<figure><img src="image_1.png" /></figure>

HAL
open science

# Feature Grouping for Intrusion Detection System Based on Hierarchical Clustering

Jingping Song, Zhiliang Zhu, Chris Price

► To cite this version:

Jingping Song, Zhiliang Zhu, Chris Price. Feature Grouping for Intrusion Detection System Based on Hierarchical Clustering. International Cross-Domain Conference and Workshop on Availability, Reliability, and Security (CD-ARES), Sep 2014, Fribourg, Switzerland. pp.270-280, 10.1007/978-3-319-10975-6_21. hal-01404004

HAL Id: hal-01404004

https://inria.hal.science/hal-01404004

Submitted on 28 Nov 2016

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Feature Grouping for Intrusion Detection System based on
Hierarchical Clustering

Jingping Song¹,², Zhiliang Zhu¹, Chris Price²

¹Software College of Northeastern University, Shenyang, Liaoning, China, 110819.
{songjp, zhuzl}@swc.neu.edu.cn

²Department of Computer Science, Aberystwyth University, United Kingdom, SY23 3DB.
{jis17,cjp}@aber.ac.uk

**Abstract.** Intrusion detection is very important to solve an increasing number of security threats. With new types of attack appearing continually, traditional approaches for detecting hazardous contents are facing a severe challenge. In this work, a new feature grouping method is proposed to select features for intrusion detection. The method is based on agglomerative hierarchical clustering method and is tested against KDD CUP 99 dataset. Agglomerative hierarchical clustering method is used to construct a hierarchical tree and it is combined with mutual information theory. Groups are created from the hierarchical tree by a given number. The largest mutual information between each feature and a class label within a certain group is then selected. The performance evaluation results show that better classification performance can be attained from such selected features.

**Keywords:** Intrusion detection, Mutual information, Feature grouping, Hierarchical clustering

# 1 Introduction

Network intrusion detection system is a tool for network operators to detect hazardous traffic and alert their existence in the networks [1]. Most intrusion detection systems adopt signature based methods to detect intrusion attacks [2]. A signature is a rule set that contains information regarding target patterns from exciting hazardous packet actions against the target patterns. A network intrusion detection system can obtain valuable information from ongoing or local traffic as well. An intrusion detection system is not a standalone system, but works with other systems as a firewall [3]. There are two types of intrusion detection methods, misuse detection and anomaly detection. Misuse detection specifically detects known attacks by using pattern matching approaches, which is the common drawback of this kind of detection method. On the other hand, anomaly detection builds profiles of normal behaviors by detecting attacks first, and then identifies potential attacks when their behaviors are obviously deviated from normal profiles [4].
Anomaly intrusion detection is a classification task, and it consists of building a predictive model which can identify attack instances [5]. Intrusion detection can be considered as a two class problem or a multiple class problem. A two class problem regards all attack types as anomaly patterns and the other class is a normal pattern [6]. A multiple class problem deals with the classification based on different attacks. Since there are too many features or attributes which may contain false correlation, classification of anomaly intrusion detection systems is complex work [7]. Moreover, many features may be irrelevant or redundant. For this reason, feature selection methods can be used to get rid of the irrelevant and redundant features without decreasing performance.

Feature selection based on mutual information was initially reported in [8] and subsequently modified in [9] and [10]. The present paper has implemented a feature selection method by grouping features based on the use of mutual information combined with a hierarchical clustering method. The selected features are then employed in the C4.5 classification method for intrusion detection [11]. The performance of the proposed approach is evaluated with respect to different numbers of features and compared with other work in applied feature selection for intrusion detection systems in [9], [12] and [13] as well. [14] proposed an algorithm to use SVM and simulated annealing to find the best selected features to improve the accuracy of anomaly intrusion detection. [15] reported mutual information-based feature selection method results in detecting intrusions with higher accuracy.

# 2 Related works

## 2.1 Hierarchical Clustering

Hierarchical clustering is a clustering method to build a hierarchy of clusters. There are two types of strategies for hierarchical clustering, agglomerative and divisive [16]. Agglomerative is a bottom-up approach where initially every data item constitutes its own cluster, and pairs of clusters are merged as one moves up the hierarchy. Divisive is a top-down approach and all data is part of the initial cluster and splits are performed recursively as one moves down the hierarchy [17].

In order to decide which clusters should be combined or split, a measure of dissimilarity between sets of observations is required [18]. In most methods of hierarchical clustering, this is achieved by use of an appropriate metric and a linkage criterion [19]. In this paper, an agglomerative hierarchical clustering algorithm is used based on linkage rule.
## 2.2 Mutual Information

Entropy is an important measurement for information in information theory. It is capable of quantifying the uncertainty of random variables and scaling the amount of information shared by them effectively.

Let X be a random variables with discrete values, its entropy is defined as

$$H(X) = - \sum_{x \in X} p(x) \log p(x) \quad (1)$$

where H(·) is entropy, and p(x)=Pr(X=x) is the probability density function of X. Note that entropy depends on the probability distribution of the random variable.

Conditional entropy refers to the uncertainty reduction of one variable when the other is known. Assume that variable Y is given, the conditional entropy H(X|Y) of X with respect to Y is

$$H(X|Y) = - \sum_{y \in Y} \sum_{x \in X} p(x, y) \log p(x|y) \quad (2)$$

where p(x,y) is the joint probability density function and p(x|y) is the posterior probabilities of X given Y. Similarly, the joint entropy H(X,Y) of X and Y is

$$H(X, Y) = H(X) + H(Y|X) = H(Y) + H(X|Y) = - \sum_{y \in Y} \sum_{x \in X} p(x, y) \log p(x, y) \quad (3)$$

To quantify how much information is shared by two variables X and Y, a concept termed mutual information I(X;Y) is defined as

$$I(X; Y) = H(X) - H(X|Y) = H(Y) - H(Y|X) = - \sum_{x \in X} \sum_{y \in Y} p(x, y) \log \frac{p(x,y)}{p(x)p(y)} \quad (4)$$

I(X;Y) will be very high when X and Y are closely related with each other. Otherwise, I(X;Y)=0 denotes that these two variables are totally unrelated. In this paper, the mutual information between two variables is calculated.

## 2.3 C4.5 Algorithm

C4.5 is an algorithm used to generate a decision tree developed by Ross Quinlan and it is an extension of Quinlan's earlier ID3 algorithm. The decision trees generated by C4.5 can be used for classification, and for this reason, C4.5 is often referred to as a statistical classifier.

In this paper, C4.5 will be used to do the classification in section 4. From the classification results we can compare our method with other feature selection methods. C4.5 uses the concept of information gain to make a tree of classificatory decisions with respect to a previously chosen target classification. The information gain can be described as the effective decrease in entropy resulting from making a choice as to which attribute to use and at what level. Compared to other classification algorithms, it is an effective method to deal with a dataset like KDD99 which has new class labels in the test dataset. The reason is C4.5 is a
supervised learning method and based on information gain.

# 3 Implemented Work

In this section, our algorithm based on agglomerative hierarchical clustering is described in detail. The basic idea is grouping the features by agglomerative hierarchical clustering method, and then selecting features from the groups. As we used a clustering method to construct groups, cluster and group have the same meaning in the following formulation.

## 3.1 Selecting Strategy of Feature Grouping

Feature Grouping is highly beneficial in learning with high dimensional data. It reduces the variance in the estimation and improves the stability of feature selection [20]. Furthermore, it could help in data understanding and interpretation as well. The purpose of feature grouping is creating groups for candidate selecting features and selecting one feature or more features from certain groups to represent the group.

Clustering methods could be used to create groups since they select data in one cluster by specific metrics. Different clustering methods and metrics could compose different cluster constructions. Number of clusters affects how many features will be selected. For example, there are different strategies if we expect to select 8 features from a dataset. We could create 8 groups by a clustering method and select 1 feature in each group. And we could construct 4 groups and select 2 features per group as well. Moreover, we could select different numbers of features in different groups. Where hierarchical clustering method is used to create groups in this work, we chose the selecting 1 feature from each group strategy. This strategy is simple and easy to implement. And another reason is there might be only one feature in one group by using agglomerative hierarchical clustering method.

## 3.2 Implemented Algorithm

In this section, we will show the algorithm put forward by this paper. The detailed algorithm is shown as follows.

Input: A training dataset T=D(F,C), number of clusters n.

Output: Selected features S.

(1) Initialize parameters: F←'initial set of all features', C←'class labels', S=Ø.

(2) Calculate the mutual information of every pair of features fᵢ and fⱼ in F, denote as I(fᵢ; fⱼ).

(3) Create hierarchical cluster tree by using agglomerative hierarchical clustering method base on I(fᵢ; fⱼ).
(4) Construct clusters from a hierarchical cluster tree by given n.

(5) For each cluster, calculate mutual information between each feature and class label in C, and then find the maximum value M<sub>c</sub>.

(6) Select feature f<sub>s</sub> which has the M<sub>c</sub> in each group, and put f<sub>s</sub> into S, S ← 'f<sub>s</sub>'.

First of all, the algorithm set initialization parameters and F is a set of all the features in the training dataset. And C denotes class labels and C represents class labels. Then, the algorithm calculates the mutual information of every pair of features in F and composes a matrix based on them. After that, it creates a hierarchical cluster tree based on the matrix by using an agglomerative hierarchical clustering method. Moreover, it constructs clusters from a hierarchical cluster tree by given n. And n clusters mean n groups containing candidate features. Furthermore, in each cluster, it calculates mutual information between each feature and class label in C, and then finds the maximum value M<sub>c</sub>. Finally, it selects feature f<sub>s</sub> which has the M<sub>c</sub> in each group, and put f<sub>s</sub> into S.

# 4 Experimental Results

## 4.1 KDD99 Dataset

KDD99 is the most widely used data set for the evaluation of anomaly detection methods. This data set is built based on 7 weeks of TCP connections in network traffic, and there are about 5 million connection records in the training dataset and around 2 million connection records. Each connection is labeled by either normal or attack. The attack type is divided into four categories of 39 types of attacks [21]. Only 22 types of attacks are in the training dataset and the other 17 unknown types are in the test dataset. It is important to note that the test data is not from the same probability distribution as the training data, and it includes specific attack types not in the training data which makes the task more realistic. The KDD dataset consists of three components, which are detailed in Table 1.

The “10% KDD” dataset is employed for the purpose of training. The KDD training dataset consists of approximately 4,900,000 single connection vectors each of which contains 41 features, with exactly one specific attack type or normal type. This dataset contains 22 attack types and is a more concise version of the “whole KDD” dataset. It contains more connections of attacks than normal connections and the attack types are not represented equally. Denial of service attacks account for the majority of the dataset [22].

<table><caption>**Table 1.** Basic characteristics of the KDD 99 intrusion detection datasets</caption><thead><tr><th>Dataset</th><th>Normal</th><th>DoS</th><th>U2R</th><th>R2L</th><th>Probe</th></tr></thead><tbody><tr><td>“10%KDD”</td><td>97278</td><td>391458</td><td>52</td><td>1126</td><td>4107</td></tr><tr><td>“Corrected KDD”</td><td>60593</td><td>229853</td><td>70</td><td>16347</td><td>4166</td></tr></tbody></table>
<table><tr><td>"Whole KDD"</td><td>972780</td><td>3883370</td><td>52</td><td>1126</td><td>41102</td></tr></table>

On the other hand, the "Corrected KDD" dataset (test dataset) provides a dataset with different statistical distributions than either "10% KDD" or "Whole KDD" and contains 14 additional attacks. The list of class labels and their corresponding categories for "10% KDD" are detailed in [23].

## 4.2 Measures of Performance Evaluation

The implemented method in this paper is conducted by six measures: True Positive Rate (TPR), False Positive Rate (FPR), Precision, Recall, F-Measure. The six measures could be calculated by True Positive (TP), False Positive (FP), True Negative (TN), False Negative (FN), as follows.

True positive rate (TPR): TP/(TP+FN), also known as detection rate (DR) or sensitivity or recall. False positive rate (FPR): FP/(TN+FP) also known as the false alarm rate. Precision (P): TP/(TP+FP) is defined as the proportion of the true positives against all the positive results. Total Accuracy (TA): (TP+TN)/(TP+TN+FP+FN) is the proportion of true results (both true positives and true negatives) in the population. Recall (R): TP/(TP+FN) is defined as percentage of positive labeled instances that were predicted as positive. F-measure: 2PR/(P+R) is the harmonic mean of precision and recall.

We use the training dataset to construct the decision tree model and then reevaluate on the test dataset and get TP, FP, TN, FN. After that, we calculate precision, total accuracy and F-measure for the test dataset.

## 4.3 Experiment Evaluation

The experiments were conducted by using KDD 99 dataset and performed on a Windows machine having configuration and Intel (R) Core (TM) i5-2400 CPU@ 3.10GHz, 3.10 GHz, 4GB of RAM, the operating system is Microsoft Windows 7 Professional. We have used an open source machine learning framework Weka 3.5.0. This tool is used to do classification for performance comparison of our method with other feature selection methods. We used C4.5 as the classification algorithm for all the feature selection methods.

Table 2 shows comparison results by different feature selection methods using 13 selected features. The first algorithm C4.5 used 41 features to do the classification. DMIFS is dynamic mutual information feature selection method proposed by Huawen Liu [9]. FGMI is feature grouping based on mutual information method implemented previously by the authors of this paper. This method is construct groups based on mutual information among features. AHC is agglomerative hierarchical clustering algorithm implemented by this paper. We can see from the comparison that AHC algorithm produces better performance on F-measure and achieves good performance on other measures.
<table><caption>**Table 2.** Comparison results by different algorithms using 13 selected features</caption><thead><tr><th>Algorithm</th><th>TP Rate</th><th>FP Rate</th><th>Precision</th><th>Recall</th><th>F-Measure</th><th>Class</th></tr></thead><tbody><tr><td rowspan="2">C4.5 (41)</td><td><strong>0.994</strong></td><td>0.09</td><td>0.728</td><td><strong>0.994</strong></td><td>0.841</td><td>Normal</td></tr><tr><td>0.91</td><td><strong>0.006</strong></td><td><strong>0.999</strong></td><td>0.91</td><td>0.952</td><td>Anomaly</td></tr><tr><td rowspan="2">DMIFS</td><td>0.993</td><td>0.086</td><td>0.736</td><td>0.993</td><td>0.846</td><td>Normal</td></tr><tr><td>0.914</td><td>0.007</td><td>0.998</td><td>0.914</td><td>0.954</td><td>Anomaly</td></tr><tr><td rowspan="2">FGMI</td><td><strong>0.994</strong></td><td>0.085</td><td>0.739</td><td>0.994</td><td>0.848</td><td>Normal</td></tr><tr><td>0.915</td><td><strong>0.006</strong></td><td>0.998</td><td>0.915</td><td>0.955</td><td>Anomaly</td></tr><tr><td rowspan="2">AHC</td><td>0.993</td><td><strong>0.077</strong></td><td><strong>0.757</strong></td><td>0.993</td><td><strong>0.859</strong></td><td>Normal</td></tr><tr><td><strong>0.923</strong></td><td>0.007</td><td>0.998</td><td><strong>0.923</strong></td><td><strong>0.959</strong></td><td>Anomaly</td></tr></tbody></table>

Table 3 describes comparison results by different feature selection methods using 10 selected features. C4.5, DMIFS, FGMI and AHC have the meaning as table 2. MMIFS is modified mutual information feature selection method raised by Jingping in 2014 [24]. And we can see from the comparison that AHC could get better performance nearly in all measures.

<table><caption>**Table 3.** Comparison results by different algorithms using 10 selected features</caption><thead><tr><th>Algorithm</th><th>TP Rate</th><th>FP Rate</th><th>Precision</th><th>Recall</th><th>F-Measure</th><th>Class</th></tr></thead><tbody><tr><td rowspan="2">C4.5 (41)</td><td><strong>0.994</strong></td><td>0.09</td><td>0.728</td><td><strong>0.994</strong></td><td>0.841</td><td>Normal</td></tr><tr><td>0.91</td><td><strong>0.006</strong></td><td><strong>0.999</strong></td><td>0.91</td><td>0.952</td><td>Anomaly</td></tr><tr><td rowspan="2">DMIFS</td><td>0.993</td><td>0.086</td><td>0.736</td><td>0.993</td><td>0.846</td><td>normal</td></tr><tr><td>0.914</td><td>0.007</td><td>0.998</td><td>0.914</td><td>0.954</td><td>anomaly</td></tr><tr><td rowspan="2">MMIFS</td><td>0.99</td><td>0.084</td><td>0.741</td><td>0.99</td><td>0.848</td><td>normal</td></tr><tr><td>0.916</td><td>0.01</td><td>0.997</td><td>0.916</td><td>0.955</td><td>anomaly</td></tr><tr><td rowspan="2">FGMI</td><td>0.994</td><td>0.082</td><td>0.746</td><td>0.994</td><td>0.852</td><td>Normal</td></tr><tr><td>0.918</td><td>0.006</td><td>0.998</td><td>0.918</td><td>0.957</td><td>Anomaly</td></tr><tr><td rowspan="2">AHC</td><td><strong>0.994</strong></td><td><strong>0.08</strong></td><td><strong>0.751</strong></td><td><strong>0.994</strong></td><td><strong>0.856</strong></td><td>Normal</td></tr><tr><td><strong>0.92</strong></td><td><strong>0.006</strong></td><td>0.998</td><td><strong>0.92</strong></td><td><strong>0.958</strong></td><td>Anomaly</td></tr></tbody></table>

The purpose of comparison in table 2 and table 3 is to compare AHC and other algorithms by the same number of selected features. Figure 1 illustrates the precision comparison of AHC by different number of features.
<figure><img src="image_3.png" /><figcaption>Fig. 1. Precision comparison of AHC by different number of selected features</figcaption></figure>

Figure2 and figure 3 show the F-measure and total accuracy comparison of AHC by different number of features respectively.

<figure><img src="image_4.png" /><figcaption>Fig. 2. F-measure comparison of AHC by different number of selected features</figcaption></figure>
<figure><img src="image_5.png" /><figcaption>Fig. 3. Total accuracy comparison of AHC by different number of selected features</figcaption></figure>

From the comparison of figure 1 to figure 3, we could see better performance could be achieved when selecting 12 features by AHC. And table 4 shows detailed comparison of AHC by different number of selected features.

<table><caption>Table 4. Comparison results of AHC by different number of selected features</caption><thead><tr><th>NO. of Features</th><th>TP Rate</th><th>FP Rate</th><th>Precision</th><th>Recall</th><th>F-Measure</th><th>Class</th></tr></thead><tbody><tr><td rowspan="2">8</td><td><strong>0.995</strong></td><td>0.082</td><td>0.745</td><td><strong>0.995</strong></td><td>0.852</td><td>normal</td></tr><tr><td>0.918</td><td><strong>0.005</strong></td><td><strong>0.999</strong></td><td>0.918</td><td>0.956</td><td>anomaly</td></tr><tr><td rowspan="2">9</td><td><strong>0.995</strong></td><td>0.082</td><td>0.745</td><td><strong>0.995</strong></td><td>0.852</td><td>normal</td></tr><tr><td>0.918</td><td><strong>0.005</strong></td><td><strong>0.999</strong></td><td>0.918</td><td>0.956</td><td>anomaly</td></tr><tr><td rowspan="2">10</td><td>0.994</td><td>0.08</td><td>0.751</td><td>0.994</td><td>0.856</td><td>normal</td></tr><tr><td>0.92</td><td>0.006</td><td>0.998</td><td>0.92</td><td>0.958</td><td>anomaly</td></tr><tr><td rowspan="2">11</td><td><strong>0.995</strong></td><td>0.091</td><td>0.726</td><td><strong>0.995</strong></td><td>0.839</td><td>normal</td></tr><tr><td>0.909</td><td><strong>0.005</strong></td><td><strong>0.999</strong></td><td>0.909</td><td>0.952</td><td>anomaly</td></tr><tr><td rowspan="2">12</td><td>0.994</td><td><strong>0.075</strong></td><td><strong>0.762</strong></td><td>0.994</td><td><strong>0.863</strong></td><td>normal</td></tr><tr><td><strong>0.925</strong></td><td>0.006</td><td>0.998</td><td><strong>0.925</strong></td><td><strong>0.96</strong></td><td>anomaly</td></tr><tr><td rowspan="2">13</td><td>0.993</td><td>0.077</td><td>0.757</td><td>0.993</td><td>0.859</td><td>normal</td></tr><tr><td>0.923</td><td>0.007</td><td>0.998</td><td>0.923</td><td>0.959</td><td>anomaly</td></tr><tr><td rowspan="2">14</td><td>0.994</td><td>0.087</td><td>0.734</td><td>0.994</td><td>0.844</td><td>normal</td></tr><tr><td>0.913</td><td>0.006</td><td>0.998</td><td>0.913</td><td>0.954</td><td>anomaly</td></tr></tbody></table>

We can see from table 4 that AHC algorithm could get best performance by selecting 12 features. And for F-measure, both normal and anomaly could achieve highest value when using 12 selected features.
# 5 Conclusion

This paper has presented a feature grouping method based on agglomerative hierarchical clustering method. It described how to compose the group by hierarchical tree, how to get the number of groups and how to select features in each group. First of all, the mutual information between each pair of two features is calculated to be used to construct the hierarchical tree. Moreover, the proposed algorithm creates groups by a given number. Finally, the mutual information between a feature and class labels is used to select one feature in one group. Experiment results on KDD 99 dataset indicate that the proposed approach generally outperforms DMIFS, MMIFS, and FGMI algorithm. Furthermore, the comparison by different number of features shows that 12 features could get best performance indicator.

Whilst promising, the presented work opens avenues for further investigation. For instance, the mutual information between features and class labels can be used to design new algorithm. And other clustering or classification algorithms can be applied to compose groups. Moreover, more than one feature could be selected in a certain group. In future work, the proposed algorithm will be tested on other datasets and look for more effective measures or methods than mutual information theory.

# Reference

1. Hyun Jin Kim, Hong-Sik Kim, Sungho Kang, A memory-efficient bit-split parallel string matching using pattern dividing for intrusion detection systems, *IEEE Transactions on Parallel and Distributed Systems* 22(11): 1904-1911, 2011.

2. P. García-Teodoroa, J. Díaz-Verdejoa, G. Macía-Fernaández, E. Vaázquez, Anomaly-based network intrusion detection: Techniques, systems and challenges, *computers & security* 28:18-28, 2009.

3. Shi-Jinn Horng, Ming-Yang Su, Yuan-Hsin Chen, Tzong-Wann Kao, Rong-Jian Chen, Jui-Lin Lai, Citra Dwi Perkasa, A novel intrusion detection system based on hierarchical clustering and support vector machines, *Expert Systems with Applications* 38: 306-313, 2011.

4. V. Bolón-Canedo, N. Sánchez-Maroño, A. Alonso-Betanzos, Feature selection and classification in multiple class datasets: An application to KDD Cup 99 dataset, *Expert Systems with Applications* 38: 5947-5957, 2011.

5. Tarek S. Sobh., Anomaly Detection Based on Hybrid Artificial Immune Principles, *Information Management & Computer Security*, 21 (14): 1-25, 2013.

6. Mehdi, M., Zair, S., Anou, A., and Bensebti, M., A Bayesian Networks in Intrusion Detection Systems, *Journal of Computer Science*, 3 (5): 259-265, 2007.

7. Suthaharan Shan and Vinnakota Karthik., An approach for automatic selection of relevance features in intrusion detection systems, in *Proc. of the 2011 International Conference on Security and Management*, pp. 215-219, 2011.

8. Battiti, R., "Using mutual information for selecting features in supervised neural net learning", *IEEE Transactions on Neural Networks*, pp.537-550, 1994.

9. Huawen Liu, Jigui Suna, Lei Liu, Huijie Zhang., Feature selection with dynamic mutual in-
formation, *Pattern Recognition* 42: 1330-1339, 2009.

10. La The Vinh, Sungyoung Lee, Young-Tack Park, Brian J. d'Auriol., A novel feature selection method based on normalized mutual information, *International Journal of Artificial Intelligence, Neural Networks, and Complex Problem-Solving Technologies*, 37(1): 100-120, 2012.

11. Amuthan Prabakar Muniyandia, R. Rajeswarib, R. Rajaramc., Network Anomaly Detection by Cascading K-Means Clustering and C4.5 Decision Tree algorithm, *International Conference on Communication Technology and System Design*, pp. 174-182, 2012.

12. Chebrolu, S., Abraham, A., & Thomas, J. P.. Feature deduction and ensemble design of intrusion detection systems, *Journal of Computers & Security*, 24(4): 295–307, 2005.

13. Mukkamala, S., & Sung, A. H.. Feature ranking and selection for intrusion detection systems using support vector machines, *In International conference on information and knowledge engineering (ICIKE)*, pp.503–509, 2002.

14. Shih-Wei Lin, Kuo-Ching Ying, Chou-Yuan Lee, Zne-Jung Lee, An intelligent algorithm with feature selection and decision rules applied to anomaly intrusion detection, *Applied Soft Computing* 12: 3285–3290, 2012.

15. Fatemeh Amiri, MohammadMahdi Rezaei Yousefi, Caro Lucas, Azadeh Shakery, Nasser Yazdani, Mutual information-based feature selection for intrusion detection systems, *Journal of Network and Computer Applications* 34: 1184–1199, 2011.

16. Seung-Joon Oh, Jae-Yearn Kim, A hierarchical clustering algorithm for categorical sequence data, *Information Processing Letters* 91: 135–140, 2004.

17. Rudi L.Cilibrasi, Paul M.B. Vitanyi, A fast quartet tree heuristic for hierarchical clustering, *Pattern Recognition* 44 : 662–677, 2011.

18. Ivan Kojadinovic, Agglomerative hierarchical clustering of continuous variables based on mutual information, *Computational Statistics & Data Analysis* 46: 269–294, 2004.

19. Linet Özdamar, Onur Demir, A hierarchical clustering and routing procedure for large scale disaster relief logistics planning, *Transportation Research Part E* 48: 591–602, 2012.

20. Xianglong Liu, Bo Lang, Yi Xu, Bo Cheng, Feature grouping and local soft match for mobile visual search, *Pattern Recognition Letters* 33: 239–246, 2012.

21. Kayacik, H. G., Zincir-Heywood, A. N., & Heywood, M. I., Selecting features for intrusion detection: A feature relevance analysis on KDD 99 intrusion detection datasets, *In Proceedings of the third annual conference on privacy, security and trust*, 2005.

22. Jaeik Cho, Changhoon Lee, Sanghyun Cho, Jung Hwan Song, Jongin Lim, Jongsub Moonam, A statistical model for network data analysis: KDD CUP 99' data evaluation and its comparing with MIT Lincoln Laboratory network data, *Simulation Modelling Practice and Theory*, 18: 431–435, 2010.

23. Mahbod Tavallaee, Ebrahim Bagheri, Wei Lu, and Ali A. Ghorbani, A Detailed Analysis of the KDD CUP 99 Data Set, *Proceedings of the Second IEEE Symposium on Computational Intelligence for Security and Defence Applications 2009*.

24. Jingping Song, Zhiliang Zhu, Peter Scully, Chris Price., Modified Mutual Information-based Feature Selection for Intrusion Detection Systems in Decision Tree Learning, *Journal of computers*, 9(7): 1542-1546, 2014.