# On Copulas-Based Classification Method for Intrusion Detection

Abdelkader Khobzaoui, Mhamed Mesfioui, Abderrahmane Yousfate, Boucif

Amar Bensaber

► To cite this version:

Abdelkader Khobzaoui, Mhamed Mesfioui, Abderrahmane Yousfate, Boucif Amar Bensaber. On Copulas-Based Classification Method for Intrusion Detection. 5th International Conference on Computer Science and Its Applications (CIIA), May 2015, Saida, Algeria. pp.394-405, 10.1007/978-3-319-19578-0_32. hal-01789951

HAL Id: hal-01789951

https://inria.hal.science/hal-01789951

Submitted on 11 May 2018

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# On Copulas-based Classification Method for Intrusion Detection *

Abdelkader Khobzaoui¹, Mhamed Mesfioui², Abderrahmane Yousfate³, and
Boucif Amar Bensaber²

¹ Computer sciences Department, University of Saida

² Département de mathématiques et informatique, Université du Québec,
Trois-Rivières, C.P, 500, Québec, Canada, G9A 5H7

³ Laboratoire de mathématiques (LDM), University of Sidi Bel Abbès

**Abstract.** The intent of this paper is to develop a nonparametric classification method using copulas to estimate the conditional probability for an element to be a member of a connected class while taking into account the dependence of the attributes of this element. This technique is suitable for different types of data, even those whose probability distribution is not Gaussian. To improve the effectiveness of the method, we apply it to a problem of network intrusion detection where prior classes are topologically connected.

**Key words:** Intrusion detection, Classification, Copula function, Copula density estimator, Empirical copula.

## 1 Introduction

Let a set of $d$ attributes $(a_1, a_2, \dots, a_d)$ characterizing a vectorial space $E$. Let also $(x_1, x_2, \dots, x_n)$ a set of $E$ used as a learning set over $m$ classes denoted $(\omega_1, \omega_2, \dots, \omega_m)$ which are actually some disjoint subsets of $E$. To avoid the use of some predetermined probability laws of the attributes systematically, we intent to build a copulas-based classification model that estimates the true attributes laws and their dependency. Then one assigns each entity of $E$ to its most likely class $\omega_i$; $i \in \{1, \dots, m\}$. This entity must be well-assigned when it verifies an optimal probabilistic criterion.

In deterministic classification, this model builds, over the set $E$, an equivalence relation $\mathcal{R} \subset E \times E$ where $E/\mathcal{R}$ is a partition of $E$. In nondeterministic classification, for some adapted risks, classes are built using probability distributions. Each realization of the observed phenomenon distributes all elements over the different classes which yields to a partition of $E$. Partition changes with realizations (samples). To assign $k$ elements to $m$ classes, in the deterministic case, one has only $k$ steps to carry out all the affectations; each step requires $m$ simplified tests. However, in the nondeterministic case, if one enumerates all

<footnote>* Funded in part by DGRSDT, Algiers (PNR : Data mining and applications)</footnote>
possibilities for distributing k entities over m classes, then one finds m^k possibilities; each possibility requires k assigning steps. Each element is assigned to the class ω_j via a conditional probability f(x | j) which can be estimated using the training data. Actually, we seek the most likely class k (maximum likelihood estimation) solution of : k = arg max_j (f(x | j)) where f(x | j) denotes the conditional probability density function for x being a member of group ω_j.

To reduce the complexity of the problem, one assigns elements to their respective classes as in deterministic affectation. Elements whose ranges are near apexes are the most likely affected. In this case, each step requires m complicated tests; that means k.m complicated tests.

In the following we'll denote f^j(x) instead f(x | j).

Many applications algorithms and models have been proposed to estimate this conditional probability density function : kernel-density estimator [32], k-nearest-neighbours (KNN) method [19], Learning Vector Quantisation (LVQ) [12], Support Vector Machines (SVM)[20] ...

In this work we present the use of the empirical copula function as an alternative for modeling dependence structure in a supervised probabilistic classifier. The set E is identified to a vector space R^d over the field R and we use the law of the considered phenomenon over E which can be well estimated if learning sample is sizable. So, the conditional probability density function f^j(x) is estimated according the following algorithm:

**Algorithm 1** Conditional probability density estimation

**Require:** :

- {X_i}^n_{i=1} an iid random sample from a d-dimensional distribution F with density f.

- Ω = {ω_1, ..., ω_m} m learning classes.

1: **for** each j ∈ {1, ..., m} **do**

2: Transform the observations X_i^j to U_i^j = F^j_{ni}(X_i) where F^j_{ni} estimates the ith marginal distribution restricted to a class ω_j and X_i^j denotes observation from the class ω_j

3: Estimate the marginal densities f_i^j for class ω_j.

4: Estimate the joint density of the transformed data restricted to the class ω_j. this density w'il be noted c^j and it is equivalent to the copula density.

5: Estimate the joint density of the original data restricted to a class ω_j by:

$$f^j(x) = c^j(F_1(x_1), \dots, F_d(x_d)) \prod_{i=1}^{d} f_i^j(x_i)$$

6: **end for**
This approach allows to mitigate the curse of dimensionality and to treat the data in all situations even if the variance does not exist. It considers also the non-linear relationships between attributes.

New observation $x$ will be affected to the class $\omega_r$ such that

$$r = \arg \max_j f^j(\mathbf{x})$$

The content of the paper is the following: The second section of the paper gives a short mathematical background of copula functions, Section 3 presents a copula based probabilistic model for classification. Section 4 presents the experimental setting to detect and identify intrusion in computer network and Section 5 summarizes the conclusions

## 2 Copulas Theory

Copulas play an important role in several areas of statistics and in Machine Learning as a tool of studying scale-free measures of dependence and as starting point for constructing families of bivariate distribution especially in applications where nonlinear dependencies are common and need to be represented.

The best definition of a copula is that given by referring to well known Sklar's theorem [28], [18], which states how a copula function is related to joint distribution functions.

**Theorem 1 (Sklar's theorem).** Let $F$ be any $d$-dimensional distribution function over real-valued random variables with marginals $f_1, f_2, \dots, f_d$, then there exists a copula function $C$ such that for all $x \in \bar{\mathbb{R}}^d$

$$F(x_1, \dots, x_d) = C(f_1(x_1), \dots, f_d(x_d)) \quad (1)$$

where $\bar{\mathbb{R}}$ denotes the extended real line $[-\infty, \infty]$ and $C: [0, 1]^p \to [0, 1]$.

The copula distribution can also be stated as joint distribution function of standard uniform random variables:

$$C(u_1, \dots, u_p) = P(U_1 \le u_1, \dots, U_p \le u_p) \quad (2)$$

where $U_i \sim U(0, 1)$ for $i = 1, \dots, p$.

Note that if $f_1(x_1), \dots, f_d(x_d)$ in (1) are all continuous, then $C$ is unique. Otherwise, $C$ is uniquely determined on $\text{Ran}(f_1) \times \text{Ran}(f_2) \times \dots \times \text{Ran}(f_d)$, where $\text{Ran}$ stands for the range.

Conversely, if $C$ is an $d$-copula and $f_1, \dots, f_d$ are distribution functions, then the function $F$ defined above is an $d$-dimensional distribution function with margins $f_1, \dots, f_d$. For the proof, see [28].

From Sklar's theorem we see that for continuous multivariate distribution functions, the univariate margins and the multivariate dependence structure can be separated, and the dependence structure can be represented by a copula.
An important consequence of theorem 1 is that the d-dimensional joint density $F$ and the marginal densities $f_1, f_2, \dots, f_d$ are also related:

$$f(x_1, \dots, x_d) = c(F_1(x_1), \dots, F_d(x_d)) \prod_{i=1}^{d} f_i(x_i) \quad (3)$$

where $c$ denotes the density of the copula $C$. The equation (3) shows that the product of marginal densities and a copula density builds a d-dimensional joint density.

The unique copula function related to the multivariate distributions $F$ with continues margins $f_i; 1 \le i \le d$ is determined by

$$C(u_1, \dots, u_d) = F(F_i^{-1}(u_1), \dots, F_i^{-1}(u_d)) \quad (4)$$

where

$$F_i^{-1}(s) = \{t \mid F_i(t) \ge s\} \quad (5)$$

denote the pseudo-inverse of the univariate margins $F_1, \dots, F_d$.

Copulas are essentially a way of transforming the random variable $(X_1, \dots, X_d)$ into another random variable $(U_1, \dots, U_d) = (F_1(X_1), \dots, F_d(X_d))$ having the margins uniform on $[0, 1]$ and preserving the dependence among the components. Without the continuity assumption, care must be taken to use equation (4); see [21] or [17].

### 3 Copula function estimation

To estimate copula functions, the first issue consists in specifying how to estimate separately the margins and the joint law. Moreover, some of these functions can be fully known. Depending on the assumptions made, some quantities have to be estimated parametrically, or semi or even non-parametrically. In the latter case, we have to choose between the usual methodology of using "empirical counterparts" and invoking smoothing methods well-known in statistics: kernels, wavelets, orthogonal polynomials, nearest neighbors,... A non-parametric estimation of copula treats both the copula and the marginals parameter-free and thus offers the greatest generality.

Unlike the marginal and the joint distributions which are directly observable, a copula is a hidden dependence structure. This makes the task of proposing a suitable parametric copula model non-trivial and is where a non-parametric estimator can play a significant role.

Indeed, a non-parametric copula estimator can provide initial information needed in revealing and subsequent formulation of an underlying parametric copula model[3].

Non-parametric estimation of copulas dates back to Deheuvels [6], who proposed the so-called empirical copula defined by

$$C_n(\mathbf{u}) = \frac{1}{n} \sum_{i=1}^{n} \mathbb{I}(F_{n,1}(X_{i1}) \le u_1, \dots, F_{n,d}(X_{i,d}) \le u_d) \quad (6)$$
where $F_{n,i}$ are the empirical distribution function given by

$$F_{n,j}(x) = \frac{1}{n} \sum_{i=1}^{n} \mathbb{I}(X_{i,j} \le x) \quad (7)$$

with $j=1, \dots, d$ and $\mathbf{u} \in [0, 1]^d$.

Let $R_i$ be the rank of $X_i$ among the sample $X_1, \dots, X_n$. Observe that $C_n$ is a function of ranks $R_1, R_2, \dots, R_n$, because $F_{n,j}(X_i) = \frac{R_{i,j}}{n}$, $i = 1, \dots, n$, namely;

$$C_n(\mathbf{u}) = \frac{1}{n} \sum_{i=1}^{n} \mathbb{I} \left( \frac{R_{i,1}}{n} \le u_1, \dots, \frac{R_{i,d}}{n} \le u_d \right). \quad (8)$$

From this representation, one can consider $C_n(\mathbf{u})$ as discrete multivariate distribution with uniform marginals takings values in the set $[\frac{1}{n}, \frac{2}{n}, \dots, 1]$. and so his density:

$$c_n(\mathbf{u}) = \frac{\partial C(u_1, \dots, u_d)}{\partial u_1, \dots, \partial u_d} \quad (9)$$

can be estimated by a standard kernel function:

$$\hat{c}_n(\mathbf{u}) = \frac{1}{n} \sum_{j=1}^{n} \prod_{i=1}^{d} h_i^{-1} K \left( \frac{u_i - U_{ji}}{h_i^{-1}} \right) \quad (10)$$

where $U_i$ is the transformed of the original data given by $U_i = F_{n,i}^j(X_i)$ as described above. And a univariate kernel function $K(u)$ is any functions satisfying the following conditions:

(a) $K(x) \ge 0$ and $\int_{\mathbb{R}} K(x)dx = 1$

(b) $\int_{\mathbb{R}} xK(x)dx = 0$ (Symmetric about the origin)

(c) Has finite second moment e.g. $\int_{\mathbb{R}} x^2K(x)dx < \infty$

So, we have to choose both kernel function $K$ and their smoothing parameter or bandwidth $h$. Actually, selection of $K$ is a problem of less importance, and different functions that produce good results can be used (see table 1 for some examples).

In this paper, we use the Gaussian one given by:

$$K(v) = \frac{1}{\sqrt{2\pi}} \exp(-\frac{v}{2}).$$

In practice, the choice of an efficient method for the calculation of $h$; for an observed data sample is a more complex problem, because of the effect of the bandwidth on the shape of the corresponding estimator. If the bandwidth is small, we will obtain an under-smoothed estimator, with high variability. On the contrary, if the value of $h$ is big, the resulting estimator will be very smooth and farther from the function that we are trying to estimate[23](see figure 1).
<table><caption>**Table 1.** some kernel functions.</caption><thead><tr><th></th><th>Kernel</th><th>K(x)</th></tr></thead><tbody><tr><td>1</td><td>uniform</td><td><sup>1</sup>&frasl;<sub>2</sub> <b>1</b><sub>(|x|&le;1)</sub></td></tr><tr><td>2</td><td>Epanechnikov</td><td><sup>3</sup>&frasl;<sub>4</sub> (1 &minus; x<sup>2</sup>) <b>1</b><sub>(|x|&le;1)</sub></td></tr><tr><td>3</td><td>Gaussian</td><td><sup>1</sup>&frasl;<sub>&radic;2&pi;</sub> exp(&minus;<sup>x</sup>&frasl;<sub>2</sub>)</td></tr><tr><td>4</td><td>triangular</td><td>(1 &minus; |x|) <b>1</b><sub>(|x|&le;1)</sub></td></tr><tr><td>5</td><td>Triweight</td><td><sup>35</sup>&frasl;<sub>32</sub> (1 &minus; x<sup>2</sup>)<sup>3</sup> <b>1</b><sub>(|x|&le;1)</sub></td></tr><tr><td>6</td><td>Tricube</td><td><sup>70</sup>&frasl;<sub>81</sub> (1 &minus; x<sup>3</sup>)<sup>3</sup> <b>1</b><sub>(|x|&le;1)</sub></td></tr><tr><td>7</td><td>Biweight (Quartic)</td><td><sup>15</sup>&frasl;<sub>16</sub> (1 &minus; x<sup>2</sup>)<sup>2</sup> <b>1</b><sub>(|x|&le;1)</sub></td></tr><tr><td>8</td><td>Cosine</td><td><sup>n</sup>&frasl;<sub>4</sub> cos(<sup>&pi;</sup>&frasl;<sub>2</sub> x) <b>1</b><sub>(|x|&le;1)</sub></td></tr></tbody></table>

For evaluating the tradeoff between bias and variance. Silverman[31] has suggested a frequently used rule-of-thumb bandwidth

$$h_n = 0.9(min(\hat{\sigma}, \frac{IQR}{1.34})n^{\frac{1}{5}},$$

where IQR is the interquartile range (the difference between the 75th and 25th percentile) and $\hat{\sigma}$ is the sample standard deviation. Like all desirable bandwidth selection procedures, this bandwidth gets smaller as the number of observations $n$ increases, but does not go to zero "too fast" [8].

## 4 The Probabilistic Classifier

As noted, the aim of this work is to develop a non-parametric classification method using a copula functions to estimate the conditional probability density $f^j(x)$ for one element $x$ being a member of class $\omega_j$. Actually, we use the empirical copula function estimator as tool to estimating $f^j(x)$ given by the equation 3.

Consider a set of $m$ class $\omega_1, \dots, \omega_m$. Each class $\omega_j$ is characterized by a $d$-random vector $\mathbf{X}^j = (X_1^j, \dots, X_d^j)$. Let $(X_{11}^j, \dots, X_{1d}^j), \dots, (X_{n1}^j, \dots, X_{nd}^j)$ be a random sample arises from the class $\omega_j$. The distribution of component $\mathbf{X}_i^j$ of the random vector $\mathbf{X}^j$ may be estimated by

$$F_{n,i}^j(x_i) = \frac{1}{n} \sum_{k=1}^{n} \mathbb{I}(X_{ki}^j \le x_i).$$

The density function of this component is also estimated by

$$\hat{f}_i^j(x_i) = \frac{1}{n} \sum_{j=1}^{n} K(x_i - X_{ji})$$
<figure><img src="image_2.png" /><figcaption>Fig. 1. Kernel density estimate (KDE) with different bandwidths of a random sample of 100 points from a standard normal distribution. Grey: true density (standard normal). Red: KDE with h=0.05. Green: KDE with h=2. Black: KDE with h=0.337.</figcaption></figure>

where

$$K(x) = \frac{1}{\sqrt{2\pi}} \exp\left(-\frac{x^2}{2}\right)$$

The density function of the random vector $\mathbf{X}_j$ can be estimated by

$$\hat{f}^j(\mathbf{x}) = \hat{c}^j(F_{n,1}^j(x_1), \dots, F_{n,d}^j(x_d)) \prod_{i=1}^d \hat{f}_i^j(x_i) \quad (11)$$

where $\hat{c}^j$ denotes the estimator of the copula density associated to a random vector $\mathbf{X}^j$ estimated by a standard kernel function as described in equation 10.

So, all elements of our classifier are constructed, namely: $\hat{c}$ the copula density estimators, $\hat{f}_i^j$ the marginal density estimators, and $\hat{f}^j$ the joint density estimators.

The goal of the classifier is to determine, given a new observation $x$, its most likely corresponding class $\omega_r$ which is chosen as follows:

$$r = \arg \max_j \hat{f}^j(\mathbf{x})$$

Finally, we will describe the main steps of our classifier:
**Algorithm 2** The probabilistic classifier algorithm

1: Let $\mathbf{x} = (x_1, \dots, x_d)$ a new observation.

2: For each $j \in \{1, \dots, m\}$ Do

3: For each $i \in \{1, \dots, d\}$ Do

– $u_i^j \leftarrow F_{n,i}^j(x_i)$

– Compute $\hat{f}_i^j(x_i)$

4: EndFor

5: Compute $\hat{c}^j(F_{n,1}^j(x_1), \dots, F_{n,d}^j(x_d))$ as described above

6: Compute $\hat{f}^j(\mathbf{x})$ from equation(11)

7: EndFor

8: affect the observation $x$ to the class $\omega_r$ such that

$$r = \arg \max_j \hat{f}^j(\mathbf{x})$$

## 5 Application

To verify the effectiveness and the feasibility of the proposed algorithm, we use the KDD'99 dataset ([5]), was originally provided by MIT Lincoln, Labs which contains a standard set of data to be audited, which includes a wide variety of intrusions simulated in a real-world military network environment.

The KDD'99 dataset includes a set of 41 features, gathered in 7 symbolic ones and 34 numeric. A complete description of all 41 features is available in [5]. These features are divided into four categories:

1. The intrinsic features of a connection, which includes the basic features of individual TCP connections. For example, duration of the connection, the type of the protocol (tcp, udp, etc), network service (http, telnet, etc), etc.

2. The content feature within a connection suggested by domain knowledge is used to assess the payload of the original TCP packets, such as number of failed login attempts.

3. The same host features examine established connections in the past two seconds that have the same destination host as the current connection, and calculate statistics related to the protocol behavior, service, etc.

4. The similar same service features examine the connections in the past two seconds that have the same service as the current connection.

These features describe 23 behaviors of which one corresponds to a normal traffic and the 22 others correspond to attacks which are gathered in four categories as summarized in table 2:

1. DOS (Denial of service): making some computing or memory resources too busy so that they deny legitimate users access to these resources.
2. R2L (Root to local): unauthorized access from a remote machine according to exploit machine's vulnerabilities.

3. U2R (User to root): unauthorized access to local super user (root) privileges using system's susceptibility.

4. PROBE: host and port scans as precursors to other attacks. An attacker scans a network to gather information or find known vulnerabilities.

<table><caption>**Table 2.** Class label in KDD '99 Dataset.</caption><thead><tr><td>Id-Attack</td><td>Attack</td><td>Category</td></tr></thead><tbody><tr><td>1</td><td>back</td><td>dos</td></tr><tr><td>2</td><td>buffer_overflow</td><td>u2r</td></tr><tr><td>3</td><td>ftp_write</td><td>r2l</td></tr><tr><td>4</td><td>guess_passwd</td><td>r2l</td></tr><tr><td>5</td><td>imap</td><td>r2l</td></tr><tr><td>6</td><td>ipsweep</td><td>probe</td></tr><tr><td>7</td><td>land</td><td>dos</td></tr><tr><td>8</td><td>loadmodule</td><td>u2r</td></tr><tr><td>9</td><td>multihop</td><td>r2l</td></tr><tr><td>10</td><td>neptune</td><td>dos</td></tr><tr><td>11</td><td>nmap</td><td>probe</td></tr><tr><td>12</td><td>normal</td><td>normal</td></tr><tr><td>13</td><td>perl</td><td>u2r</td></tr><tr><td>14</td><td>phf</td><td>r2l</td></tr><tr><td>15</td><td>pod</td><td>dos</td></tr><tr><td>16</td><td>portsweep</td><td>probe</td></tr><tr><td>17</td><td>rootkit</td><td>u2r</td></tr><tr><td>18</td><td>satan</td><td>probe</td></tr><tr><td>19</td><td>smurf</td><td>dos</td></tr><tr><td>20</td><td>spy</td><td>r2l</td></tr><tr><td>21</td><td>teardrop</td><td>dos</td></tr><tr><td>22</td><td>warezclient</td><td>r2l</td></tr><tr><td>23</td><td>warezmaster</td><td>r2l</td></tr></tbody></table>

We used the train data-set which is about 494 020 connection record and test data-set is about 4 898 431. First, the symbolic variables are converted to numeric ones, the zero colones and repeated rows are removed we obtained 145 586 rows for training and 1 074 992 for test.

Calculations are performed under the R Environment for Statistical Computing[24] [25] using the parallel packages snow[29] and snowfall[30] under Linux RedHat enterprise 6 workstation on Intel Core i7 with 16 Go of Ram and 4 physical cores.

As confusion matrix between all behaviors is too big, we present in table 3 a summarized confusion matrix between the five categories of behaviors (described above). This condensed representation allows us to compare our
results with those presented by other authors which have used the same data set.

<table><caption>**Table 3.** Results by Attacks categories.</caption><thead><tr><th></th><th>Normal</th><th>Dos</th><th>Probe</th><th>R2L</th><th>U2R</th></tr></thead><tbody><tr><th>Normal</th><td>97.375</td><td>0.406</td><td>2.038</td><td>0.175</td><td>0.006</td></tr><tr><th>Dos</th><td>0.068</td><td>97.357</td><td>2.563</td><td>0.010</td><td>0.002</td></tr><tr><th>Probe</th><td>4.928</td><td>4.199</td><td>90.548</td><td>0.094</td><td>0.231</td></tr><tr><th>R2L</th><td>0.000</td><td>0.000</td><td>0.000</td><td>100.000</td><td>0.000</td></tr><tr><th>U2R</th><td>0.000</td><td>0.000</td><td>0.000</td><td>0.000</td><td>100.000</td></tr></tbody></table>

Conditional distributions are on rows. For example the first row means that normal behavior is identified as normal with estimate probability 97.375% (True Negative Attacks). It is identified as DOS behavior with estimate probability 0.406%, as PROB behavior with estimate probability 2.038% as R2L behavior with estimate probability 0.175% and U2R behavior with estimate probability 0.006%. These four last identifications are said "False Positive Attacks". From second to fifth rows when behavior is identified as Normal, this identification is said "False Negative Attacks" else it is said "True Positive Attacks".

In order to evaluate the performances of our method, we compare the our results with those obtained by other authors which have used the same data set.

<table><caption>**Table 4.** Performance comparison of proposed Algorithm.</caption><thead><tr><th>Method</th><th>Normal</th><th>Dos</th><th>Probe</th><th>U2R</th><th>R2L</th></tr></thead><tbody><tr><th>MCAD[26]</th><td>95.20</td><td>99.20</td><td>97.0</td><td>72.80</td><td>69.20</td></tr><tr><th>KDD cup 99 Winer [22]</th><td>99.50</td><td>97.10</td><td>83.30</td><td>13.20</td><td>08.40</td></tr><tr><th>GP Multi- Transformation[10]</th><td>99.93</td><td>98.81</td><td>97.29</td><td>45.20</td><td>80.22</td></tr><tr><th>C.N.B.D.[11]</th><td>99.72</td><td>99.75</td><td>99.25</td><td>99.20</td><td>99.26</td></tr><tr><th>PNRule[1]</th><td>99.50</td><td>96.9</td><td>73.20</td><td>06.60</td><td>10.70</td></tr><tr><th>ESC-IDS-1[33]</th><td>98.20</td><td>99.5</td><td>84.10</td><td>14.10</td><td>31.50</td></tr><tr><th>Prazen-window N.I.D.[34]</th><td>97.38</td><td>96.71</td><td>99.17</td><td>93.57</td><td>31.17</td></tr><tr><th>Model 1(a)[13]</th><td></td><td>97.40</td><td>83.80</td><td>32.80</td><td>10.70</td></tr><tr><th>SVM-IDS [9]</th><td>99.80</td><td>92.5</td><td>98.30</td><td>05.10</td><td>70.20</td></tr><tr><th>NN Classifier with GDA[27]</th><td>98.95</td><td>98.63</td><td>96.50</td><td>24.12</td><td>12.08</td></tr><tr><th>SVM+DGSOT[14]</th><td>95.00</td><td>97.00</td><td>91.00</td><td>23.00</td><td>43.00</td></tr><tr><th>I.C.A.[7]</th><td>69.60</td><td>98.00</td><td>100.00</td><td>71.40</td><td>99.20</td></tr><tr><th>C.L.C. [15]</th><td>73.95</td><td>99.88</td><td>87.83</td><td>61.36</td><td>98.50</td></tr><tr><th>Multi- PD[16]</th><td></td><td>97.30</td><td>88.70</td><td>29.80</td><td>09.60</td></tr><tr><th>ADWICE[4]</th><td></td><td>98.30</td><td>96.00</td><td>81.10</td><td>70.80</td></tr><tr><th><strong>Our method</strong></th><td><strong>97.375</strong></td><td><strong>97.357</strong></td><td><strong>90.548</strong></td><td><strong>100.00</strong></td><td><strong>100.00</strong></td></tr></tbody></table>
# 6 Conclusion

The method proposed, in this paper, presents many interesting advantages with respect to previous proposals in the field of intrusion detection, when applied to KDDCup'99 data set.

The obtained results, confirm the fact that copulas are flexible and powerful tool of studying scale-free measures of dependence and as starting point for constructing families of multivariate distribution especially in applications where nonlinear dependencies involved in the study and need to be represented. That occurs essentially when attributes probability laws are non-gaussian.

# References

1. Agarwal, R. and Joshi, M.V. "PNrule: A New Framework for Learning Classifier Models in Data Mining." Proceedings of the First SIAM International Conference on Data Mining, Chicago, IL USA, 5-7 April, (2001).

2. Chao, M., Xin, S.Z. and Min, L.S. (2014) "Neural network ensembles based on copula methods and Distributed Multiobjective Central Force Optimization algorithm." Engineering Applications of Artificial Intelligence Vol. 32, pp. 203212.

3. Chen, S. X. and Huang, T.-M. "Nonparametric estimation of copula functions for dependence modelling." The Canadian Journal of Statistics, Vol. 35, No. 2, (2007).

4. Burbeck, K. and Nadjm-Tehrani, S. "ADWICE - anomaly detection with real-time incremental clustering." In: the 7th International Conference on Information Security and Cryptology, Seoul, Korea, pp. 4007-424. Springer Verlag. (2004).

5. "DARPA Intrusion Detection Data set"
http://www.ll.mit.edu/mission/communications/ist/corpora/ideval/datahtml.

6. Deheuvels, P. "La fonction de dépendance empirique et ses propriétés. Un test non paramétrique d’indépendance." Bulletin de la classe des sciences. Acadimie Royale de Belgique, Volume 65, pp 274-292. (1979)

7. Y. Dayu, H. Qi. "A Network Intrusion Detection Method using Independent Component Analysis." International Conference on Pattern Recognition (ICPR), Tampa, FL, pp. 8-11, (2008).

8. DiNardo, J. and Tobias, J. L. "Nonparametric Density and Regression Estimation" Journal of Economic Perspectives. Vol. 15, No. 4, pp. 11-28, (2001).

9. Eid, H. F., Darwish, A., Hassanien, A. E. and Ajith, A. "Principle Components Analysis and Support Vector Machine based Intrusion Detection System." 10th International Conference on Intelligent Systems Design and Applications, (2010).

10. Faraoun, K. M. and Boukelif, A. "Securing network traffic using genetically evolved transformations." Malaysian Journal of Computer Science, Vol. 19, No. 1, (2006).

11. Farid, D. M., Harbi, N. and Rahma, Z. M. "Combining naive bayes and decision tree for adaptive intrusion detection." International Journal of Network Security & Its Applications (IJNSA), Vol. 2, No. 2, (2010).

12. Kohonen, T. "Self-Organizing Maps." 3rd edition Springer-Verlag. (2000).

13. Huy, A. N., Deokjai, C. "Application of Data Mining to Network Intrusion Detection: Classifier Selection Model." 11th Asia-Pacific Network Operations and Management Symposium (APNOMS), pp. 399-408, (2008).

14. Khan, L., Awad, M. and Thuraisingham, B. "A new intrusion detection system using support vector machines and hierarchical clustering." The International Journal on Very Large Data Bases, Vol. 16, No. 4, pp. 507-521, (2007).
15. Levin, I. "KDD-99 Classifier Learning Contest LLSoft's Results Overview." ACM SIGKDD Explorations Newsletter, Vol. 1, No. 2, pp 67-75, (2000).

16. Maheshkumar, S. and Gursel, S. "Application of Machine Learning Algorithms to KDD Intrusion Detection Dataset within Misuse Detection Context." Proceedings of the International Conference on Machine Learning, Models, Technologies and Applications, Las Vegas (MLMTA 2003), Vol. 1, pp. 209-215. (2003).

17. Marshall, A. "Copulas, marginals and joint distributions," in Distributions with Fixed Marginals and Related Topics, ed. by L. Rüschendorff, B. Schweizer, and M. Taylor, Institute of Mathematical Statistics, Hayward, CA. pp. 213-222. (1996).

18. Mayor, G. Su'er, J. and Torrens, J. "Sklar's theorem in finite settings." IEEE Transactions on Fuzzy Systems, Vol. 15, No. 3, pp. 410416, (2007).

19. Michie, D., Spiegelhalter, D. J., Tayler, C. C. "Machine Learning, Neural and Statistical Classification." Ellis Horwood Series in Artificial Intelligence (Upper Saddle River, NJ: Prentice Hall). (1994).

20. Müller, K. R., Mika, S., Rätsch, G., Tsuda, K., Schölkopf, B. "An Introduction to Kernel-Based Learning Algorithms." IEEE Transactions on Neural Networks, Vol. 12, pp. 181-201, (2001).

21. Nelsen, R. "An Introduction to Copulas." 2nd Edition, Springer, New York. (2006).

22. Pfahringer, B. "Winning the KDD99 classification cup: bagged boosting." ACM SIGKDD Explorations Newsletter, Vol. 1, No. 2, pp. 65-66, (2000).

23. Quintela-del-Río A., Estévez-Pérez, G. "Nonparametric Kernel Distribution Function Estimator with kerdiest: An R Package for Bandwidth Choice and Applications." Journal of Statistical Software, Vol 50, issue 8. (2012).

24. "The Comprehensive R Archive Network." http://cran.r-project.org/

25. Rossiter, D. G. "Tutorial: Using the R Environment for Statistical Computing: An example with the Mercer & Hall wheat yield dataset." University of Twente, Faculty of Geo-Information Science & Earth Observation (ITC) Enschede (NL). (2014).

26. Santosh, K., Sumit, K. and Sukumar, N. "Multidensity Clustering Algorithm for Anomaly Detection Using KDD'99 Dataset." Advances in Computing and Communications, Vol. 190, Part 8, pp. 619-630. (2011).

27. Singh, S. and Silakari, S. "Generalized Discriminant Analysis algorithm for feature reduction in Cyber Attack Detection System." International Journal of Computer Science and Information Security, Vol. 6, No. 1, (2009).

28. Sklar A. "Fonction de répartition á n dimensions et leurs marges." Publ. Inst. Statist. Univ. Paris, 8,229-231. (1959).

29. "snow: Simple Network of Workstations."
http://cran.r-project.org/web/packages/snow/index.html

30. "snowfall: Easier cluster computing (based on snow)."
http://cran.r-project.org/web/packages/snowfall/index.html

31. Silverman, B.W. "Density Estimation for Statistics and Data Analysis." In Monographs on Statistics and Applied Probability, London: Chapman and Hall, (1986).

32. Terrell, D. G., Scott, D. W. "Variable kernel density estimation." Annals of Statistics, Vol. 20, No. 3, pp. 1236-1265, (1992).

33. Toosi, A. N. and Kahani, M. "A new approach to intrusion detection based on an evolutionary soft computing model using neuro-fuzzy classifiers." Computer Communications, Vol. 30, pp. 2201-2212, (2007).

34. Yeung, D. Y. and Chow, C. "Parzen-window Network Intrusion Detectors." 16th International Conference on Pattern Recognition. Quebec, Canada. pp. 11-15, (2002).