## 4 Evaluation Methodology
### Result of Binary Decoding with Other Intrusion Detection Dataset: NSL-KDD, CIC-IDS2017  
The kddcup99 is a commonly used dataset for benchmarking IDS detection performance. Other datasets are the NSL-KDD and CIC-IDS 2017 datasets [49]. The NSL-KDD is an updated and improved dataset of the existing KDD99 dataset. The basic structure is the same as KDD99. The CIC-IDS 2017 dataset contains normal and the most up-to-date common attacks, which resembles the true real-world data (PCAPs). It also includes labeled flows based on the time stamp, source and destination IPs, source and destination ports, protocols, and attack. For machine learning model benchmarking, MachineLearn \begin{table}
\begin{tabular}{l l l} \hline \hline
**Algorithm** & **Selected Feature** & **Length** \\ \hline \multirow{8}{*}{Proposed} & \multirow{8}{*}{protocol\_type} & srv\_error\_rate & \\  & protocol\_type & srv\_diff\_host\_rate & \\  & flag & dst\_host\_count & \\  & wrong\_fragment & dst\_host\_same\_srv\_rate & \\  & logged\_in & dst\_host\_diff\_srv\_rate & \\  & root\_shell & dst\_host\_same\_src\_port & 18 \\  & num\_outbound & \_rate & \\  & \_cmds & dst\_host\_srv\_diff & \\  & srv\_server\_rate & \_host\_rate & \\  & error\_rate & dst\_host\_srv\_server\_rate & \\  & & dst\_host\_srv\_error\_rate & \\ \hline \multirow{8}{*}{wrapper-DR} & \multirow{8}{*}{protocol\_type} & rror\_rate & \\  & protocol\_type & srv\_diff\_host\_rate & \\  & flag & dst\_host\_count & \\  & wrong\_fragment & dst\_host\_srv\_count & \\  & urgent & dst\_host\_same\_srv & \\  & hot & \_rate & \\  & num\_failed\_logins & dst\_host\_same\_src & \\  & num\_compromised & \_port\_rate & \\  & root\_shell & dst\_host\_server\_rate & \\  & is\_guest\_login & dst\_host\_rerror\_rate & \\  & count & dst\_host\_srv\_error & \\  & & \_rate & \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Result of selected features by feature selection. ingCSV.zip is provided separately, and we conducted additional experiments with this dataset. MachineLearningCSV consists of 78 features excluding class labels. A dataset consisting of 104,255 records sampled from 10% of the entire dataset was used. The training set and the test set were split at a ratio of 9:1. To verify the feature selection performance from high-dimensional data, the proposed method based on binary decoding and the wrapper-DR method were compared. Table 8 shows the results of experiments with the CIC-IDS 2017 and NSL-KDD datasets. For the CIC-IDS 2017 dataset, the proposed method showed an F1-measure of 0.9511(CIC-IDS)/0.9523(NSL-KDD), 0.1952/0.3165 points higher than wrapper-DR's 0.5840, and showed better performance in all performance metrics except detection rate than wrapper-DR. Figure 16 shows the experimental results as a bar chart. In experiments on the CIC-IDS 2017 dataset, which has a higher dimension (more features) than the kddcup99 dataset, it was found that the proposed method showed a larger performance difference. It was confirmed that the proposed fitness function method was designed so that the optimization algorithm could search for the optimal feature set even in a large-dimensional dataset. Table 9 shows the feature set results selected by the method proposed in the CIC-IDS 2017 dataset and the wrapper-DR method. In this paper, since the fitness function is important in using GA, a more suitable fitness function for the detection system was studied, proposed, and verified through various experiments and performance indicators. In the relatively high-dimensional CIC-IDS2017 dataset, the proposed algorithm showed a more significant performance improvement than in the low-dimensional data [11]. Modern security datasets are becoming more and more dimensional, so analysis using all features is increasingly difficult. If a detection model is built with an optimized dataset composed of key features, it is possible to secure detection performance and real-time detection speed performance in operation.