# A New Method of Fuzzy Support Vector Machine Algorithm for Intrusion Detection
## 4 Experimental Evaluation
### The Experimental Performance
The algorithm proposed in this paper has the highest comprehensive detection rate and the strongest detection performance. The comprehensive detection performance of FSVM1 algorithm, FSVM2 algorithm and FSVM3 algorithm also varies with the fuzzy membership function, but the overall trend is consistent with the test results obtained from UNM_live_lpr process data, that is, the detection performance is improved with the improvement of fuzzy membership function. As shown in Tables 3 and 4, the length of the system call short sequence \(k\) has a direct impact on the detection performance. When \(k\) increases from 3 to 5, the detection rate, missing alarm rate and false alarm rate are increasing. When \(k\) is 6, our algorithm obtains the highest detection rate, the lowest false alarm rate and the lowest missing rate. When \(k\) is greater than 6, the detection rate of our algorithm starts to decrease, and the missing rate and false alarm rate start to increase. On UNM_sendmail data, the detection rate, false alarm rate, and missing alarm rate of PVFSVM algorithm have the same trend as on UNM_live_lpr data. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Algorithm** & **Detection Rate (\%)** & **Missing Rate (\%)** & **False Alarm Rate (\%)** \\ \hline SVM & 61.53\% & 38.47\% & 10.14\% \\ FSVM1 & 76.92\% & 23.08\% & 9.57\% \\ FSVM2 & 76.92\% & 23.08\% & 8.17\% \\ FSVM3 & 83.21\% & 16.23\% & 6.92\% \\ Our algorithm & 84.61\% & 15.39\% & 4.51\% \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Performance comparison on data set UNM_sendmail. Figure 8: Performance comparisons on UNM_sendmail data set. This is consistent with professor [PERSON]'s conclusion on the selection of short sequence length, and professor [PERSON]'s conclusion from the perspective of information theory that the best system call short sequence length is 6 or 7. Compared with the value of k of 6, when the value of short sequence is too small, the timing relation between short sequence patterns is lost. When the short sequence becomes longer, the short sequence pattern loses local information, no matter what kind of information loss will make the comprehensive detection performance worse. Therefore, the short sequence length can only be chosen as 6, which makes the detection performance of our algorithm reach the optimal level. Table 5 summarizes the comparison results of detection performance between our method and the other eight methods on UNM_live_lp. The detection rate of N.bayes, Uniqueness, Hybrid Markov, Bayes1-step Markov, IPMA, Sequence matching, Compression, Closeness, and our algorithm are 65.11%, 39.1%, 45.6%, 62.6%, 45.05%, 36.7%, 33.9%, 76.5%, and 92.63% respectively. The missing rates of N.bayes, Uniqueness, Hybrid Markov, Bayes1-step Markov, IPMA, Sequence matching, Compression, Closeness, and our algorithm are 30.12%, 55.3%, 40.22%, 33.3%, 47.37%, 58.2%, 50.1%, 19.2%, and 7.37% respectively. The false alarm rates of N.bayes, Uniqueness, Hybrid Markov, Bayes1-step Markov, IPMA, Sequence matching, Compression, Closeness, and our algorithm are 4.77%, 2.30%, 14.26%, 4.1%, 7.58%, 5.91%, 16%, 4.3%, and 6.16% respectively. These two methods, Compression method and Sequence Matching method, respectively consider the detection problem from the aspect of data reversibility and similarity matching degree, and fail to consider the sequence characteristics between system calls. Therefore, they are the two algorithms with the worst comprehensive detection performance. The IPMA method and Hybrid Markov method are complicated due to investigating the transition characteristics of system calls one by one. Although the \(\rho_{FAR}\) of IPMA method and Hybrid Markov method are 7.58% and 14.26%, the \(\rho_{MR}\) is 47.37% and 40.22%. The \(\rho_{MR}\) of Bayes 1-step Markov method is 33.3% and the \(p_{FAR}\) is 4.1%. The comprehensive test performance evaluation formula has a high value, so the test performance is good.