Intelligent feature selection and classification techniques for intrusion detection in networks: a survey
---
paper_title: Intelligent agents: an emerging technology for next generation telecommunications?

paper_content:

The telecommunications environment is changing its face towards an open market of information services where the vision is "information any time, at any place, in any form". Within this electronic market the aspects of service customization and instant service provision are of fundamental importance. In this context a new paradigm is gaining momentum referred to as "intelligent agents". This paper provides an overview of the emerging field of intelligent agents (IAs) by identifying their basic properties. Focusing on mobile agents, which could be considered as a specific class of intelligent agents, we identify the chances of agent technology in the context of telecommunications. We look at their potential impacts on open service architectures, intelligent communications and network management.
---
paper_title: Wrappers for feature subset selection

paper_content:

Abstract In the feature subset selection problem, a learning algorithm is faced with the problem of selecting a relevant subset of features upon which to focus its attention, while ignoring the rest. To achieve the best possible performance with a particular learning algorithm on a particular training set, a feature subset selection method should consider how the algorithm and the training set interact. We explore the relation between optimal feature subset selection and relevance. Our wrapper method searches for an optimal feature subset tailored to a particular algorithm and a domain. We study the strengths and weaknesses of the wrapper approach and show a series of improved designs. We compare the wrapper approach to induction without feature subset selection and to Relief, a filter approach to feature subset selection. Significant improvement in accuracy is achieved for some datasets for the two families of induction algorithms used: decision trees and Naive-Bayes.
---
paper_title: Feature Extraction, Foundations and Applications

paper_content:

An Introduction to Feature Extraction.- An Introduction to Feature Extraction.- Feature Extraction Fundamentals.- Learning Machines.- Assessment Methods.- Filter Methods.- Search Strategies.- Embedded Methods.- Information-Theoretic Methods.- Ensemble Learning.- Fuzzy Neural Networks.- Feature Selection Challenge.- Design and Analysis of the NIPS2003 Challenge.- High Dimensional Classification with Bayesian Neural Networks and Dirichlet Diffusion Trees.- Ensembles of Regularized Least Squares Classifiers for High-Dimensional Problems.- Combining SVMs with Various Feature Selection Strategies.- Feature Selection with Transductive Support Vector Machines.- Variable Selection using Correlation and Single Variable Classifier Methods: Applications.- Tree-Based Ensembles with Dynamic Soft Feature Selection.- Sparse, Flexible and Efficient Modeling using L 1 Regularization.- Margin Based Feature Selection and Infogain with Standard Classifiers.- Bayesian Support Vector Machines for Feature Ranking and Selection.- Nonlinear Feature Selection with the Potential Support Vector Machine.- Combining a Filter Method with SVMs.- Feature Selection via Sensitivity Analysis with Direct Kernel PLS.- Information Gain, Correlation and Support Vector Machines.- Mining for Complex Models Comprising Feature Selection and Classification.- Combining Information-Based Supervised and Unsupervised Feature Selection.- An Enhanced Selective Naive Bayes Method with Optimal Discretization.- An Input Variable Importance Definition based on Empirical Data Probability Distribution.- New Perspectives in Feature Extraction.- Spectral Dimensionality Reduction.- Constructing Orthogonal Latent Features for Arbitrary Loss.- Large Margin Principles for Feature Selection.- Feature Extraction for Classification of Proteomic Mass Spectra: A Comparative Study.- Sequence Motifs: Highly Predictive Features of Protein Function.
---
paper_title: To reject or not to reject: that is the question-an answer in case of neural classifiers

paper_content:

A method defining a reject option that is applicable to a given 0-reject classifier is proposed. The reject option is based on an estimate of the classification reliability, measured by a reliability evaluator /spl Psi/. Trivially, once a reject threshold /spl sigma/ has been fixed, a sample is rejected if the corresponding value of /spl Psi/ is below /spl sigma/. Obviously, as /spl sigma/ represents the least tolerable classification reliability level, when its value varies the reject option becomes more or less severe. In order to adapt the behavior of the reject option to the requirements of the considered application domain, a function P characterizing the reject option's adequacy to the domain has been introduced. It is shown that P can be expressed as a function of /spl sigma/ and, consequently, the optimal value for /spl sigma/ is defined as the one which maximizes the function P. The method for determining the optimal threshold value is independent of the specific 0-reject classifier, while the definition of the reliability evaluators is related to the classifier's architecture. General criteria for defining appropriate reliability evaluators within a classification paradigm are illustrated in the paper and are based on the localization, in the feature space, of the samples that could be classified with a low reliability. The definition of the reliability evaluators for three popular architectures of neural networks (backpropagation, learning vector quantization and probabilistic network) is presented. Finally, the method has been tested with reference to a complex classification problem with data generated according to a distribution-of-distributions model.
---
paper_title: Decision tree based light weight intrusion detection using a wrapper approach

paper_content:

The objective of this paper is to construct a lightweight Intrusion Detection System (IDS) aimed at detecting anomalies in networks. The crucial part of building lightweight IDS depends on preprocessing of network data, identifying important features and in the design of efficient learning algorithm that classify normal and anomalous patterns. Therefore in this work, the design of IDS is investigated from these three perspectives. The goals of this paper are (i) removing redundant instances that causes the learning algorithm to be unbiased (ii) identifying suitable subset of features by employing a wrapper based feature selection algorithm (iii) realizing proposed IDS with neurotree to achieve better detection accuracy. The lightweight IDS has been developed by using a wrapper based feature selection algorithm that maximizes the specificity and sensitivity of the IDS as well as by employing a neural ensemble decision tree iterative procedure to evolve optimal features. An extensive experimental evaluation of the proposed approach with a family of six decision tree classifiers namely Decision Stump, C4.5, Naive Baye's Tree, Random Forest, Random Tree and Representative Tree model to perform the detection of anomalous network pattern has been introduced.
---
paper_title: An Adaptive Hybrid Architecture for Intrusion Detection Based on Fuzzy Clustering and RBF Neural Networks

paper_content:

Automatic detection of network intrusion is a challenging task because of increasing types of attacks. Many of the existing approaches either are rigid, inflexible designs tailored to a specific situation or require manual setting of design parameters such as the initial number of clusters. In this paper we allow the design parameters to be determined dynamically by adopting a layered hybrid architecture, hence resolving the aforementioned shortcomings. The first layer uses FCM and GK fuzzy clustering to extract the features and the second layer uses a set of RBF neural networks to perform the classification. The flexible design parameters are initial number of clusters, number of RBF networks and number of neurons inside each network which are determined with minimal input from the user. The simulation result shows high detection rates as well as fewer false positives compared to earlier approaches.
---
paper_title: Intrusion Detection Method Based on Fuzzy Hidden Markov Model

paper_content:

Because of the excellent performance of the HMM (Hidden Markov Model), it has been widely used in pattern recognition. Due to the high false alarm rate in the classical intrusion detection system(IDS) based on HMM, a fuzzy approach for the HMM, called Fuzzy Hidden Markov Models (FHMM) is proposed. it is introduced with the Fuzzy logic to the HMM. The robustness and accurate rate of the IDS based on FHMM model are greatly improved. So a new intrusion detection method based on FHMM was proposed in this paper. The experiment results with 1998 DARPA data set shows that our method is efficiently to classify the anomaly profile from the normal profile, and has low false positive rate with high detection rate. Moreover?the training time is reduced, the detection speed is effectively increased and computer resources are saved.
---
paper_title: Intrusion Detection Model Based on Hierarchical Fuzzy Inference System

paper_content:

With the growing rate of network attacks, intelligent methods for detecting new attacks have attracted increasing interest. This paper presents an approach incorporating several soft computing techniques to construct a Hierarchical Neuro-Fuzzy Inference intrusion detection system which can implement either misuse or anomaly detection. In the proposed system principal component analysis neural network is used to reduce the dimensions of the feature space. And the preprocessed data is clustered by applying an enhanced Fuzzy C-Means clustering algorithm to extract and manage fuzzy rules. The system developments two level Neuro-Fuzzy inference system. Genetic algorithm is used to optimize the structure of the system. Finally a publicly available DRAPA/KDD99 dataset is used to demonstrate the approaches and the results show their accuracy.
---
paper_title: Intrusion Detection Based on Fuzzy Support Vector Machines

paper_content:

A great deal of noise data in the Network connectivity information affect badly to build SVM optimal classification hyperplane and lead to higher classification error rate. In this paper, fuzzy membership function is applied into v-SVM; it acquires different values for each input data that accord to different effects on the classification result. Therefore different input samples points can make different contributions to the learning of the decision surface—the optimal separating hyperplane. Then the model of Intrusion Detection System based on SVM is presented, and detailedly illustrated the performance of this model. Finally, comparison of detection ability between v-SVM and v-FSVM is given. It is found that v-FSVM effectively reduce the impact of the noise data and improve the accuracy of decision-making.
---
paper_title: Fuzzy Multi-Class Support Vector Machines for cooperative network intrusion detection

paper_content:

A large number of noise data always exits when obtaining information through Internet, which deteriorates intrusion detection performance. In order to avoid the affection of noise data, data preprocessing needs to be done before the construction of hyperplane in Support Vector Machine (SVM). By importing fuzzy theory into SVM, a new method is proposed for cooperative network intrusion detection. Due to the various attack methods in different network protocol, a fuzzy membership function is formatted under each protocol, which means a unique Multi-Class SVM is suitable for only one network protocol. To implement this approach, a fuzzy Multi-Class-SVM-based cooperative network intrusion detection model with multi-agent architecture is presented in this paper, which is composed of three types of agents corresponding to TCP, UDP, and ICMP protocols, respectively and a statistic-based agent. Moreover, simulation experiments are performed by using KDD CUP 1999 data set while it is shown in the results that the training time can be significantly shortened, storage space requirement can be sharply reduced, and classification accuracy is improved apparently by using the SVM method preprocessing the data.
---
paper_title: A detailed analysis of the KDD CUP 99 data set

paper_content:

During the last decade, anomaly detection has attracted the attention of many researchers to overcome the weakness of signature-based IDSs in detecting novel attacks, and KDDCUP'99 is the mostly widely used data set for the evaluation of these systems. Having conducted a statistical analysis on this data set, we found two important issues which highly affects the performance of evaluated systems, and results in a very poor evaluation of anomaly detection approaches. To solve these issues, we have proposed a new data set, NSL-KDD, which consists of selected records of the complete KDD data set and does not suffer from any of mentioned shortcomings.
---
paper_title: Cost-based modeling for fraud and intrusion detection: results from the JAM project

paper_content:

We describe the results achieved using the JAM distributed data mining system for the real world problem of fraud detection in financial information systems. For this domain we provide clear evidence that state-of-the-art commercial fraud detection systems can be substantially improved in stopping losses due to fraud by combining multiple models of fraudulent transaction shared among banks. We demonstrate that the traditional statistical metrics used to train and evaluate the performance of learning systems (ie. statistical accuracy or ROC analysis) are misleading and perhaps inappropriate for this application. Cost-based metrics are more relevant in certain domains, and defining such metrics poses significant and interesting research questions both in evaluating systems and alternative models, and in formalizing the problems to which one may wish to apply data mining technologies. This paper also demonstrates how the techniques developed for fraud detection can be generalized and applied to the important area of intrusion detection in networked information systems. We report the outcome of recent evaluations of our system applied to tcpdump network intrusion data specifically with respect to statistical accuracy. This work involved building additional components of JAM that we have come to call, MADAM ID (Mining Audit Data for Automated Models for Intrusion Detection). However, taking the next step to define cost-based models for intrusion detection poses interesting new research questions. We describe our initial ideas about how to evaluate intrusion detection systems using cost models learned during our work on fraud detection.
---
paper_title: Evaluating intrusion detection systems: the 1998 DARPA off-line intrusion detection evaluation

paper_content:

An intrusion detection evaluation test bed was developed which generated normal traffic similar to that on a government site containing 100's of users on 1000's of hosts. More than 300 instances of 38 different automated attacks were launched against victim UNIX hosts in seven weeks of training data and two weeks of test data. Six research groups participated in a blind evaluation and results were analyzed for probe, denial-of-service (DoS) remote-to-local (R2L), and user to root (U2R) attacks. The best systems detected old attacks included in the training data, at moderate detection rates ranging from 63% to 93% at a false alarm rate of 10 false alarms per day. Detection rates were much worse for new and novel R2L and DoS attacks included only in the test data. The best systems failed to detect roughly half these new attacks which included damaging access to root-level privileges by remote users. These results suggest that further research should focus on developing techniques to find new attacks instead of extending existing rule-based approaches.
---
paper_title: Decentralized intrusion detection for secure cooperative multi-agent systems

paper_content:

In this paper we address the problem of detecting faulty behaviors of cooperative mobile agents. A novel decentralized and scalable architecture that can be adopted to realize a monitor of the agents' behavior is proposed. We consider agents which may perform different independent tasks, but cooperate to guarantee the entire system's safety. Agents plan their next actions by following a set of rules which is shared among them. Such rules are decentralized, i.e. they dictate actions that depend only on configurations of neighboring agents. Some agents may not be acting according to this cooperation protocol, due to tampering or spontaneous failure. To detect such misbehaviors we propose a solution where each agent runs a local monitor using only locally available information. The objective of the work is the definition of a basic framework to automatically realize decentralized intrusion detectors for (hybrid) multi-agent systems where interaction is modeled through logical cooperative protocols.
---
paper_title: MULTI-AGENT SYSTEM FOR WORM DETECTION AND CONTAINMENT IN METROPOLITAN AREA NETWORKS

paper_content:

Active worms can cause widespread damages at so high a speed that effectively precludes human-directed reaction, and patches for the worms are always available after the damages have been caused, which has elevated them self to a first-class security threat to Metropolitan Area Networks (MAN). Multi-agent system for Worm Detection and Containment in MAN (MWDCM) is presented to provide a first-class automatic reaction mechanism that automatically applies containment strategies to block the propagation of the worms and to protect MAN against worm scan that wastes a lot of network bandwidth and crashes the routers. Its user agent is used to detect the known worms. Worm detection agent and worm detection correlation agent use two-stage based decision method to detect unknown worms. They adaptively study the accessing in the whole network and dynamically change the working parameters to detect the unknown worms. MWDCM confines worm infection within a macro-cell or a micro-cell of the metropolitan area networks, the rest of the accesses and hosts continue functioning without disruption. MWDCM integrates Worm Detection System (WDS) and network management system. Reaction measures can be taken by using Simple Network Management Protocol (SNMP) interface to control broadband access server as soon as the WDS detect the active worm. MWDCM is very effective in blocking random scanning worms. Simulation results indicate that high worm infection rate of epidemics can be avoided to a degree by MWDCM blocking the propagation of the worms.
---
paper_title: Security Schemes for a Mobile Agent Based Network and System Management Framework

paper_content:

In previous research work, we proposed an integrated framework to guide the design of a Mobile Agent based Network Management (MANM) system, namely the Mobile Agent based framework for Security enhanced Autonomous network and system Management (MASAM). This framework offered two distinct advantages: (1) the provision of a secure agent-based management infrastructure and (2) the capability of achieving enhanced network management functionalities. In this paper, we propose two novel security schemes, namely the Visibility Domain Protection Scheme (VDPS) and the Visa Based Authentication Scheme (VBAS), for protection of management information and authentication and resource access control of management agents, respectively. These schemes seamlessly fit into the modular MASAM framework and facilitate two major security components defined in its abstract architecture. The efficiency of the two security schemes, focusing on the aspects of security and performance, is demonstrated and evaluation results are compared with the SNMPv3 standard.
---
paper_title: Towards the automatic generation of mobile agents for distributed intrusion detection system

paper_content:

The Mobile Agent Intrusion Detection System (MAIDS) is an agent based distributed Intrusion Detection System (IDS). A disciplined requirement engineering process is developed to build MAIDS. The starting point is a high level description of intrusions expressed as Software Fault Trees (SFTs). Then the SFTs are translated to Colored Petri Nets (CPNs) that specify the IDS design. Subsequently, the CPNs are implemented as software intrusion detection agents in the MAIDS agent system. By using SFT and CPN as the theoretical underpinnings, the design and implementation of MAIDS can be verified and the design and implementation errors can be substantially reduced. This paper presents a tool that automatically translates CPNs that specify IDS design into software intrusion detection agents in MAIDS. Together with the translator we have developed to convert SFTs that model intrusions into the CPN for IDS design, this tool can automatically generate intrusion detection software agents from a high level description of intrusions.
---
paper_title: A denial-of-service resistant intrusion detection architecture

paper_content:

Abstract As the capabilities of intrusion detection systems (IDSs) advance, attackers may disable organizations’ IDSs before attempting to penetrate more valuable targets. To counter this threat, we present an IDS architecture that is resistant to denial-of-service (DOS) attacks. The architecture frustrates attackers by making IDS components invisible to attackers’ normal means of “seeing” in a network. Upon a successful attack, the architecture allows IDS components to relocate from attacked hosts to operational hosts thereby mitigating the attack. These capabilities are obtained by using mobile agent technology, utilizing network topology features, and by restricting the communication allowed between different types of IDS components.
---
paper_title: A Distributed Intrusion Detection Model Based on a Society of Intelligent Mobile Agents for Ad Hoc Network

paper_content:

The evolution of wireless network technologies and the recent advances in mobile computing hardware have made possible the introduction of various applications in mobile adhoc networks. Not only is the infrastructure of these networks inherently vulnerable but they have increased requirements regarding their security as well. As intrusion prevention mechanisms, such as encryption and authentication, are not sufficient regarding security, we need a second line of defence, Intrusion Detection. The focus of this paper is on distributed and intelligent intrusion detection. We propose a model for building a distributed and behavioural intrusion detection system by using a classification method.
---
paper_title: Security Schemes for a Mobile Agent Based Network and System Management Framework

paper_content:

In previous research work, we proposed an integrated framework to guide the design of a Mobile Agent based Network Management (MANM) system, namely the Mobile Agent based framework for Security enhanced Autonomous network and system Management (MASAM). This framework offered two distinct advantages: (1) the provision of a secure agent-based management infrastructure and (2) the capability of achieving enhanced network management functionalities. In this paper, we propose two novel security schemes, namely the Visibility Domain Protection Scheme (VDPS) and the Visa Based Authentication Scheme (VBAS), for protection of management information and authentication and resource access control of management agents, respectively. These schemes seamlessly fit into the modular MASAM framework and facilitate two major security components defined in its abstract architecture. The efficiency of the two security schemes, focusing on the aspects of security and performance, is demonstrated and evaluation results are compared with the SNMPv3 standard.
---
paper_title: A denial-of-service resistant intrusion detection architecture

paper_content:

Abstract As the capabilities of intrusion detection systems (IDSs) advance, attackers may disable organizations’ IDSs before attempting to penetrate more valuable targets. To counter this threat, we present an IDS architecture that is resistant to denial-of-service (DOS) attacks. The architecture frustrates attackers by making IDS components invisible to attackers’ normal means of “seeing” in a network. Upon a successful attack, the architecture allows IDS components to relocate from attacked hosts to operational hosts thereby mitigating the attack. These capabilities are obtained by using mobile agent technology, utilizing network topology features, and by restricting the communication allowed between different types of IDS components.
---
paper_title: Feature selection with neural networks

paper_content:

We present a neural network based approach for identifying salient features for classification in feedforward neural networks. Our approach involves neural network training with an augmented cross-entropy error function. The augmented error function forces the neural network to keep low derivatives of the transfer functions of neurons when learning a classification task. Such an approach reduces output sensitivity to the input changes. Feature selection is based on the reaction of the cross-validation data set classification error due to the removal of the individual features. We demonstrate the usefulness of the proposed approach on one artificial and three real-world classification problems. We compared the approach with five other feature selection methods, each of which banks on a different concept. The algorithm developed outperformed the other methods by achieving higher classification accuracy on all the problems tested.
---
paper_title: Multi-agent intrusion detection system in industrial network using ant colony clustering approach and unsupervised feature extraction

paper_content:

Industrial control systems have been globally connected to the open computer networks for decentralized management and control purposes. Most of these networked control systems that are not designed with security protection can be vulnerable to network attacks nowadays, so there is a growing demand of efficient and scalable intrusion detection systems (IDS) in the network infrastructure of industrial plants. In this paper, we present a multi-agent IDS architecture that is designed for decentralized intrusion detection and prevention control in large switched networks. An efficient and biologically inspired learning model is proposed for anomaly intrusion detection in the multi-agent IDS. The proposed model called ant colony clustering model (ACCM) improves the existing ant-based clustering approach in searching for near-optimal clustering heuristically, in which meta-heuristics engages the optimization principles in swarm intelligence. In order to alleviate the curse of dimensionality, four unsupervised feature extraction algorithms are applied and evaluated on their effectiveness to enhance the clustering solution. The experimental results on KDD-Cup99 IDS benchmark data demonstrate that applying ACCM with one of the feature extraction algorithms is effective to detect known or unseen intrusion attacks with high detection rate and recognize normal network traffic with low false positive rate
---
paper_title: Feature selection with neural networks

paper_content:

We present a neural network based approach for identifying salient features for classification in feedforward neural networks. Our approach involves neural network training with an augmented cross-entropy error function. The augmented error function forces the neural network to keep low derivatives of the transfer functions of neurons when learning a classification task. Such an approach reduces output sensitivity to the input changes. Feature selection is based on the reaction of the cross-validation data set classification error due to the removal of the individual features. We demonstrate the usefulness of the proposed approach on one artificial and three real-world classification problems. We compared the approach with five other feature selection methods, each of which banks on a different concept. The algorithm developed outperformed the other methods by achieving higher classification accuracy on all the problems tested.
---
paper_title: A new wrapper feature selection approach using neural network

paper_content:

This paper presents a new feature selection (FS) algorithm based on the wrapper approach using neural networks (NNs). The vital aspect of this algorithm is the automatic determination of NN architectures during the FS process. Our algorithm uses a constructive approach involving correlation information in selecting features and determining NN architectures. We call this algorithm as constructive approach for FS (CAFS). The aim of using correlation information in CAFS is to encourage the search strategy for selecting less correlated (distinct) features if they enhance accuracy of NNs. Such an encouragement will reduce redundancy of information resulting in compact NN architectures. We evaluate the performance of CAFS on eight benchmark classification problems. The experimental results show the essence of CAFS in selecting features with compact NN architectures.
---
paper_title: A Classifier Ensemble Approach to Intrusion Detection for Network-Initiated Attacks

paper_content:

We present a classifier ensemble system using a combination of Neural Networks and rule-based systems as base classifiers that is capable of detecting network-initiated intrusion attacks on web servers. The system can recognize novel attacks (i.e., attacks it has never seen before) and categorize them as such. The performance of the Neural Network in detecting attacks from network data alone is very good with success rates of more than 78% in recognizing new attacks but suffers from high false alarms rates. An ensemble combining the original ANN with a second component that monitors the server's system calls for detecting unusual activity results in high prediction accuracy with very small false alarm rates. We experiment with a variety of ensemble classifiers and decision making schemes for final classification. We report on the results we got from our approach and future directions for this research
---
paper_title: Network Intrusion Detection System Using Neural Networks

paper_content:

This paper presents a neural network-based intrusion detection method for the internet-based attacks on a computer network. Intrusion detection systems (IDS) have been created to predict and thwart current and future attacks. Neural networks are used to identify and predict unusual activities in the system. In particular, feedforward neural networks with the back propagation training algorithm were employed in this study. Training and testing data were obtained from the Defense Advanced Research Projects Agency (DARPA) intrusion detection evaluation data sets. The experimental results on real-data showed promising results on detection intrusion systems using neural networks.
---
paper_title: Hierarchical Kohonenen net for anomaly detection in network security

paper_content:

A novel multilevel hierarchical Kohonen Net (K-Map) for an intrusion detection system is presented. Each level of the hierarchical map is modeled as a simple winner-take-all K-Map. One significant advantage of this multilevel hierarchical K-Map is its computational efficiency. Unlike other statistical anomaly detection methods such as nearest neighbor approach, K-means clustering or probabilistic analysis that employ distance computation in the feature space to identify the outliers, our approach does not involve costly point-to-point computation in organizing the data into clusters. Another advantage is the reduced network size. We use the classification capability of the K-Map on selected dimensions of data set in detecting anomalies. Randomly selected subsets that contain both attacks and normal records from the KDD Cup 1999 benchmark data are used to train the hierarchical net. We use a confidence measure to label the clusters. Then we use the test set from the same KDD Cup 1999 benchmark to test the hierarchical net. We show that a hierarchical K-Map in which each layer operates on a small subset of the feature space is superior to a single-layer K-Map operating on the whole feature space in detecting a variety of attacks in terms of detection rate as well as false positive rate.
---
paper_title: Improvement in Intrusion Detection With Advances in Sensor Fusion

paper_content:

Various intrusion detection systems (IDSs) reported in the literature have shown distinct preferences for detecting a certain class of attack with improved accuracy, while performing moderately on the other classes. In view of the enormous computing power available in the present-day processors, deploying multiple IDSs in the same network to obtain best-of-breed solutions has been attempted earlier. The paper presented here addresses the problem of optimizing the performance of IDSs using sensor fusion with multiple sensors. The trade-off between the detection rate and false alarms with multiple sensors is highlighted. It is illustrated that the performance of the detector is better when the fusion threshold is determined according to the Chebyshev inequality. In the proposed data-dependent decision (DD) fusion method, the performance optimization of individual IDSs is first addressed. A neural network supervised learner has been designed to determine the weights of individual IDSs depending on their reliability in detecting a certain attack. The final stage of this DD fusion architecture is a sensor fusion unit which does the weighted aggregation in order to make an appropriate decision. This paper theoretically models the fusion of IDSs for the purpose of demonstrating the improvement in performance, supplemented with the empirical evaluation.
---
paper_title: RT-UNNID: A practical solution to real-time network-based intrusion detection using unsupervised neural networks

paper_content:

With the growing rate of network attacks, intelligent methods for detecting new attacks have attracted increasing interest. The RT-UNNID system, introduced in this paper, is one such system, capable of intelligent real-time intrusion detection using unsupervised neural networks. Unsupervised neural nets can improve their analysis of new data over time without retraining. In previous work, we evaluated Adaptive Resonance Theory (ART) and Self-Organizing Map (SOM) neural networks using offline data. In this paper, we present a real-time solution using unsupervised neural nets to detect known and new attacks in network traffic. We evaluated our approach using 27 types of attack, and observed 97% precision using ART nets, and 95% precision using SOM nets.
---
paper_title: The neural network models for IDS based on the asymmetric costs of false negative errors and false positive errors

paper_content:

Abstract This paper investigates the asymmetric costs of false positive and negative errors to enhance the IDS performance. The proposed method utilizes the neural network model to consider the cost ratio of false negative errors to false positive errors. Compared with false positive errors, false negative errors incur a greater loss to organizations which are connected to the systems by networks. This method is designed to accomplish both security and system performance objectives. The results of our empirical experiment show that the neural network model provides high accuracy in intrusion detection. In addition, the simulation results show that the effectiveness of intrusion detection can be enhanced by considering the asymmetric costs of false negative and false positive errors.
---
paper_title: ANNIDS: intrusion detection system based on artificial neural network

paper_content:

This paper describes a network intrusion detection system based on artificial neural network (ANNIDS). The advantage of neural network ensures that ANNIDS does not need expert knowledge and it can find unknown or novel intrusions. The key part of ANNIDS is an adaptive resonance theory neural network (ART). ANNIDS can be trained in real-time and in an unsupervised way. A weight hamming distance method is used in detection, which is simple and correct in finding anomalous behavior. A well-trained ANNIDS can monitor the network in real time. The experimental results show that ANNIDS performs best when vigilance parameter is 0.4 to 0.5 and intrusion threshold is 0.4. The false positive error is about 8%, the negative error is about 2%, and the total error is lower 10%.
---
paper_title: Decision tree classifier for network intrusion detection with GA-based feature selection

paper_content:

Machine Learning techniques such as Genetic Algorithms and Decision Trees have been applied to the field of intrusion detection for more than a decade. Machine Learning techniques can learn normal and anomalous patterns from training data and generate classifiers that then are used to detect attacks on computer systems. In general, the input data to classifiers is in a high dimension feature space, but not all of features are relevant to the classes to be classified. In this paper, we use a genetic algorithm to select a subset of input features for decision tree classifiers, with a goal of increasing the detection rate and decreasing the false alarm rate in network intrusion detection. We used the KDDCUP 99 data set to train and test the decision tree classifiers. The experiments show that the resulting decision trees can have better performance than those built with all available features.
---
paper_title: Scaling Genetic Programming to Large Datasets Using Hierarchical Dynamic Subset Selection

paper_content:

The computational overhead of genetic programming (GP) may be directly addressed without recourse to hardware solutions using active learning algorithms based on the random or dynamic subset selection heuristics (RSS or DSS). This correspondence begins by presenting a family of hierarchical DSS algorithms: RSS-DSS, cascaded RSS-DSS, and the balanced block DSS algorithm, where the latter has not been previously introduced. Extensive benchmarking over four unbalanced real-world binary classification problems with 30000-500000 training exemplars demonstrates that both the cascade and balanced block algorithms are able to reduce the likelihood of degenerates while providing a significant improvement in classification accuracy relative to the original RSS-DSS algorithm. Moreover, comparison with GP trained without an active learning algorithm indicates that classification performance is not compromised, while training is completed in minutes as opposed to half a day.
---
paper_title: Decision tree based light weight intrusion detection using a wrapper approach

paper_content:

The objective of this paper is to construct a lightweight Intrusion Detection System (IDS) aimed at detecting anomalies in networks. The crucial part of building lightweight IDS depends on preprocessing of network data, identifying important features and in the design of efficient learning algorithm that classify normal and anomalous patterns. Therefore in this work, the design of IDS is investigated from these three perspectives. The goals of this paper are (i) removing redundant instances that causes the learning algorithm to be unbiased (ii) identifying suitable subset of features by employing a wrapper based feature selection algorithm (iii) realizing proposed IDS with neurotree to achieve better detection accuracy. The lightweight IDS has been developed by using a wrapper based feature selection algorithm that maximizes the specificity and sensitivity of the IDS as well as by employing a neural ensemble decision tree iterative procedure to evolve optimal features. An extensive experimental evaluation of the proposed approach with a family of six decision tree classifiers namely Decision Stump, C4.5, Naive Baye's Tree, Random Forest, Random Tree and Representative Tree model to perform the detection of anomalous network pattern has been introduced.
---
paper_title: Research on Neuro-fuzzy Inference System in Hierarchical Intrusion Detection

paper_content:

Intrusion detection technique has become increasingly important in the area of network security research. It is innovative that various soft computing approaches have been applied to the intrusion detection field. This paper presents an intelligent intrusion detection system which incorporates several soft computing techniques to implement either misuse or anomaly detection. Genetic algorithm is used to optimize the structure of the system. In the proposed system principal component analysis neural network is used to reduce the dimensions of the feature space. An enhanced Fuzzy C-Means clustering algorithm is used to cluster the preprocessed data to obtain fuzzy rules. And a Hierarchical Neuro-Fuzzy classifier is developmented. The experiments and evaluations of the proposed method were performed with the KDD Cup 99 intrusion detection dataset. Results indicate the high detection accuracy for intrusion attacks and low false alarm rate of the reliable system.
---
paper_title: An Efficient Intrusion Detection Approach Based on Hidden Markov Model and Rough Set

paper_content:

Intrusion detection system has become the research hotspot because it can provide dynamic protection for computer system. Aiming at the problems existed in actual methods or models of intrusion detection, an effective method for intrusion detection based on hidden markov model and rough sets theory was presented in this paper. The circular sequences of system call sequences generated during the normal execution of a process is replaced by circular body, then, a little data is extracted from normal system call sequences, and is transformed to decisive table, afterward, the decisive table is reduced and the simplest rules that present normal behavior mode is extracted by rough sets theory. These rules can be used to detect anomalous behavior. In order to realize the quick detection of known intrusion, an engine of quick detection inspired by hidden markov model was presented in this paper. Compared with other methods in the literature, the method presented in this paper is not only able to extract a set of effective detection rules with the minimum size from part of records of system call sequences, but also can detect the known intrusion quickly. Experiments show that this method in this paper is better than other methods.
---
paper_title: An Efficient Intrusion Detection Approach Based on Hidden Markov Model and Rough Set

paper_content:

Intrusion detection system has become the research hotspot because it can provide dynamic protection for computer system. Aiming at the problems existed in actual methods or models of intrusion detection, an effective method for intrusion detection based on hidden markov model and rough sets theory was presented in this paper. The circular sequences of system call sequences generated during the normal execution of a process is replaced by circular body, then, a little data is extracted from normal system call sequences, and is transformed to decisive table, afterward, the decisive table is reduced and the simplest rules that present normal behavior mode is extracted by rough sets theory. These rules can be used to detect anomalous behavior. In order to realize the quick detection of known intrusion, an engine of quick detection inspired by hidden markov model was presented in this paper. Compared with other methods in the literature, the method presented in this paper is not only able to extract a set of effective detection rules with the minimum size from part of records of system call sequences, but also can detect the known intrusion quickly. Experiments show that this method in this paper is better than other methods.
---
paper_title: Feature selection based on Rough set and modified genetic algorithm for intrusion detection

paper_content:

In the Network Intrusion Detection, the large number of features increases the time and space cost, besides the irrelative redundant characteristics make the detection accuracy dropped. In order to improve detection accuracy and efficiency, a new Feature Selection method based on Rough Sets and improved Genetic Algorithms is proposed for Network Intrusion Detection. Firstly, the features are filtered by virtue of the Rough Sets theory; then in the remaining feature subset, the Optimal subset will be found out through the Genetic Algorithm improved with Population Clustering approach for the best ultimate optimized results. Finally, the effectiveness of the algorithm is tested on the classical KDD CUP 99 data sets, using the SVM classifier for performance evaluation. The experiment shows that the new method improves the accuracy and efficiency in Network Intrusion Detection compared with the related researches of the intrusion detection system.
---
paper_title: A Bee Swarm Genetic Algorithm for the Optimization of DNA Encoding

paper_content:

Bee Swarm Genetic Algorithm (BSGA), a new efficient algorithm is developed for designing DNA sequences that satisfy some combinatorial and thermodynamic constraints. In BSGA, the optimum individual of population selected as a queen bee and a random population is introduced to reinforce the exploitation of Genetic Algorithm (GA) and increase the diversity of population. Based on the algorithm, a computer simulation for DNA encoding is conducted and the sequences are better than the previous known systems that can prove the efficiency and convergence of our algorithm.
---
paper_title: Systems Biology of Group Decision Making

paper_content:

Systems biology of decision making focuses on understanding the structures, dynamics, and evolution of complex interconnected biological mechanisms that support decision making by individuals and social animal groups. In this article, an experimentally validated mathematical model of the nest-site selection process of honey bee swarms is introduced. In this spatially distributed dynamical feedback process individual bee actions and bee-to-bee communications combine to produce an emergent "consensus" nest choice. The process has connections to neurobiological cognition systems, especially at the behavioral level: the swarm can effectively discriminate between different quality nest sites and eliminate from consideration relatively inferior distractor sites. Simulations indicate that individual-level bee decision-making mechanisms have been tuned by natural selection to provide a balance between the need for fast and accurate decisions at the group level. Theoretical analyses of the properties of the dynamics of swarm decision making are outlined, and potential implications in engineering are briefly highlighted
---
paper_title: A novel class of multi-agent algorithms for highly dynamic transport planning inspired by honey bee behavior

paper_content:

Commercial transport planning as well as individual intra-city or inter-city traffic in densely populated regions, both in Europe and the US, increasingly suffer from congestion problems, to an extent which e.g. affects predictable transport planning substantially (except - so far - for overnight tours). Due to the highly dynamic character of congestion forming and dissolving, no static approach like shortest path finding, applied globally or individually in car navigators, is adequate here: Its use even makes things worse as can be frequently observed. In this paper we present a completely decentralized multi-agent approach (termed BeeJamA) on multiple layers where car or truck routing are handled through algorithms adapted from the BeeHive algorithms which in turn have been derived from honey bee behavior. We report on extensive distributed simulation experiments in the BeeJamA project which demonstrate a very substantial improvement over traditional congestion handling.
---
paper_title: SWAN: A Swarm Intelligence Based Framework for Network Management of IP Networks

paper_content:

This research paper presents a swarm-intelligence based architecture for network management of IP networks which attempts to alleviate the shortcomings of traditional network management software like scalability, performance, accuracy, single point-of-failure and extensibility. The proposed architecture draws inspiration from the management of beehives by worker bees and the queen bee in the animal kingdom, utilizing and extending that model to perform network management in a more effective and efficient manner.
---
paper_title: Intrusion detection based on ant colony algorithm of fuzzy clustering

paper_content:

An intrusion detection method based on ant colony fuzzy clustering was proposed, The algorithm uses ant colony algorithm is a strong ability to deal with local minima, it better than random selected cluster centers cause iterative process into a local optimal solution, dynamically determine the number and center of clusters.
---
paper_title: Ant colony optimization based network intrusion feature selection and detection

paper_content:

This paper proposes a novel intrusion detection approach by applying ant colony optimization for feature selection and SVM for detection. The intrusion features are represented as graph-ere nodes, with the edges between them denoting the adding of the next feature. Ants traverse through the graph to add nodes until the stopping criterion is satisfied. The fisher discrimination rate is adopted as the heuristic information for ants' traversal. In order to avoid training of a large number of SVM classifier, the least square based SVM estimation is adopted. Initially, the SVM is trained based on grid search method to obtain discrimination function using the training data based on all features available. Then the feature subset produced during the ACO search process is evaluated based on their abilities to reconstruct the reference discriminative function using linear least square estimation. Finally SVM is retrained using the train data based on the obtained optimal feature subset to obtain intrusion detection model. The MIT's KDD Cup 99 dataset is used to evaluate our present method, the results clearly demonstrate that the method can be an effective way for intrusion feature selection and detection.
---
paper_title: Anomaly detection combining one-class SVMs and particle swarm optimization algorithms

paper_content:

Anomalies are patterns in data that do not conform to a well-defined notion of normal behavior. One-class Support Vector Machines calculate a hyperplane in the feature space to distinguish anomalies, but the false positive rate is always high and parameter selection is a key issue. So, we propose a novel one-class framework for detecting anomalies, which takes the advantages of both boundary movement strategy and the effectiveness of evaluation algorithm on parameters optimization. First, we search the parameters by using a particle swarm optimization algorithm. Each particle suggests a group of parameters, the area under receiver operating characteristic curve is chosen as the fitness of the object function. Second, we improve the original decision function with a boundary movement. After the threshold has been adjusted, the final detection function will bring about a high detection rate with a lower false positive rate. Experimental results on UCI data sets show that the proposed method can achieve better performance than other one class learning schemes.
---
paper_title: An efficient intrusion detection system based on support vector machines and gradually feature removal method

paper_content:

The efficiency of the intrusion detection is mainly depended on the dimension of data features. By using the gradually feature removal method, 19 critical features are chosen to represent for the various network visit. With the combination of clustering method, ant colony algorithm and support vector machine (SVM), an efficient and reliable classifier is developed to judge a network visit to be normal or not. Moreover, the accuracy achieves 98.6249% in 10-fold cross validation and the average Matthews correlation coefficient (MCC) achieves 0.861161.
---
paper_title: Using mutual information for selecting features in supervised neural net learning

paper_content:

This paper investigates the application of the mutual information criterion to evaluate a set of candidate features and to select an informative subset to be used as input data for a neural network classifier. Because the mutual information measures arbitrary dependencies between random variables, it is suitable for assessing the "information content" of features in complex classification tasks, where methods bases on linear relations (like the correlation) are prone to mistakes. The fact that the mutual information is independent of the coordinates chosen permits a robust estimation. Nonetheless, the use of the mutual information for tasks characterized by high input dimensionality requires suitable approximations because of the prohibitive demands on computation and samples. An algorithm is proposed that is based on a "greedy" selection of the features and that takes both the mutual information with respect to the output class and with respect to the already-selected features into account. Finally the results of a series of experiments are discussed. >
---
paper_title: Mutual information-based feature selection for intrusion detection systems

paper_content:

As the network-based technologies become omnipresent, threat detection and prevention for these systems become increasingly important. One of the effective ways to achieve higher security is to use intrusion detection systems, which are software tools used to detect abnormal activities in the computer or network. One technical challenge in intrusion detection systems is the curse of high dimensionality. To overcome this problem, we propose a feature selection phase, which can be generally implemented in any intrusion detection system. In this work, we propose two feature selection algorithms and study the performance of using these algorithms compared to a mutual information-based feature selection method. These feature selection algorithms require the use of a feature goodness measure. We investigate using both a linear and a non-linear measure-linear correlation coefficient and mutual information, for the feature selection. Further, we introduce an intrusion detection system that uses an improved machine learning based method, Least Squares Support Vector Machine. Experiments on KDD Cup 99 data set address that our proposed mutual information-based feature selection method results in detecting intrusions with higher accuracy, especially for remote to login (R2L) and user to remote (U2R) attacks.
---
paper_title: Layered Approach Using Conditional Random Fields for Intrusion Detection

paper_content:

Intrusion detection faces a number of challenges; an intrusion detection system must reliably detect malicious activities in a network and must perform efficiently to cope with the large amount of network traffic. In this paper, we address these two issues of Accuracy and Efficiency using Conditional Random Fields and Layered Approach. We demonstrate that high attack detection accuracy can be achieved by using Conditional Random Fields and high efficiency by implementing the Layered Approach. Experimental results on the benchmark KDD '99 intrusion data set show that our proposed system based on Layered Conditional Random Fields outperforms other well-known methods such as the decision trees and the naive Bayes. The improvement in attack detection accuracy is very high, particularly, for the U2R attacks (34.8 percent improvement) and the R2L attacks (34.5 percent improvement). Statistical Tests also demonstrate higher confidence in detection accuracy for our method. Finally, we show that our system is robust and is able to handle noisy data without compromising performance.
---
paper_title: Toward integrating feature selection algorithms for classification and clustering

paper_content:

This paper introduces concepts and algorithms of feature selection, surveys existing feature selection algorithms for classification and clustering, groups and compares different algorithms with a categorizing framework based on search strategies, evaluation criteria, and data mining tasks, reveals unattempted combinations, and provides guidelines in selecting feature selection algorithms. With the categorizing framework, we continue our efforts toward-building an integrated system for intelligent feature selection. A unifying platform is proposed as an intermediate step. An illustrative example is presented to show how existing feature selection algorithms can be integrated into a meta algorithm that can take advantage of individual algorithms. An added advantage of doing so is to help a user employ a suitable algorithm without knowing details of each algorithm. Some real-world applications are included to demonstrate the use of feature selection in data mining. We conclude this work by identifying trends and challenges of feature selection research and development.
---
paper_title: On the combination of naive Bayes and decision trees for intrusion detection

paper_content:

Decision trees and naive Bayes have been recently used as classifiers for intrusion detection problems. They present good complementarities in detecting different kinds of attacks. However, both of them generate a high number of false negatives. This paper proposes a hybrid classifier that exploits complementaries between decision trees and naive Bayes. In order to reduce false negative rate, we propose to reexamine decision trees and Bayes nets outputs by an anomaly-based detection system
---
paper_title: Support-vector networks

paper_content:

Thesupport-vector network is a new learning machine for two-group classification problems. The machine conceptually implements the following idea: input vectors are non-linearly mapped to a very high-dimension feature space. In this feature space a linear decision surface is constructed. Special properties of the decision surface ensures high generalization ability of the learning machine. The idea behind the support-vector network was previously implemented for the restricted case where the training data can be separated without errors. We here extend this result to non-separable training data.High generalization ability of support-vector networks utilizing polynomial input transformations is demonstrated. We also compare the performance of the support-vector network to various classical learning algorithms that all took part in a benchmark study of Optical Character Recognition.
---
paper_title: Layered Approach Using Conditional Random Fields for Intrusion Detection

paper_content:

Intrusion detection faces a number of challenges; an intrusion detection system must reliably detect malicious activities in a network and must perform efficiently to cope with the large amount of network traffic. In this paper, we address these two issues of Accuracy and Efficiency using Conditional Random Fields and Layered Approach. We demonstrate that high attack detection accuracy can be achieved by using Conditional Random Fields and high efficiency by implementing the Layered Approach. Experimental results on the benchmark KDD '99 intrusion data set show that our proposed system based on Layered Conditional Random Fields outperforms other well-known methods such as the decision trees and the naive Bayes. The improvement in attack detection accuracy is very high, particularly, for the U2R attacks (34.8 percent improvement) and the R2L attacks (34.5 percent improvement). Statistical Tests also demonstrate higher confidence in detection accuracy for our method. Finally, we show that our system is robust and is able to handle noisy data without compromising performance.
---
paper_title: Least Squares Support Vector Machine Classifiers: a Large Scale Algorithm

paper_content:

Support vector machines (SVM's) have been introduced in literature as a method for pattern recognition and function estimation, within the framework of statistical learning theory and structural risk minimization. A least squares version (LSSVM) has been recently reported which expresses the training in terms of solving a set of linear equations instead of quadratic programming as for the standard SVM case. In this paper we present an iterative training algorithm for LS-SVM's which is based on a conjugate gradient method. This enables solving large scale classification problems which is illustrated on a multi two-spiral benchmark problem. Keywords. Support vector machines, classification, neural networks, RBF kernels, conjugate gradient method.
---
paper_title: Decision tree based light weight intrusion detection using a wrapper approach

paper_content:

The objective of this paper is to construct a lightweight Intrusion Detection System (IDS) aimed at detecting anomalies in networks. The crucial part of building lightweight IDS depends on preprocessing of network data, identifying important features and in the design of efficient learning algorithm that classify normal and anomalous patterns. Therefore in this work, the design of IDS is investigated from these three perspectives. The goals of this paper are (i) removing redundant instances that causes the learning algorithm to be unbiased (ii) identifying suitable subset of features by employing a wrapper based feature selection algorithm (iii) realizing proposed IDS with neurotree to achieve better detection accuracy. The lightweight IDS has been developed by using a wrapper based feature selection algorithm that maximizes the specificity and sensitivity of the IDS as well as by employing a neural ensemble decision tree iterative procedure to evolve optimal features. An extensive experimental evaluation of the proposed approach with a family of six decision tree classifiers namely Decision Stump, C4.5, Naive Baye's Tree, Random Forest, Random Tree and Representative Tree model to perform the detection of anomalous network pattern has been introduced.
---

Title: Intelligent feature selection and classification techniques for intrusion detection in networks: a survey

Section 1: Intelligent intrusion detection systems
Description 1: Discuss the concept and importance of intelligent intrusion detection systems.

Section 2: Intelligent preprocessing techniques
Description 2: Explain feature selection methods and its advantages in the context of intrusion detection systems.

Section 3: Intelligent classification techniques
Description 3: Provide an overview of classification techniques, particularly focusing on their application in intrusion detection systems.

Section 4: Decision trees
Description 4: Describe the structure and working principles of decision trees and their use in intrusion detection.

Section 5: Neural networks
Description 5: Discuss neural network models, their structure, and their application in intrusion detection systems.

Section 6: Naive Bayesian classifiers
Description 6: Explain the naive Bayesian classifier and its role in intrusion detection.

Section 7: Fuzzy sets
Description 7: Describe fuzzy set theory and its application in intrusion detection systems.

Section 8: Dataset and performance metrics
Description 8: Discuss the dataset used for evaluating intrusion detection methods and the performance metrics commonly employed.

Section 9: Testing scenario
Description 9: Explain the evaluation scenario and methodology used to test the algorithms discussed in the paper.

Section 10: Works on intelligent IDSs
Description 10: Provide a survey of recent works utilizing computational intelligence approaches for intrusion detection.

Section 11: Static agents
Description 11: Detail static agent-based systems and their deployment in intrusion detection.

Section 12: Mobile agents
Description 12: Describe mobile agent-based systems and their roles in intrusion detection.

Section 13: Ant based agents
Description 13: Explain the application of ant colony optimization algorithms in intrusion detection.

Section 14: Neural networks based IDSs
Description 14: Discuss the application of neural networks specifically for intrusion detection systems.

Section 15: Genetic algorithm-based IDSs
Description 15: Explain genetic algorithms used for intrusion detection, with a focus on simplified security audit trials analysis.

Section 16: Genetic-based feature selection
Description 16: Discuss feature selection using genetic algorithms and its benefits for intrusion detection.

Section 17: Neuro-genetic classification
Description 17: Describe the combination of neural networks and genetic algorithms for intrusion detection.

Section 18: Fuzzy and rough sets
Description 18: Explore fuzzy and rough sets and their application in intrusion detection systems.

Section 19: Neuro-fuzzy algorithms
Description 19: Explain neuro-fuzzy algorithms and their usefulness in handling large volumes of data with uncertainty.

Section 20: Fuzzy-Genetic algorithms
Description 20: Discuss the integration of fuzzy logic and genetic algorithms in intrusion detection systems.

Section 21: Rough sets
Description 21: Describe the use of rough sets for reducing attributes and improving accuracy in intrusion detection.

Section 22: Particle swarm intelligence
Description 22: Explain the particle swarm optimization techniques and their application in intrusion detection.

Section 23: Comparative analysis
Description 23: Compare different computational intelligence approaches for intrusion detection.

Section 24: Feature selection
Description 24: Provide a detailed look at various feature selection methods and their impact on intrusion detection.

Section 25: Classification
Description 25: Explore different classification algorithms used for detecting intrusions.

Section 26: Proposed intelligent IDS
Description 26: Discuss the newly proposed intelligent IDS, including feature selection and classification algorithms.

Section 27: Results and discussion
Description 27: Present experimental results and discuss the effectiveness of the proposed methods.

Section 28: Conclusion
Description 28: Summarize the findings, contributions, and future research directions in intelligent intrusion detection systems.