# A Lightweight Perceptron-Based Intrusion Detection System for Fog Computing
## 4 Experimental Setup
### ADFA-LD and ADFA-WD Dataset  
Collecting and generating system call traces in a large scale for research purposes in not a simple task, and the number of datasets available for IDS evaluation is limited. Recently, [PERSON] et al. [35; 36] proposed ADFA-LD and ADFA-WD datasets as a modern alternative to some of the outdated datasets. They showed that ADFA-LD has higher complexity level than some legacy datasets. [PERSON] and [PERSON] performed preliminary analysis of ADFA-LD [37; 38] and showed that Euclidean distance is not an effective metric to separate behaviors of some attacks from the normal behavior. Table 2 contains the distribution of the system call traces to normal and attack types in three groups of ADFA-LD and ADFA-WD. Python workbench was used for the evaluation of Modified Vector Space MVS demonstration on ADFA-LD and ADFA-WD datasets. The workbench can host multiple machine learning algorithms which can be utilized on the selected datasets with various term-size. Nine classification algorithms were selected from six different categories. A list of the algorithms selected, the options for individual algorithm and their respective categories are shown in [26]. The datasets were collected and then converted into MVS representation for various term-size. Term-sizes of 1 and 2 were selected for the experiment. For each dataset (i.e., ADFA-LD and ADFA-WD) the experiment was run for binary classification. One of two labels was considered for each trace--normal and attack. Each chosen algorithm was run with selected options on converted \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Dataset** & **No. of Traces ADFA-LD** & **No. of Traces ADFA-WD** & **Class of Traces** \\ \hline TRAINING\_DATA\_MASTER & 833 & 355 & Normal \\ VALIDATION\_DATA\_MASTER & 4372 & 1827 & Normal \\ ATTACK\_DATA\_MASTER & 746 & 5542 & Attack \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Australian Defense Force Academy Linux Dataset (ADFA-LD) and Australian Defense Force Academy Windows Dataset (ADFA-WD) composition based on binary classification of the types of system call traces. data through 10-fold cross-validation method. Table 2 describes the number of features extracted from ADFA-LD and ADFA-WD dataset for varying term-size using modified vector space representation. Comparing with previous benchmark datasets, ADFA-LD and ADFA-WD are much more representative of current cyber-attacks. Furthermore, they provide a more convincing and appropriate framework for intrusion detection system (IDS) development and performance evaluation. ADFA-LD contains thousands of traces of system calls, which are collected under a variety of scenarios to mimic real life circumstances. It consists of a comprehensive collection of system call traces representing recent system level vulnerabilities and attacks. ADFA-LD is generated from a Linux local server with Linux kernel 2.6.38, presenting a more modern and wildly used computer system. The attacks used in generating ADFA-LD include Hydra-FTP, Hydra-SSH, Adduser, Java-Meterpreter, Meter-preter, and Webshell, each of them generates 8 to 20 attack traces. Table 3 shows the number of collected traces for each type of attack. Moreover, technical details about the dataset can be found in [35]. ADFA-WD (Windows Dataset) shows the high-quality collection of DLL access requests and hacking attacks for a variety of system calls [30; 36]. It generally contains identified Windows-based vulnerability. Dataset was collected in Windows XP SP2 host with the help of Procmon program. Default firewall was used and Norton AV 2013 was enabled to ignore the low level attacks and filter only sophisticated attacks. The OS environment enabled file sharing and configured network printer. It was running different applications such as, webserver, FTP server, database server, etc. A total of 12 class labels, V1 to V12, of known vulnerabilities for installed applications were exploited with the help of Metasploit framework and other custom methods.