# A New Method of Fuzzy Support Vector Machine Algorithm for Intrusion Detection
## 4 Experimental Evaluation
### The Experimental Performance
Since this method looks the frequency of rare system calls, the \(\rho_{MR}\) of Uniqueness method is 55.3% and the \(p_{FAR}\) is 2.3%. However, this requires statistics for all the system calls that are used. N.bayes belongs to Naive Bayesian method in essence, and it has good noise tolerance and fast calculation, but the false alarm rate is too high. Therefore, the comprehensive detection performance is good. The closeness method extracts user behavior patterns from the perspective of combination. It shows good detection performance under different closeness thresholds, but it ignores the characteristics of attack intensity. That is, the attacker will complete the attack task in the shortest possible time and try to behave normally the rest of the time. As show in Figure 11, our algorithm has the highest comprehensive detection rate 86.92% among five algorithms. In all the algorithms, our algorithm has the highest detection rate, and the lowest false alarm rate and missing rate. The formula of the comprehensive detection rate is closer to reality. The comprehensive detection rate of N.bayes, Uniqueness, Hybrid Markov, Bayes1-step Markov, IPMA, Sequence matching, Compression, Closeness, and our algorithm are 62%, 36.91%, 39.13%, 60.03%, 41.63%, 34.82%, 28.47%, 73.22%, and 86.92% respectively. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Algorithm** & **Detection Rate (\%)** & **Missing Rate (\%)** & **False Alarm Rate (\%)** \\ \hline N.bayes & 65.11\% & 30.12\% & 4.77\% \\ Uniqueness & 39.1\% & 55.3\% & 2.30\% \\ Hybrid Markov & 45.6\% & 40.22\% & 14.26\% \\ Bayes1-step Markov & 62.6\% & 33.3\% & 4.1\% \\ IPMA & 45.05\% & 47.37\% & 7.58\% \\ Sequence matching & 36.7\% & 58.2\% & 5.91\% \\ Compression & 33.9\% & 50.1\% & 16\% \\ Closeness & 76.5\% & 19.2\% & 4.3\% \\ Our algorithm & 92.63\% & 7.37\% & 6.16\% \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Comparison between different algorithms on UNM_live_lp. Table 6 summarizes the comparison results of detection performance between our method and the other eight methods on UNM_sendmail. The detection rates of N.bayes, Uniqueness, Hybrid Markov, Bayes1-step Markov, IPMA, Sequence matching, Compression, Closeness, and our algorithm are 63.88%, 37.4%, 45.3%, 67.3%, 40.63%, 35.9%, 29.7%, 75.2%, and 84.61% respectively. The missing rates of N.bayes, Uniqueness, Hybrid Markov, Bayes1-step Markov, IPMA, Sequence matching, Compression, Closeness, and our algorithm are 32.12%, 60.3%, 40.44%, 30.8%, 42.37%, 60.2%, 50.5%, 20.1%, and 15.39% respectively. The false alarm rates of N.bayes, Uniqueness, Hybrid Markov, Bayes1-step Markov, IPMA, Sequence matching, Compression, Closeness, and our algorithm are 4%, 2.30%, 14.26%, 1.9%, 17%, 3.9%, 19.8%, 4.7%, and 4.51% respectively. Similarly, the Compression method and Sequence Matching method pay attention to reversibility and similarity matching degree, respectively, and fail to consider the sequence characteristic between system calls. The IPMA method and Hybrid Markov method are complicated due to investigating transition characteristics of system calls one by one. Although the \(\rho_{FAR}\) of IPMA method and Hybrid Markov method is 17% and 14.26%, the \(\rho_{MR}\) is 42.37% and 40.44%. The \(\rho_{MR}\) of Bayes 1-step Markov method is 30.8%, and the \(\rho_{FAR}\) is 1.9%. The comprehensive test performance evaluation formula has a high value, so the test performance is good. Since this method looks at the frequency of rare system calls, the \(\rho_{MR}\) of Uniqueness method is 60.3%, and the \(\rho_{FAR}\) is 2.3%. However, this requires statistics for all the system calls that are used. N.bayes belongs to Naive Bayesian method in essence, and it has good noise tolerance and fast calculation, but the false alarm rate is too high. Therefore, the comprehensive detection performance is good. The closeness method extracts user behavior patterns from the perspective of combination. It shows good detection performance under specific closeness thresholds, but it ignores the characteristics of attack intensity.