## 4 Methodology
  
Moreover, the evaluation of the proposed system can be conducted using the confusion matrix presented in Table 2. The assessment of classification effectiveness is determined by the degree of goodness and degree of error. In the context of intrusion detection, goodness is categorized into two types:  
1. True Positives (TPs) are intrusion records that are successfully detected as intrusions. 2. True Negatives (TNs) are normal records that are correctly stated as normal. \begin{tabular}{l c c} \hline \hline \multicolumn{1}{c}{\multirow{2}{*}{**Actual**}} & \multicolumn{2}{c}{**Detection**} \\ \cline{2-3} \cline{3-4}  & **Intrusion** & **Normal** \\ \hline Intrusion & True Positives (TPs) & False Negatives (FNs) \\ Normal & False Positives (FPs) & True Negatives (TNs) \\ \hline \hline \end{tabular}   
* The errors in detecting intrusion also can be divided into two types:  
1. False Positives (FPs) are normal records that are incorrectly detected as intrusions. 2. False Negatives (FNs) are intrusion records that are unsuccessfully detected as normal. FPs led to a false alarm, while FNs result in undetected chart intrusions. These error types can be used to calculate the degree of error, namely FP Rate and FN Rate [43]. The level of goodness can be measured using the Area Under Curves (AUC) as follows [44]:  
\[AUC=\frac{1}{2}\bigg{(}\frac{TP}{TP+FN}+\frac{TN}{TN+FP}\bigg{)} \tag{10}\]  
\begin{table} \begin{tabular}{c c c c} \hline \hline \multicolumn{1}{c}{\multirow{2}{*}{**Actual**}} & \multicolumn{2}{c}{**Detection**} \\ \cline{2-3} \cline{3-4}  & **Intrusion** & **Normal** \\ \hline Intrusion & True Positives (TPs) & False Negatives (FNs) \\ Normal & False Positives (FPs) & True Negatives (TNs) \\ \hline \hline \end{tabular}   
* The errors in detecting intrusion also can be divided into two types:
* False Positives (FPs) are normal records that are incorrectly detected as intrusions. * False Negatives (FNs) are intrusion records that are unsuccessfully detected as normal. * FPs led to a false alarm, while FNs result in undetected chart intrusions. These error types can be used to calculate the degree of error, namely FP Rate and FN Rate [43]. The level of goodness can be measured using the Area Under Curves (AUC) as follows [44]:  
\[AUC=\frac{1}{2}\bigg{(}\frac{TP}{TP+FN}+\frac{TN}{TN+FP}\bigg{)} \tag{11}\] \begin{table}
\begin{tabular}{c c c} \hline \hline \multicolumn{1}{c}{\multirow{2}{*}{**Phase II: Detection**}} & \multirow{2}{*}{
\begin{tabular}{c} **Phase II: Detection** \\ Step 1. & Form a new data matrix \(\mathbf{X}_{test}\) \\ Step 2. & Calculate \(T^{2}_{MRCD;i}\) from new data \(\mathbf{X}_{normal}\) as follows: \\ \(T^{2}_{MRCD;i}\)= \((\mathbf{x}_{test;i}-\overline{\pi}_{MRCD})^{T}\mathbf{\mathsf{S}}^{-1}_{MRCD}(\mathbf{x}_{ test;i}-\overline{\pi}_{MRCD})\) \\ where \(\overline{\pi}_{MRCD}\) and \(\mathbf{S}_{MRCD}\) are taken from Phase I \\ Step 3. & Detect if \(T^{2}_{MRCD;i}>CL_{B;MRCD}\) then the observation is labeled as an intrusion, and if \\ \(T^{2}_{MRCD;i}\leq CL_{B;MRCD}\) then the observation is labeled as normal \\ \hline \hline \end{tabular}  
* \end{table} 
Table 2: Confusion Matrix Table. \[FP\ Rate=\frac{FP}{TN+FP} \tag{11}\] \[FN\ Rate=\frac{FN}{TP+FN} \tag{12}\]