\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={A Comparative Study on Performance Evaluation of Intrusion Detection System through Feature Reduction for High Speed Networks},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2014-01-15 (revised: 15 January 2014)}
\def\TheID{\makeatother }
\def\TheDate{2014-01-15}
\title{A Comparative Study on Performance Evaluation of Intrusion Detection System through Feature Reduction for High Speed Networks}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{V.  Jyothsn}

             \affil[1]{  JNTUH}

\renewcommand\Authands{ and }

\date{\small \em Received: 15 December 2013 Accepted: 31 December 2013 Published: 15 January 2014}

\maketitle


\begin{abstract}
        


Abstract- The rapid growth in the usage of the internet had led to many serious security issues in the network. The intrusion detection system (IDS) is one of the sophisticated defensive systems used to detect the malicious activities happening in the network services across the world.Hence, more advanced IDS are been developed in past few years. To improve the performance of the IDS, the system has to be trained effectively to increase the efficiency and decrease the false alarm rate. To train the system the attributes selection plays the major role.This paper evaluates and compares the performance of the intrusion detection systems for different feature reduction techniques in high speed networks.

\end{abstract}


\keywords{}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{Introduction}]{Introduction}\par
nternet is a global public network. In today's world, with the rapid increase in the potentials of the Internet, business model adopted in the organizations has subsequent change. Every day the people connecting to the Internet are also drastically increased. Today's a very critical business model popularly used is E-Business.\par
With the internet, business organizations are having incredible approach of reaching the end users. But in the internet there will be both harmless and harmful users that may lead to lots of risk to the business organizations. The information availability to the end users is one of the main services adopted by every organization. At the same time the information becomes available to the malicious users also. Malicious users or hackers will use different techniques on organization's internal systems to exploit vulnerabilities and compromise the system to access the sensitive information available in the system \hyperref[b0]{[1]}.\par
Every organization needs to adopt a security measure to overcome the accessing of data from the hackers. Many organizations across the world deployed firewalls to protect their private network from the Public network. Firewall protects the internal system by controlling the incoming and outgoing network traffic based on rule set. As the business organizations needs some kind of access permissions to the internal systems for the Internet users. These permissions may cause some vulnerabilities in the Private network through which the malicious users will have a change to get in to the system. So, the firewalls will not provide the 100\% guarantee of the organization in securing the sensitive data present in the system.\par
One of the remedy to defence against the attacks in the network is intrusion detection system (IDS) \hyperref[b1]{[2]}. An intrusion detection system (IDS) is used to monitor suspicious activities in the network traffic and alerts the system or network administrator. In some cases the IDS is not only used to detect the anomalous or maliceousstraffic but also for taking action such as blocking the user or source IP address from accessing the network.\par
Initially, Intrusion Detection Systems \hyperref[b2]{[3,}\hyperref[b3]{4]} were implemented to run on individual hosts or network devices to monitor the inbound and outbound packets from the device and alert the user or administrator about suspicious activity. This sort of detection is called host based (HIDS) intrusion detection systems. But the gradual evolution of the network led to focus on network based (NIDS) intrusion detection systems which is used to monitor traffic to and from all devices in the network by scanning all inbound and outbound traffic that would affect the overall speed of the network.\par
Depending upon the type of analysis used to detect the anomalies, IDS are classified as Signature based and Anomaly based detection systems \hyperref[b4]{[5]}. Signature based detection system also called misuse detection will monitor the network packets and check the availability of signatures in the database. If the pattern matches it specifies as attack. It is similar to the most antivirus software. The main limitation is it will only detect the attack whose attack patterns are already present in the database i.e., known malicious threats. It is unable to predict the new attacks. But the other type of analysis technique so called Anomaly based detection system will analyse the behaviour of the network and establish the baseline. If the activities in the network deviate from the baseline it will consider as malicious threat.\par
The benchmark dataset usually adopted by the research community of intrusion detection is KDD99 \hyperref[b5]{[6]}. Each record in the dataset is labelled as normal or attack. Each record in the dataset will consist of 41 features. The features are categorized into four clusters.  
\section[{Feature selection techniques}]{Feature selection techniques}\par
Feature selection also called attribute selection or variable subset selection. It is used to select the subset of relevant features needed for the model. The data set used in the constructed model will consists of relevant, redundant or irrelevant features \hyperref[b6]{[7]}. So, the key assumption used in the feature selection technique is removing the data which are redundant or irrelevant. The attribute or feature which does not provide any more information than the currently selected features then such type of features are called as Redundant and if the feature does not consist of useful information in any context then they are called as irrelevant features. Feature selection is also useful as part of the data analysis process, as it shows which features are important for prediction, and how these features are related \hyperref[b7]{[8,}\hyperref[b8]{9]}.\par
A feature selection technique provides the following benefits for analytical models:\par
? Improves the performance of the system.\par
? Increases the accuracy of prediction ? Need short time for training through which overall time of execution can be reduced.\par
The performance of the system will depend on detection rate and the false alarm rate also called as false positive rate. The detection rate is defined as the number of malicious packets detected by the system (True Positive) divided by the total number of malicious packets present in the data set. False Alarm Rate is defined as the number of normal packets detected as malicious packets (False Positive) divided by the total number of normal packets. Normally the IDS need to have high detection rate and low false alarm rate. To retrieve have high detection rate and low false alarm rate training the system plays a vital role. To train and improve the performance of the system all the parameters of the packet is not needed. So, an appropriate feature selection technique has to be used to select the relevant features by removing the redundant and irrelevant features through which overall performance of the system can be increased by decreasing the training time and increasing the accuracy of detecting the attacks in the network \hyperref[b9]{[10,}\hyperref[b10]{11]}. 
\section[{a) Correlation-based feature reduction (CFS)}]{a) Correlation-based feature reduction (CFS)}\par
The Correlation Feature Selection (CFS) \hyperref[b11]{[12,}\hyperref[b12]{13}] is a simple filter algorithm for evaluating and ranks subset of features based on correlation evaluation function. By observing the ranks for the attributes we can predict the correlation of the features. The features with high correlation will be considered as relevant features and low correlation can be ignored as Irrelevant features.\par
The following equation gives the correlation of features consisting k features: Information gain \hyperref[b13]{[14,}\hyperref[b14]{15]} determines the importance of the attribute in the total training dataset by analysing the information content of attributes. It is also used to predict the ordering of the nodes in the decision tree where nodes are considered as attributes. The highest information gain attribute is chosen as the splitting attribute for node N. This attribute minimizes the information needed to classify the list of attributes in the resulting partitions. By this approach, the needed expected number of tests can be minimized to classify a given list of attributes and guarantees that a simple tree is found.\par
The information gain of the each attribute is calculated as follows:Gain (A) = Info (D) -Info A (D)\par
Where, A?Attribute Info (D) ? Information content of the total dataset Info A (D) ?Information content of the Attribute A Information content of the total dataset is calculated as????????(??) = ? ? P ?? log 2 (P ?? ) m i=1\par
Where, D ? Total dataset i? Total number of class labels in the data set P i ? Probability of class label i in the data set Information content of the Attribute A in the total dataset is calculated as???????? ?? (??) = ? |?? ?? | |??| × ????????(?? ?? ) ?? ?? =1\par
Where  
\section[{c) Gain ratio (GR)}]{c) Gain ratio (GR)}\par
Gain ratio \hyperref[b15]{[16,}\hyperref[b16]{17]} is also a method which is used to define the importance of the attributes. It is a modified version of the information gain that reduces its bias on high-branch attributes. The values of the Gain ratio will be Large when data is evenly spread and it is small when all data belongs to one branch. It will take Gain ratio takes into account the number and size of branches when choosing an attribute. It has modified the information gain by taking into account the essential information of a split. It is based on how much information is needed to tell which branch an instance belongs to. Gain ratio is calculated as follows Gain Ratio (A) = Gain (A) / SplitInfo (A) Where, Gain (A) ?The information gain of the attribute A Split Info (A) ?The splitting information of the attribute A The splitting information is calculated as follows?????????????????? ?? (??) = ? ? |?? ?? | |??| × log 2 ( |?? ?? | |??| ) ?? ?? =1\par
Where Principal components analysis (PCA) \hyperref[b17]{[18]} also known as the Karhunen-Loeve or K-L method is a useful statistical technique which is used to reduce the number of attributes or dimensions in the dataset without much loss in the information needed to analyse the data. The basic procedure is as follows \hyperref[b18]{[19,}\hyperref[b19]{20]}:\par
1. Select the dataset for which the attributes or dimensions has to be reduced. 2. The dataset is normalized such that each attribute falls within the same range. 
\section[{Initially calculate the covariance between one}]{Initially calculate the covariance between one}\par
attribute with the other and derive the covariance matrix. Covariance is calculated as After calculating the eigenvectors of the covariance matrix, then order the eigen values by highest to lowest. These values give the importance of the attributes. The attributes with lesser eigen values can be ignored and higher eigen values will be considered. The attributes after leaving out the lesser Eigen values is considered as feature vector. 6. Derive the final data set Final dataset = Row feature vector * Row data adjust Where, Row feature vector ? The transposed eigenvectors matrix with most important features at the top.????(??, ??) = ? (?? ?? ? ?? ? )(?? ?? ? ?? ? ) ?? ??=1 ?? ?\par
Row data adjust ? The transposed mean-adjusted matrix (Attribute values in each column, with each row hol ding a separate dimension). 
\section[{e) Gini index (GI)}]{e) Gini index (GI)}\par
The Gini index \hyperref[b20]{[21]} is used to extract the attributes mainly needed to analyse the data set to detect the attacks. It measures the impurity of data set D. The attribute with highest gini index is treated as the unimportant attributes and the lowest gini index is treated as important attributes to detect the attacks. Gini index for the attribute A is calculated asGini (A) = Gini (D) ? GiniA (D)\par
Where, Gini (D) ? impurity of the total dataset Gini A (D) ? impurity of the Attribute A Impurity of the total dataset is calculated as OLSP-QPSO \hyperref[b21]{[22]} is an optimizing technique used to replace the QPSO. This technique is used to calculate the best swarm particles by applying a quadratic polynomial model. This process is an iterative process until the best swarm particles are been identified to analyse the attacks. The procedure for optimized QPSO algorithm is as follows 1. Swarm is initialized. 2. mbest is calculated 3. Update the position of the attributes 4. Estimate the fitness value for each attribute 5. If the present fitness value is better than the best fitness value in past, then update the existing fitness value by the current fitness value. 6. Update global best 7. Find the new attribute 8. If the new attribute is better than the worst attribute in the swarm, then replace the worst attribute by the new attribute 9. Repeat step 2 until maximum iterations is reached.Gini (D) = 1 ? ? P ?? m i=1\textbf{2} 
\section[{III. Comparison between the different feature selection techniques}]{III. Comparison between the different feature selection techniques}\par
Feature selection plays a major role for achieving the high performance intrusion detection system. Many feature selection techniques were proposed to select the relevant attributes from the data set. Some of the feature selection techniques mainly used was discussed in the previous section. The standard data set mainly used to experiment the intrusion detection system is KDD cup 1999. The KDD cup 1999 \hyperref[b22]{[23]} consists of approximately 5 million training set records and 3 million test set records. The records are classified as normal or anomaly. The anomalies are broadly classified as four categories such as DoS, U2R, R2L and Probe. Only 19.86 \% of the total training records are normal traffic and remaining are the attack traffic. Among the test set, 19.45 \% is normal traffic and remaining is attack traffic. Each record in the data set will consists of 41 features. All the attributes in the data set is not needed to analyse the attacks in the network. So, appropriate technique has to be chosen to reduce the features for the data set. Selected feature reduction should not affect the performance of the system. The selected technique should increase the detection rate and decrease the false positives \hyperref[b23]{[24]}.  From the above table it is observed that among the specified feature selection techniques more number of attributes is reduced using the Optimized Least Significant Particle based Quantitative Particle Swarm Optimization (OLSP-QPSO). The performance of the system will depend on detection rate and the false alarm rate \hyperref[b24]{[25]}. The detection rate is defined as the number of malicious packets detected by the system (True Positive) divided by the total number of malicious packets present in the data set. False Alarm Rate also called as false positive rate is defined as the number of normal packets detected as malicious packets (False Positive) divided by the total number of normal packets. Normally the IDS need to have high detection rate and low false alarm rate. This can be done by selecting the appropriate features needed to detect the attacks.\par
The general formulae used for detection rate and false alarm rate is calculated as follows     
\section[{Conclusion and future work}]{Conclusion and future work}\par
This paper mainly focuses on the different feature selection techniques used to detect the attacks in the network. Feature selection techniques will decreased the training time of the network. By training the system by the appropriate feature selection technique will increases the performance of the system. \begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-2.png}
\caption{\label{fig_0}}\end{figure}
         \begin{figure}[htbp]
\noindent\textbf{1} \par 
\begin{longtable}{P{0.7016363636363636\textwidth}P{0.02781818181818182\textwidth}P{0.12054545454545454\textwidth}}
\multicolumn{2}{l}{Feature selection}\tabcellsep Number of attributes\\
\multicolumn{2}{l}{methods}\tabcellsep selected\\
\multicolumn{2}{l}{Correlation-based feature reduction (CFS)}\tabcellsep 10\\
Gain ratio (GR)\tabcellsep \tabcellsep 14\\
\multicolumn{2}{l}{Information gain (IR)}\tabcellsep 20\\
Principal analysis (PCA)\tabcellsep component\tabcellsep 12\\
Gini Index (GI)\tabcellsep \tabcellsep 18\\
\multicolumn{2}{l}{Optimized Least Significant}\tabcellsep \\
\multicolumn{2}{l}{Particle based Quantitative Particle}\tabcellsep 8\\
\multicolumn{2}{l}{Optimization (OLSP-QPSO)}\tabcellsep \end{longtable} \par
 
\caption{\label{tab_2}Table 1 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{2} \par 
\begin{longtable}{P{0.6227019498607242\textwidth}P{0.0947075208913649\textwidth}P{0.13259052924791087\textwidth}}
Statistical results Feature selection methods\tabcellsep Number of attributes selected\tabcellsep Detection rate\\
Correlation-based feature reduction (CFS)\tabcellsep 10\tabcellsep 97.78\%\\
Gain ratio (GR)\tabcellsep 14\tabcellsep 96.56\%\\
Information gain (IR)\tabcellsep 20\tabcellsep 96.30\%\\
Principal component analysis (PCA)\tabcellsep 12\tabcellsep 97.20\%\\
Gini Index (GI)\tabcellsep 18\tabcellsep 96.42\%\\
Optimized Least\tabcellsep \tabcellsep \\
Significant Particle\tabcellsep \tabcellsep \\
based Quantitative Particle Swarm\tabcellsep 8\tabcellsep 98.33\%\\
Optimization (OLSP-\tabcellsep \tabcellsep \\
QPSO)\tabcellsep \tabcellsep \end{longtable} \par
 
\caption{\label{tab_3}Table 2 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{3} \par 
\begin{longtable}{P{0.12234848484848486\textwidth}P{0.13093434343434343\textwidth}P{0.07512626262626262\textwidth}P{0.08585858585858586\textwidth}P{0.11590909090909089\textwidth}P{0.07512626262626262\textwidth}P{0.24469696969696972\textwidth}}
Feature selection methods Attack categories\tabcellsep Correlation-based feature reduction (CFS)\tabcellsep Gain ratio (GR)\tabcellsep Information gain (IR)\tabcellsep Principal component analysis (PCA)\tabcellsep Gini Index (GI)\tabcellsep Optimized Least Significant Particle based Quantitative Particle Swarm Optimization (OLSP-QPSO)\\
DoS\tabcellsep 0.003\tabcellsep 0.004\tabcellsep 0.002\tabcellsep 0.001\tabcellsep 0.002\tabcellsep 0.002\\
R2L\tabcellsep 0.002\tabcellsep 0.004\tabcellsep 0.01\tabcellsep 0.003\tabcellsep 0.008\tabcellsep 0.001\\
U2R\tabcellsep 0.001\tabcellsep 0.005\tabcellsep 0.006\tabcellsep 0.002\tabcellsep 0.004\tabcellsep 0.003\\
Probe\tabcellsep 0.015\tabcellsep 0.036\tabcellsep 0.028\tabcellsep 0.013\tabcellsep 0.024\tabcellsep 0.01\end{longtable} \par
  {\small\itshape [Note: Figure 3 : False positive rate for attack categories V.]} 
\caption{\label{tab_4}Table 3 :}\end{figure}
 			\footnote{© 2014 Global Journals Inc. (US)} 		 		\backmatter  			  				\begin{bibitemlist}{1}
\bibitem[Mukkamala and Sung ()]{b3}\label{b3} 	 		‘A Comparative Study of Techniques for Intrusion Detection’.  		 			S Mukkamala 		,  		 			Sung 		.  	 	 		\textit{Proceedings of 15th IEEE International Conference on Tools with Artificial Intelligence},  				 (15th IEEE International Conference on Tools with Artificial Intelligence)  		2003. IEEE Computer Society Press. p. .  	 
\bibitem[Kendall ()]{b0}\label{b0} 	 		\textit{A Database of Computer Attacks for the Evaluation of Intrusion Detection Systems},  		 			K Kendall 		.  		1998.  		 			Massachusetts Institute of Technology 		 	 	 (Master's Thesis) 
\bibitem[Tavallaee et al. ()]{b22}\label{b22} 	 		‘A detailed analysis of the KDD Cup datasets’.  		 			M Tavallaee 		,  		 			E Bagheri 		,  		 			Lu W Ghorbani 		,  		 			AA 		.  	 	 		\textit{proceedings of IEEE Symposium on computational intelligence in security and defence applications},  				 (IEEE Symposium on computational intelligence in security and defence applications)  		2009.  	 
\bibitem[Jyothsna and Rama Prasad (2011)]{b1}\label{b1} 	 		‘A Review of Anomaly based Intrusion Detection Systems’.  		 			V Jyothsna 		,  		 			V V Rama Prasad 		.  	 	 		\textit{International Journal of Computer Applications}  		August 2011. 28  (7)  p. .  	 
\bibitem[Debar et al. ()]{b2}\label{b2} 	 		‘A Revised taxonomy for intrusion detection systems’.  		 			H Debar 		,  		 			M Dacier 		,  		 			A Wespi 		.  	 	 		\textit{Annales des Telecommunications}  		2000. 55  (7-8)  p. .  	 
\bibitem[Lindsay and Smith (2002)]{b18}\label{b18} 	 		\textit{A tutorial on Principal Components Analysis},  		 			I Lindsay 		,  		 			Smith 		.  		February 26, 2002.  	 
\bibitem[Xu ()]{b5}\label{b5} 	 		‘Adaptive Intrusion Detection Based on Machine Learning: Feature Extraction, Classifier Construction and Sequential Pattern Prediction’.  		 			Xin Xu 		.  	 	 		\textit{International Journal of Web Services Practices}  		2006. 2  (1)  p. .  	 
\bibitem[Xu and Wang ()]{b17}\label{b17} 	 		‘Adaptive network intrusion detection method based on PCA and support vector machines’.  		 			Xin Xu 		,  		 			X N Wang 		.  	 	 		\textit{ADMA 2005},  		Lecture Notes in Artificial Intelligence  		2005. 3584 p. .  	 	 (LNAI) 
\bibitem[Guyon and Elisseeff (2003)]{b6}\label{b6} 	 		‘An Introduction to Variable and Feature Selection’.  		 			Isabelle Guyon 		,  		 			Andre Elisseeff 		.  	 	 		\textit{Journal of Machine Learning Research}  		March 2003.  	 
\bibitem[García-Teodoro et al. (2009)]{b4}\label{b4} 	 		\textit{Anomaly-based network intrusion detection: Techniques, systems and challenges},  		 			P García-Teodoro 		,  		 			J Díaz-Verdejo 		,  		 			G Maciá-Fernández 		,  		 			E Vázquez 		.  		March 2009. Elsevier Computers \& Security. 28 p. .  	 
\bibitem[Altwaijry and Algarny ()]{b16}\label{b16} 	 		‘Basesian based intrusion detection system’.  		 			Hesham Altwaijry 		,  		 			Saeed Algarny 		.  	 	 		\textit{Journal of King Saud University -Computer and Information Sciences}  		2012. p. .  	 
\bibitem[Puttini and Me ()]{b15}\label{b15} 	 		‘Bayesian classification model for Real time intrusion detection’.  		 			R Puttini 		,  		 			Z 		,  		 			L Me 		.  	 	 		\textit{Proc. of 22nd. International workshop on Bayesian inference and maximum entropy methods in science and engineering},  				 (of 22nd. International workshop on Bayesian inference and maximum entropy methods in science and engineering)  		2002.  	 
\bibitem[Hall]{b12}\label{b12} 	 		\textit{Correlation-based Feature Selection for Machine Learning},  		 			Mark A Hall 		.  		 \url{http://www.cs.waikato.ac.nz/\textasciitilde mhall/thesis.pdf}  		 		 			Dept of Computer Science, University of Waikato 		 	 
\bibitem[Chebrolu et al. (2005)]{b9}\label{b9} 	 		‘Feature deduction and ensemble design of intrusion detection systems’.  		 			S Chebrolu 		,  		 			J P Abraham 		,  		 			Thomas 		.  	 	 		\textit{Computers \& Security}  		June 2005. 24  (4)  p. .  	 
\bibitem[Azhagusundari and Thanamani (2013)]{b14}\label{b14} 	 		‘Feature Selection based on Information Gain’.  		 			B Azhagusundari 		,  		 			Antony Selvadoss Thanamani 		.  	 	 		\textit{International Journal of Innovative Technology and Exploring Engineering (IJITEE)}  		 2278-3075.  		January 2013.  (2) .  	 
\bibitem[Ahmad et al. ()]{b19}\label{b19} 	 		‘Feature Subset Selection for Network Intrusion Detection Mechanism Using Genetic Eigen Vectors’.  		 			Ahmad 		,  		 			A Abdulah 		,  		 			K S Alghamdi 		,  		 			M Alnfajan 		,  		 			Hussain 		.  	 	 		\textit{Proc .of CSIT},  				 (.of CSIT)  		2011. 5.  	 
\bibitem[Zaman and Karray ()]{b8}\label{b8} 	 		‘Features selection for intrusion detection systems based on support vector machines’.  		 			S Zaman 		,  		 			Karray 		.  	 	 		\textit{CCNC'09 Proceedings of the 6th IEEE Conference on Consumer Communications and Networking Conference},  				2009.  	 
\bibitem[Han and Kamber ()]{b20}\label{b20} 	 		 			Jiawei Han 		,  		 			Micheline Kamber 		.  		\textit{Data mining: Concepts and Techniques},  				2006. Morgan Kauffmann Publishers.  	 
\bibitem[Jyothsna and Rama Prasad (2012)]{b21}\label{b21} 	 		‘HFO-ANID: Hierarchical Feature Optimization for Anomaly based Network Intrusion Detection’.  		 			V Jyothsna 		,  		 			V V Rama Prasad 		.  	 	 		\textit{Third International Conference on Computing Communication \& Networking Technologies (ICCCNT)},  				July 2012. p. .  	 	 (Published in IEEE Xplore digital library) 
\bibitem[Saman et al. ()]{b23}\label{b23} 	 		‘Identify Features and Parameters to Devise an Accurate Intrusion Detection System Using Artificial Neural Network’.  		 			M Saman 		,  		 			Abdulla 		,  		 			B Najla 		,  		 			Omar Al-Dabagh 		,  		 			Zakaria 		.  	 	 		\textit{World Academy of Science, Engineering and Technology}  		2010.  	 
\bibitem[Nguyen et al.]{b11}\label{b11} 	 		‘Improving Effectiveness of Intrusion Detection by Correlation Feature Selection’.  		 			H Nguyen 		,  		 			Franke 		,  		 			Petrovic 		.  	 	 		\textit{International Conference on Availability, Reliability and Security},  				2010 p. .  	 
\bibitem[Dr et al. ()]{b24}\label{b24} 	 		\textit{Intrusion Detection using Naive Bayes Classifier with Feature Reduction},  		 			Dr 		,  		 			Neelam Saurabh Mukherjeea 		,  		 			Sharmaa 		.  		2012. Elsevier Procedia Technology. p. .  	 
\bibitem[Chou et al. ()]{b10}\label{b10} 	 		‘Network Intrusion Detection Design Using Feature Selection of Soft Computing Paradigms’.  		 			T S Chou 		,  		 			K K Yen 		,  		 			J Luo 		.  	 	 		\textit{International Journal of Computational Intelligence}  		2008.  	 
\bibitem[NSL-KDD dataset for network -based intrusion detection systems]{b25}\label{b25} 	 		\textit{NSL-KDD dataset for network -based intrusion detection systems},  		 \url{http://iscx.info/NSL-KDD/}  		 	 
\bibitem[Sung and Mukkamala ()]{b7}\label{b7} 	 		‘The Feature Selection and Intrusion Detection Problems’.  		 			H Sung 		,  		 			S Mukkamala 		.  	 	 		\textit{Proceedings of the 9th Asian Computing Science Conference},  		Lecture Notes in Computer Science  		 (the 9th Asian Computing Science Conference)  		2004. Springer.  	 
\bibitem[Novakovic ()]{b13}\label{b13} 	 		\textit{Using Information Gain Attribute Evaluation to Classify Sonar Targets},  		 			Jasmina Novakovic 		.  		November 24-26, 2009. Belgrade.  	 	 (17th Telecommunications forum TELFOR 2009 Serbia) 
\end{bibitemlist}
 			 		 	 
\end{document}
