Information Technology Reference
In-Depth Information
dt_hst_reor_rt, dt_hst_srv_rerr_rt). For the single default hidden layer there is 9
nodes. Rest of the information is default for the architecture.
Thus the developed IDS model required to be assessed based on performance
measures using the model evaluation criteria discussed in the next section.
4.1 Measurement of Proposed Model Performance
In Table
4
the model summary shows information about the outcomes of training
and applying the
final network to the testing sample. Cross entropy error is shown
since the output layer uses the softmax activation function using that the network
tries to minimize the error during training. The confusion matrix provides the
percentage of incorrect predictions. The execution of algorithm stopped when the
maximum number of epochs reached and training has been completed ideally when
the errors has converged.
In Table
5
the confusion matrix displays the useful outcomes of applying the
network. For each case, the predicted response is anomaly if that cases
is predicted
pseudo-probability is greater than equal to 1 else it is normal attack. For each sample:
Cells on the diagonal of the cross-classi
'
cation of cases are correct predictions and
off the diagonal of the cross-classification of cases are incorrect predictions.
Table 4 Model summary
Training
Cross entropy error
520.534
Percent incorrect predictions
1.0 %
1 consecutive step(s) with no decrease in error
a
Stopping rule used
Training time
00:00:11.969
Testing
Cross entropy error
331.762
Percent incorrect predictions
1.3 %
Dependent variable: class
a
Error computations are based on the testing sample
Table 5 Confusion matrix
Sample
Observed
Predicted
a
n
Percent correct (%)
Training
a
8,142
73
99.1
n
96
9,412
99.0
Overall percent
46.5 %
53.5 %
99.0
Testing
a
3,484
43
98.8
n
57
3,884
98.6
Overall percent
47.4 %
52.6 %
98.7
Dependent variable: class
Search WWH ::
Custom Search