and FN (False Negative) indicates that the number of attacks incorrectly classified by intrusion detection system as normal packets. In (7), corresponds to the relative importance of precision versus recall and is usually set to 1. On one β hand, when precision and recall have equal weights and close to 1, the model can achieve close F-Value to 1, which indicates good performance meaning that the classifier has 0% false alarms and 100% detection of attacks. On the other hand, close to 0 indicates poor performance. Thus, the F-Value F-Value of a classifier is desired to be as high as possible. The selected principal components are the one which facilitates the classifier to achieve the greatest kfinal among the candidates and Then, selected principal components are used in the F-Value k1, k2 k3. kfinal profile generation, which is briefly discussed in Subection 3.2.4. 3.2.4 Profile Generation Using Mahalanobis Distance Map Network traffic profile is generated using Mahalanobis Distance Map (MDM) which captures complex non-linear correlations of the data. By using MDM, the hidden correlations between the features of projected feature vector, which is obtained from the projection of original feature vector onto the kfinal dimensional feature subspace (outcome of IFSEng), and the correlations among packets are obtained as follows. , (10) , (11) , (12) where represents the projected feature in the projected feature vector denotes the average of each a-th projected feature, defines the Mahalanobis distance between the projected feature and the a-th b-th projected feature, is the covariance value of each projected feature, and finally is the MDM (the pattern D of a network packet). Distance map is used to generate the network traffic profiles (normal and attack) D of the training and test data. These profiles are used for the classification of incoming network traffic.
and FN (False Negative) indicates that the number of attacks incorrectly classified by intrusion detection system as normal packets. In (7), β corresponds to the relative importance of precision versus recall and is usually set to 1. On one hand, when precision and recall have equal weights and close to 1, the model can achieve F-Value close to 1, which indicates good performance meaning that the classifier has 0% false alarms and 100% detection of attacks. On the other hand, F-Value close to 0 indicates poor performance. Thus, the F-Value of a classifier is desired to be as high as possible. The selected kfinal principal components are the one which facilitates the classifier to achieve the greatest F-Value among the candidates k1, k2 and k3. Then, selected kfinal principal components are used in the profile generation, which is briefly discussed in Subection 3.2.4. 3.2.4 Profile Generation Using Mahalanobis Distance Map Network traffic profile is generated using Mahalanobis Distance Map (MDM) which captures complex non-linear correlations of the data. By using MDM, the hidden correlations between the features of projected feature vector, which is obtained from the projection of original feature vector onto the kfinal dimensional feature subspace (outcome of IFSEng), and the correlations among packets are obtained as follows. , (10) , (11) , (12) where represents the a-th projected feature in the projected feature vector denotes the average of each projected feature, defines the Mahalanobis distance between the a-th projected feature and the b-th projected feature, is the covariance value of each projected feature, and finally D is the MDM (the pattern of a network packet). Distance map D is used to generate the network traffic profiles (normal and attack) of the training and test data. These profiles are used for the classification of incoming network traffic.