
n
n
ec
ess
ar
y
.
T
h
is
r
es
ea
r
ch
u
s
ed
m
ath
em
atica
l
r
elatio
n
s
h
ip
s
to
ca
lcu
late
f
ea
tu
r
e
co
r
r
elatio
n
s
an
d
id
en
tify
u
n
n
ec
ess
ar
y
f
ea
tu
r
es.
T
h
is
p
r
o
ce
s
s
in
clu
d
ed
:
Evaluation Warning : The document was created with Spire.PDF for Python.
I
SS
N
:
2
0
8
8
-
8
7
0
8
I
n
t J E
lec
&
C
o
m
p
E
n
g
,
Vo
l.
15
,
No
.
6
,
Decem
b
e
r
20
25
:
5
5
7
0
-
5
5
8
3
5578
˗
I
d
en
tify
in
g
r
ed
u
n
d
a
n
t
f
ea
tu
r
e
s
v
ia
v
ar
ian
ce
ca
lcu
latio
n
,
w
h
er
e
f
ea
tu
r
es
with
ze
r
o
v
a
r
ian
ce
,
m
ea
n
in
g
th
o
s
e
th
at
r
em
ain
ed
u
n
c
h
an
g
e
d
ac
r
o
s
s
th
e
d
ataset,
wer
e
d
is
c
ar
d
ed
.
˗
T
h
is
was
d
o
n
e
u
s
in
g
t
h
e
v
a
r
ian
ce
f
o
r
m
u
la
in
MA
T
L
AB
with
th
e
v
ar
ia
b
le
f
u
n
ctio
n
,
wh
er
e
v
alu
e
r
ep
r
esen
ts
th
e
s
elec
ted
f
ea
tu
r
e
co
lu
m
n
.
T
h
e
v
ar
ian
ce
r
e
s
u
lts
f
o
r
th
e
UNSW
-
NB
1
5
d
ataset
ar
e
p
r
esen
ted
in
T
a
b
le
2
.
T
h
e
r
ea
s
o
n
f
o
r
u
s
to
ch
o
o
s
e
t
h
e
ML
an
d
DL
m
o
d
els,
n
am
ely
K
NN,
R
F,
ML
P,
L
STM
,
is
d
u
e
to
th
e
f
o
llo
win
g
s
ev
er
al
c
o
n
s
id
er
atio
n
s
s
p
ec
if
ic
to
in
tr
u
s
io
n
d
etec
tio
n
p
r
o
b
lem
s
:
a.
R
F
was
s
e
lecte
d
d
u
e
to
its
s
tr
en
g
th
in
d
ea
lin
g
with
h
ig
h
-
d
i
m
en
s
io
n
al
d
ata
a
n
d
o
v
er
f
itti
n
g
av
o
id
a
n
ce
an
d
r
ea
s
o
n
ab
le
p
er
f
o
r
m
a
n
ce
in
m
u
lticlas
s
cla
s
s
if
icat
io
n
task
s
.
I
t
p
r
o
v
es
to
b
e
esp
ec
ially
u
s
ef
u
l
in
th
e
ar
ea
s
o
f
cy
b
er
s
ec
u
r
ity
,
w
h
er
e
th
e
a
n
aly
s
is
o
f
th
e
im
p
o
r
tan
ce
o
f
f
ea
tu
r
es is
also
a
r
eq
u
ir
em
en
t
.
b.
ML
P
was
ch
o
s
en
as
a
b
aseli
n
e
d
ee
p
lear
n
in
g
m
o
d
el
th
at
ca
n
b
e
ap
p
lied
ef
f
ec
tiv
ely
o
n
to
s
tr
u
ctu
r
ed
r
ec
o
r
d
s
s
u
ch
as
n
etwo
r
k
tr
af
f
i
c
lo
g
s
.
I
t
is
f
le
x
ib
le
in
t
u
n
in
g
th
e
h
id
d
e
n
lay
er
s
a
n
d
ac
tiv
ati
o
n
f
u
n
ctio
n
s
,
s
o
it c
an
ac
co
m
m
o
d
ate
co
m
p
lex
r
elatio
n
s
am
o
n
g
f
ea
tu
r
es.
c.
KNN
was
ad
d
ed
as
a
s
im
p
le
n
o
n
-
p
ar
am
etr
ic
m
o
d
el
t
h
at
m
ak
es
a
s
o
lid
b
aselin
e
f
o
r
t
h
e
c
o
m
p
ar
is
o
n
with
m
o
r
e
s
o
p
h
is
ticated
class
if
ier
s
.
d.
L
STM
n
etwo
r
k
s
wer
e
ad
d
e
d
to
test
if
th
e
tem
p
o
r
al
asp
ec
ts
o
f
n
etwo
r
k
t
r
af
f
ic
n
a
m
ely
tim
e
s
eq
u
en
tial
attac
k
b
eh
a
v
io
r
s
if
ca
p
tu
r
e
d
a
s
a
tr
ain
er
f
ea
tu
r
e
o
r
n
o
t
b
y
th
e
ML
m
o
d
els,
an
d
if
th
e
p
r
es
en
ce
o
f
s
u
ch
b
y
th
e
ML
Mo
d
els im
p
r
o
v
es th
e
p
r
e
-
d
ictio
n
o
f
attac
k
s
o
r
n
o
t.
T
o
g
eth
er
,
t
h
ese
m
o
d
els
co
n
s
t
itu
te
th
e
m
o
s
t
co
m
p
r
eh
e
n
s
iv
e
co
m
p
ar
is
o
n
o
f
class
ical
m
ac
h
in
e
lear
n
in
g
an
d
r
ec
en
t d
ee
p
lea
r
n
in
g
ap
p
r
o
ac
h
es in
th
e
co
n
tex
t
o
f
I
DS to
d
ate.
T
ab
le
2
.
Var
ian
ce
r
esu
lts
f
o
r
e
ac
h
f
ea
tu
r
e
i
n
th
e
UNSW
-
NB
1
5
d
ataset
F
E.
V
a
r
.
F
E.
V
a
r
.
F
E.
V
a
r
.
F
E.
V
a
r
.
F
E.
V
a
r
.
1
0
.
3
5
9
6
2
1
.
5
8
5
9
3
0
.
2
5
1
6
4
4
.
3
5
7
5
0
.
5
8
3
9
6
0
.
0
2
5
4
8
7
0
.
6
9
8
7
8
0
.
0
8
0
8
9
0
.
0
1
7
1
10
0
.
0
9
6
8
11
0
.
1
2
0
2
12
0
.
8
0
8
7
13
0
.
1
3
2
2
14
5
.
2
0
5
15
1
.
5
8
8
9
16
5
.
2
9
5
8
17
5
.
3
6
9
5
18
0
.
2
5
4
7
19
0
.
2
5
9
8
20
0
.
0
2
5
6
21
0
.
2
5
8
9
22
1
.
0
2
5
9
23
0
.
0
8
9
7
24
2
.
3
6
9
8
25
8
.
3
6
5
1
26
0
.
2
2
0
3
27
0
.
5
2
5
9
28
0
.
0
0
2
3
29
0
30
0
31
0
.
0
3
6
5
32
0
.
0
0
2
7
33
5
.
2
3
3
2
34
2
.
3
6
5
8
35
0
.
3
2
5
8
36
0
.
2
5
8
1
37
0
.
6
5
2
3
38
0
.
0
9
6
8
39
0
40
0
.
0
7
0
2
41
1
.
0
0
5
6
42
0
.
1
6
5
8
43
0
.
2
3
6
5
44
0
.
8
7
8
9
45
0
.
0
0
3
6
4
T
ab
le
2
s
h
o
ws
th
at
f
ea
tu
r
es
2
9
,
3
0
,
an
d
3
9
h
av
e
ze
r
o
v
a
r
ian
c
e,
m
ea
n
in
g
th
eir
v
alu
es
r
em
ai
n
co
n
s
tan
t
ac
r
o
s
s
th
e
en
tire
d
ataset
an
d
a
r
e
th
e
s
am
e
f
o
r
all
r
ec
o
r
d
s
.
As
a
r
esu
lt,
th
ese
f
ea
tu
r
es
ca
n
b
e
r
em
o
v
ed
f
r
o
m
th
e
class
if
icatio
n
p
r
o
ce
s
s
,
h
elp
in
g
to
r
e
d
u
ce
co
m
p
u
tatio
n
al
l
o
ad
an
d
class
if
icatio
n
tim
e.
Featu
r
e
2
9
r
ep
r
esen
ts
th
e
s
tar
t
tim
e,
f
ea
tu
r
e
3
0
r
ep
r
esen
ts
th
e
en
d
tim
e,
an
d
f
ea
tu
r
e
3
9
in
d
icate
s
wh
eth
er
th
e
u
s
er
i
s
lo
g
g
ed
in
(
with
a
v
alu
e
o
f
1
)
o
r
n
o
t
(
with
a
v
a
lu
e
o
f
0
)
.
Af
ter
elim
in
atin
g
t
h
ese
f
ea
tu
r
es,
th
e
d
ataset
is
r
ed
u
ce
d
,
leav
in
g
4
4
f
ea
tu
r
es,
alo
n
g
with
th
e
lab
el
in
d
icatin
g
wh
et
h
er
a
r
ec
o
r
d
is
n
o
r
m
al
o
r
an
attac
k
.
Fo
r
th
e
NSL
-
KDD
d
ataset,
th
e
v
ar
ian
ce
ca
lc
u
latio
n
r
esu
lt
s
ar
e
s
h
o
wn
in
T
ab
le
3
.
T
ab
le
3
.
Var
ian
ce
r
esu
lts
f
o
r
e
ac
h
f
ea
tu
r
e
i
n
th
e
NSL
-
KDD
d
ataset
F
E.
V
a
r
.
F
E.
V
a
r
.
F
E.
V
a
r
.
F
E.
V
a
r
.
F
E.
V
a
r
.
1
1
.
9
8
5
2
.
2
3
5
6
4
.
5
0
2
6
7
3
.
1
0
4
2
8
0
.
0
2
0
3
9
0
.
0
0
1
3
10
0
.
8
6
2
11
0
.
0
2
2
6
12
0
.
2
4
6
7
13
5
2
.
8
4
7
14
0
.
0
0
2
4
15
4
.
4
3
5
3
16
6
4
.
6
6
7
6
17
0
.
4
5
8
1
18
0
.
0
0
2
3
19
0
.
0
0
4
6
20
0
21
0
22
0
.
0
2
7
6
23
1
.
6
5
2
2
24
7
.
9
3
2
1
25
0
.
0
8
7
2
26
0
.
0
8
9
27
0
.
1
7
3
2
28
0
.
1
7
3
2
29
0
.
1
7
0
2
30
0
.
0
6
7
2
31
0
.
0
6
4
3
32
8
.
8
4
2
9
6
33
1
.
2
4
9
6
34
0
.
1
8
9
8
35
0
.
0
4
8
7
36
0
.
9
3
8
37
0
.
0
0
7
3
38
0
.
0
7
4
6
39
0
.
0
7
9
4
40
0
.
1
4
9
9
41
0
.
1
6
0
7
T
ab
le
3
in
d
icate
s
th
at
f
ea
tu
r
es
2
0
an
d
2
1
h
a
v
e
ze
r
o
v
a
r
ian
c
e,
m
ea
n
in
g
th
eir
v
alu
es
r
em
ai
n
co
n
s
tan
t
ac
r
o
s
s
all
r
ec
o
r
d
s
in
t
h
e
d
a
taset.
As
a
r
esu
lt,
th
ese
f
ea
tu
r
es
ca
n
b
e
r
e
m
o
v
e
d
with
o
u
t
im
p
ac
tin
g
th
e
class
if
icatio
n
ac
cu
r
ac
y
,
t
h
u
s
r
ed
u
cin
g
th
e
d
ataset
s
ize.
Af
ter
th
is
s
tep
,
th
e
n
u
m
b
er
o
f
f
ea
tu
r
es
is
r
ed
u
ce
d
to
3
9
(
wh
er
e
f
ea
tu
r
e
2
is
th
e
s
cr
_
p
o
r
t,
f
ea
tu
r
e
3
is
th
e
d
s
t_
ip
an
d
f
e
atu
r
e
4
is
th
e
d
s
t_
p
o
r
t)
.
Featu
r
e
2
0
r
e
p
r
esen
ts
th
e
n
u
m
b
er
o
f
c
o
m
m
an
d
s
is
s
u
ed
in
an
FTP
s
ess
io
n
,
wh
ile
f
ea
tu
r
e
2
1
ta
k
es
a
v
alu
e
o
f
1
if
a
lo
g
in
to
th
e
h
o
tlis
t
o
cc
u
r
s
an
d
0
o
th
er
wis
e.
Sin
c
e
b
o
th
f
ea
tu
r
es
h
av
e
th
e
s
am
e
v
alu
e
f
o
r
all
r
ec
o
r
d
s
,
r
em
o
v
in
g
th
em
will
n
o
t
af
f
ec
t th
e
class
if
icatio
n
p
r
o
ce
s
s
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
n
t J E
lec
&
C
o
m
p
E
n
g
I
SS
N:
2088
-
8
7
0
8
I
mp
r
o
vin
g
n
etw
o
r
k
s
ec
u
r
ity
u
s
in
g
d
ee
p
lea
r
n
in
g
fo
r
in
tr
u
s
io
n
d
etec
tio
n
(
Mo
h
a
mme
d
A
l
-
S
h
a
b
i
)
5579
T
o
id
en
tify
co
r
r
elate
d
f
ea
tu
r
es,
th
e
co
r
r
elatio
n
co
e
f
f
icien
t
was
ca
lcu
lated
f
o
r
ea
ch
p
air
.
T
h
e
co
r
r
elatio
n
c
o
ef
f
icien
t
r
a
n
g
es
f
r
o
m
-
1
to
1
,
with
v
alu
es
clo
s
er
to
1
in
d
icatin
g
a
s
tr
o
n
g
er
c
o
r
r
elatio
n
.
T
h
e
aim
is
to
r
em
o
v
e
o
n
e
f
ea
t
u
r
e
f
r
o
m
ea
ch
h
ig
h
ly
c
o
r
r
elate
d
p
air
,
as
th
e
p
r
esen
ce
o
f
o
n
e
f
ea
tu
r
e
m
ak
es
th
e
o
th
er
r
ed
u
n
d
an
t.
Usi
n
g
th
e
co
r
r
elati
o
n
co
ef
f
icien
t f
o
r
m
u
la
an
d
th
e
MA
T
L
AB
f
u
n
ctio
n
co
r
r
co
ef
(
a,
b
)
,
t
h
e
co
r
r
elatio
n
co
ef
f
icien
t
f
o
r
ea
c
h
p
air
was
ca
lcu
lated
.
T
h
e
f
o
llo
win
g
T
a
b
le
4
p
r
esen
ts
th
e
m
o
s
t
co
r
r
elate
d
f
ea
tu
r
es,
th
o
s
e
with
a
co
r
r
elatio
n
c
o
ef
f
icien
t
g
r
ea
ter
th
an
0
.
9
,
f
o
r
th
e
UNSW
-
NB
1
5
an
d
NSL
-
KDD
d
atasets
.
T
ab
le
4
r
ev
ea
ls
s
ev
er
al
co
r
r
elatio
n
s
b
etwe
en
f
ea
tu
r
es
f
o
r
UNSW
-
N
B
1
5
d
ataset:
f
ea
t
u
r
e
1
0
is
co
r
r
elate
d
with
f
ea
tu
r
e
3
1
,
f
e
atu
r
e
1
1
with
f
ea
tu
r
e
3
2
,
f
ea
t
u
r
e
4
5
with
f
ea
tu
r
es
4
4
a
n
d
4
2
,
f
ea
tu
r
e
4
6
with
f
ea
tu
r
es
4
3
,
4
1
,
a
n
d
4
7
,
f
ea
tu
r
e
8
with
f
ea
tu
r
es
1
7
an
d
2
3
,
a
n
d
f
ea
tu
r
e
9
with
f
ea
tu
r
es
1
8
an
d
2
4
.
As
a
r
esu
lt,
o
n
e
f
ea
tu
r
e
f
r
o
m
ea
ch
co
r
r
elat
ed
p
air
ca
n
b
e
r
em
o
v
e
d
.
Fo
r
ex
am
p
le,
th
e
n
u
m
b
er
o
f
co
n
n
ec
tio
n
s
with
th
e
s
am
e
s
o
u
r
ce
I
P
an
d
d
esti
n
atio
n
s
er
v
ice,
f
ea
tu
r
e
4
5
,
ca
n
b
e
s
u
b
s
titu
ted
f
o
r
f
ea
tu
r
es
4
4
(
n
u
m
b
er
o
f
co
n
n
ec
tio
n
s
with
th
e
s
am
e
s
o
u
r
ce
I
P)
an
d
4
2
(
n
u
m
b
er
o
f
co
n
n
ec
tio
n
s
with
t
h
e
s
am
e
d
esti
n
atio
n
s
er
v
ice)
s
in
ce
th
e
last
two
f
ea
tu
r
es
ar
e
au
x
iliar
y
f
o
r
th
e
f
o
r
m
er
.
T
h
e
s
am
e
r
ea
s
o
n
also
ap
p
lies
to
an
y
o
th
er
c
o
r
r
elate
d
f
ea
tu
r
e.
Fo
llo
win
g
th
is
p
r
o
ce
s
s
,
th
e
UNSW
-
NB
1
5
d
ataset
is
r
ed
u
ce
d
to
3
3
f
ea
tu
r
es,
alo
n
g
with
th
e
lab
el
in
d
icatin
g
wh
eth
er
a
r
ec
o
r
d
is
n
o
r
m
al
o
r
ab
n
o
r
m
al.
T
ab
le
4
.
C
o
r
r
elate
d
f
ea
tu
r
es in
th
e
UNSW
-
NB
1
5
an
d
NSL
-
KDD
d
ataset
s
U
N
S
W
-
N
B
1
5
N
S
L
-
K
D
D
F
e
a
t
u
r
e
p
a
i
r
C
o
r
r
e
l
a
t
i
o
n
c
o
e
f
f
i
c
i
e
n
t
F
e
a
t
u
r
e
p
a
i
r
C
o
r
r
e
l
a
t
i
o
n
c
o
e
f
f
i
c
i
e
n
t
(
1
0
,
3
1
)
0
.
9
0
1
5
(
1
3
,
1
6
)
0
.
9
9
6
(
1
1
,
3
2
)
0
.
9
2
5
3
(
1
2
,
1
6
)
0
.
9
0
0
6
(
8
,
1
7
)
0
.
9
9
0
6
(
2
5
,
2
6
)
0
.
9
6
6
4
(
8
,
2
3
)
0
.
9
9
1
5
(
2
5
,
3
8
)
0
.
9
0
4
1
(
9
,
1
8
)
0
.
9
9
3
4
(
2
5
,
3
9
)
0
.
9
0
0
8
(
9
,
2
4
)
0
.
9
9
5
9
(
2
6
,
3
8
)
0
.
9
9
9
7
(
4
4
,
4
5
)
0
.
9
7
4
2
(
2
6
,
3
9
)
0
.
9
2
1
(
4
2
,
4
5
)
0
.
9
6
9
8
(
2
7
,
2
8
)
0
.
9
7
5
5
(
4
1
,
4
6
)
0
.
9
9
3
6
(
2
7
,
4
0
)
0
.
9
8
5
2
(
4
3
,
4
6
)
0
.
9
9
5
6
(
2
7
,
4
1
)
0
.
9
3
1
(
4
6
,
4
7
)
0
.
9
0
4
1
(
2
8
,
4
0
)
0
.
9
8
(
2
8
,
4
1
)
0
.
9
4
7
8
(
3
3
,
3
4
)
0
.
9
0
4
4
(
3
8
,
3
9
)
0
.
9
4
5
(
4
0
,
4
1
)
0
.
9
0
4
7
T
ab
le
4
also
r
e
v
ea
ls
s
ev
er
al
c
o
r
r
elatio
n
s
b
etwe
en
f
ea
tu
r
es
f
o
r
NSL
-
KDD
d
ataset
,
wh
e
r
e
f
ea
tu
r
e
1
6
is
h
ig
h
ly
co
r
r
elate
d
with
f
ea
t
u
r
e
s
1
2
an
d
1
3
,
allo
win
g
f
ea
tu
r
es
1
2
an
d
1
3
t
o
b
e
r
e
m
o
v
e
d
wh
i
le
r
etain
in
g
f
ea
tu
r
e
1
6
.
Similar
ly
,
f
ea
tu
r
e
2
5
ca
n
r
ep
lace
f
ea
tu
r
es
2
6
,
3
8
,
an
d
3
9
;
f
ea
tu
r
e
2
8
ca
n
r
e
p
lace
f
ea
tu
r
es
2
7
,
4
0
,
a
n
d
4
1
;
an
d
f
ea
tu
r
e
3
3
ca
n
r
e
p
lace
f
ea
tu
r
e
3
4
.
Fo
r
in
s
tan
ce
,
f
ea
tu
r
e
2
5
r
ep
r
esen
ts
th
e
p
er
ce
n
tag
e
o
f
r
etr
an
s
m
is
s
io
n
attem
p
ts
,
wh
ich
s
tr
o
n
g
ly
co
r
r
elate
s
with
f
ea
tu
r
e
2
6
,
r
ep
r
esen
tin
g
th
e
p
er
ce
n
ta
g
e
o
f
co
n
n
ec
tio
n
s
to
th
e
s
am
e
s
er
v
ice
an
d
h
o
s
t.
Sin
ce
k
n
o
wi
n
g
th
e
r
etr
a
n
s
m
is
s
io
n
attem
p
ts
p
r
o
v
i
d
e
s
u
f
f
icien
t in
f
o
r
m
atio
n
to
in
f
er
s
u
cc
ess
f
u
l
co
n
n
ec
tio
n
s
,
f
ea
tu
r
e
2
6
b
ec
o
m
es
r
ed
u
n
d
an
t.
T
h
e
s
am
e
p
r
in
cip
le
ap
p
lies
to
th
e
o
th
er
co
r
r
elate
d
f
ea
tu
r
es.
As
a
r
esu
lt,
th
e
r
etain
ed
f
ea
tu
r
es
ar
e
1
6
,
2
5
,
2
8
,
an
d
3
3
,
wh
ile
th
e
r
em
o
v
ed
f
ea
tu
r
es
ar
e
1
2
,
1
3
,
2
6
,
3
8
,
3
9
,
2
7
,
4
0
,
an
d
4
1
.
T
h
is
f
ea
tu
r
e
s
elec
tio
n
p
r
o
ce
s
s
r
ed
u
ce
s
th
e
d
ataset
to
3
0
f
ea
tu
r
es.
Fo
llo
win
g
th
is
p
r
ep
r
o
ce
s
s
in
g
s
tep
,
class
if
icatio
n
alg
o
r
ith
m
s
wer
e
ap
p
lied
to
b
o
th
d
atasets
,
with
th
e
r
esu
lts
co
m
p
ar
ed
u
s
in
g
th
e
W
ek
a
s
o
f
twar
e.
T
h
e
f
o
llo
win
g
T
ab
le
5
p
r
esen
ts
th
e
ac
cu
r
ac
y
r
esu
lts
b
ased
o
n
co
n
f
u
s
io
n
m
atr
ix
p
a
r
am
eter
s
f
o
r
ea
c
h
d
ataset
f
o
r
th
e
U
NSW
-
N
B
1
5
an
d
NSL
-
KDD
d
atasets
.
T
ab
le
5
d
em
o
n
s
tr
ates
th
at
all
th
e
class
if
icatio
n
alg
o
r
ith
m
s
p
r
o
d
u
c
ed
s
tr
o
n
g
p
e
r
f
o
r
m
an
ce
,
with
th
e
R
F
tech
n
iq
u
e
s
h
o
win
g
s
u
p
er
io
r
r
esu
lts
o
n
th
e
UNSW
-
N
B
1
5
d
ataset,
ac
h
iev
in
g
th
e
h
ig
h
est
d
etec
tio
n
ac
c
u
r
ac
y
o
f
9
9
.
7
%
an
d
an
F1
-
s
co
r
e
o
f
9
9
%.
T
ab
le
5
also
s
h
o
ws
th
at
th
e
DL
m
o
d
e
l
ML
P
ac
h
iev
ed
th
e
h
ig
h
est
p
er
f
o
r
m
a
n
ce
o
n
t
h
e
NSL
-
KDD
te
s
t
s
e
t,
with
a
d
e
tectio
n
ac
cu
r
ac
y
o
f
9
8
.
9
%
an
d
an
F1
-
s
co
r
e
o
f
9
9
%.
Ov
er
a
ll,
all
cla
s
s
if
icatio
n
alg
o
r
ith
m
s
d
eliv
er
ed
s
tr
o
n
g
r
esu
lts
,
with
p
er
f
o
r
m
an
ce
m
etr
ics
ex
ce
ed
in
g
9
0
%.
T
h
e
f
o
llo
win
g
d
iag
r
am
s
illu
s
tr
ate
a
co
m
p
ar
is
o
n
o
f
p
er
f
o
r
m
an
ce
m
et
r
ics f
o
r
b
o
th
d
ata
s
ets
.
I
n
g
en
er
al,
we
o
b
s
er
v
e
th
at
b
o
th
ML
an
d
DL
b
ased
m
o
d
els
wer
e
p
r
o
m
is
in
g
in
d
etec
tin
g
n
etwo
r
k
in
tr
u
s
io
n
s
.
No
n
eth
eless
,
R
F
s
h
o
ws
th
e
h
ig
h
est p
er
f
o
r
m
an
ce
o
n
th
e
UNSW
-
NB
1
5
d
ataset
(
9
9
.
7
%),
wh
ile
ML
P
ac
h
iev
ed
t
h
e
s
am
e
r
esu
lt
o
n
NSL
-
KDD
d
ataset
(
9
8
.
9
%).
T
h
e
r
esu
lt
in
d
icate
s
th
at
m
o
d
el
p
er
f
o
r
m
an
ce
m
ay
d
if
f
er
b
ased
o
n
d
ataset
p
r
o
p
er
ties
,
e.
g
.
f
ea
tu
r
e
d
is
tr
ib
u
tio
n
an
d
attac
k
d
iv
e
r
s
ity
.
T
h
e
f
o
llo
win
g
Fig
u
r
e
6
illu
s
tr
ates
a
co
m
p
ar
is
o
n
b
etw
ee
n
alg
o
r
ith
m
s
o
n
th
e
x
-
ax
is
(
i.e
.
NB
,
KNN,
R
F,
DT
,
M
L
P,
an
d
L
STM
)
o
f
p
er
f
o
r
m
an
ce
m
etr
ics
in
y
-
ax
is
ar
e
d
iv
id
ed
in
to
f
o
u
r
s
ec
tio
n
s
(
a
cc
u
r
ac
y
in
Fig
u
r
e
6(
a
)
,
r
e
ca
ll
in
Fig
u
r
e
6(
b
)
,
p
r
ec
is
io
n
in
Fig
u
r
e
6(
c
)
,
an
d
F1
-
s
co
r
e
in
Fig
u
r
e
6(
d
)
f
o
r
b
o
th
d
atasets
.
Evaluation Warning : The document was created with Spire.PDF for Python.