Modelling of Intrusion Detection System Using Artificial Intelligence—Evaluation of Performance Measures - Complex System Modelling and Control Through Intelligent Soft Computations - page 318

Table 2 Case processing
summary

N Percent (%)

Sample Training 17,723 70.4

Testing 7,468 29.6

Valid 25,191 100.0

Excluded 0

Total 25,191

the predictors represents the value of each hidden unit; that depends partly on the
network type and on user-controllable condition. Anomaly and Normal from
intrusion detection modeling point of view are being represented by the output layer
as dependent variables. Since the class of response is a categorical variable with two
classes, it is recoded as binary class variables. Each output node is some function of
the hidden node that is also partly on the network type and on user-controllable
condition. The proposed Multilayer Perceptron (MLP) model generates a predictive
architecture for one dependent (target) variable to classify whether the attack class
is anomaly or normal one.
In Table 2 the summary of case processing shows that 17,723 cases were
assigned to the training sample and 7,468 to the testing sample.
Table 3 displays information on the neural network and is helpful for making sure
that the speci

cations are accurate. The number of nodes in the input layer is 39 and
similarly binary class out is represented by the two output units in output layer. The
applied KDDCUP-99 dataset has 39 independent variables representing the input
layer of the proposed model (duration, protocol_type, service, fl ag, src_bytes,

dst_bytes, land, wrong_fragment, urgent, hot, num_failed_logins, logged_in,

num_compromised, root_shell, su_attempted, num_root, num_ le_creations, num_

shells, num_access_ les, is_guest_login, count, srv_count, serror_rate, srv_ser-

ror_rate, rerror_rate, srv_rerror_rate, same_srv_rate, diff_srv_rate, srv_diff_ho-
st_rate, dst_host_count, dst_host_srv_cnt, dt_hst_se_srv_rt, dt_host_diff_srv_rt,
dt_hst_sm_src_prt_rt, dt_hst_srv_dif_ht_rt, dt_hst_seror_rt, dt_hst_srv_ser_rt,

Table 3 Network information
Input layer Covariates number of units a 39 input variables from the

KDDCUP 99 dataset

Rescaling method for covariates Standardized

Hidden layer(s) Number of hidden layers 1

Number of units in hidden layer 1 a 9

Activation function Hyperbolic tangent

Output layer Dependent variables Class 1

Number of units 2

Activation function Softmax

Error function Cross-entropy

a Excluding the bias unit