## 3 The Proposed Approach of SCDNN
### The SCDNN Algorithm
This is an efficient way to improve detection rate accuracy. Experimental results show that the SCDNN performs better than SVM, BPNN, RF and Bayesian methods, with the best accuracy rates over the six datasets derived from the KDDCUP99 and NSL-KDD. Additionally, the proposed algorithm is more capable of classifying sparse attack cases and effectively improves detection accuracy in real security systems. However, the limitation of the SCDNN is that its weight parameters and the thresholds of each DNN layer need to be optimised, and the \(k\) and \(\sigma\) parameters of the clusters are determined empirically, not through mathematical theory, which deserves further study. This work has been supported by the National Natural Science Foundation of China (Grant No. 11361046 and 61602225). It also has been supported by the Key Research Fund of Ningxia Normal University (Grant No. NXSFZD1517, NXSFZD1603 and NXSFZD1608), the Natural Science Fund of Niygaia (Grant No. NZ16260) and the Fundamental Research Fund for Senior School in Ningxia province (Grant No. NGY2015124). [PERSON] and [PERSON] conceived and designed the experiments based on the benchmark KDD'99 and NSL-KDD datasets. In addition, [PERSON] wrote and partially revised the manuscript. [PERSON] implemented the SCDNN algorithm and analysed the experimental results. [PERSON] optimised the experiments. The authors declare no conflict of interest. The following abbreviations are used in this manuscript: \begin{tabular}{l l} SVM & Support Vector Machine \\ SOM & Self-Organizing Map \\ ANN & Artificial Neural Networks \\ RF & Random Forest \\ DNN & Deep Neural Network \\ PSO & Particle Swarm Optimization \\ KNN & \(K\)-Nearest Neighbour \\ IDS & Intrusion Detection System \\ SGD & Stochastic Gradient Descent \\ DoS & Denial of service \\ R2L & Remote to Local \\ U2R & User to Root \\ ER & Error Rate \\ TN & True Negative \\ TP & True Positive \\ FP & False Positive \\ FN & False Negative \\ \end{tabular} 

## References

* (1) [PERSON]; [PERSON] Research on Intrusion Detection and Response: A Survey. _Int. J. Netw. Secur._**2005**, \(1\), 84-102. * (2) [PERSON]; [PERSON]; [PERSON] Detecting Novel Network Intrusions Using Bayes Estimators. In Proceedings of the First SIAM International Conference on Data Mining, Chicago, IL, USA, 5-7 April 2001; pp. 1-17. * (3) [PERSON] An intrusion-detection model. _IEEE Trans. Softw. Eng._**1987**, _SE-13_, 222-232. * (4) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Data mining for network intrusion detection. In Proceedings of the NSF Workshop on Next Generation Data Mining, Baltimore, MD, USA, 1-3 November 2002; pp. 21-30. * (5) [PERSON]; [PERSON]; [PERSON] Application of SVM and ANN for intrusion detection. _Comput. Oper. Res._**2005**, _32_, 2617-2634. * (6) [PERSON]; [PERSON]; [PERSON] Random-forests-based network intrusion detection systems. _IEEE Trans. Syst. Man Cybern. C Appl. Rev._**2008**, _38_, 649-659. * (7) [PERSON]; [PERSON]; [PERSON]; [PERSON] Intrusion detection by machine learning: A review. _Expert Syst. Appl._**2009**, _36_, 11994-12000. * (8) [PERSON] Network security basics. _IEEE Secur. Priv._**2005**, \(3\), 68-72. * (9) [PERSON]; [PERSON] A fuzzy anomaly detection system based on hybrid pso-kmeans algorithm in content-centric networks. _Neurocomputing_**2015**, _149_, 1253-1269. * (10) [PERSON]; [PERSON]. A novel SVM-kNN-PSO ensemble method for intrusion detection system. _Appl. Soft Comput._**2016**, _38_, 360-372. * (11) [PERSON]; [PERSON]; [PERSON]; [PERSON] A Deep Learning Approach for Network Intrusion Detection System. In Proceedings of the 9 th EAI International Conference on Bio-inspired Information and Communications Technologies (formerly BIONETICS), New York, NY, USA, 3-5 December 2015; pp. 21-26. * (12) [PERSON]; [PERSON] Intrusion Detection System Using Deep Neural Network for In-Vehicle Network Security. _PLoS ONE_**2016**, _11_, e0155781. * (13) [PERSON]; [PERSON]; [PERSON]; [PERSON] [PERSON] Network anomaly detection with the restricted Boltzmann machine.