## 3 The Proposed Approach of SCDNN
### The SCDNN Algorithm
In the above, higher accuracy and recall and lower ER indicate good performance. ### The Dataset

To evaluate the performance of our proposed approach, a series of experiments on the KDD-CUP-99 [31] and NLS-KDD datasets [22] were conducted. The 10% knowledge KDD-CUP-99 datasets are used in these experiments, as it is most comprehensive dataset that is widely used as a benchmark for the performance intrusion detection network models. Each record contains 41-dimensional feature data that of various continuous, discrete and symbolic type. This is unsuitable for network data records because it includes four attack categories (DoS, probe, R2L and U2R) [45]. In order to solve the above problem, pre-trained data are processed in three steps. First, the values of three symbolic features are mapped as a series of numeric values ranging from 1 to \(N\), where \(N\) is the total number of symbols for each feature. Second, the KDD'99 dataset includes five classes, normal, DoS, probe, U2R, and R2L, which were mapped onto the numeric values 1-5, respectively [46]. Finally, because of the range of values of field columns of src_bytes and dst_bytes are quite different, in order to find more patterns and more easily handle the proposed method, the range of values of these two fields are mapped onto 0-5000. After data pre-processing, the total number of dataset features was transformed to 65. The NLS-KDD dataset includes the KDDTrain+, KDDTTest+ and KDDTTest-21 subsets, which are used for this experiment because the KDD-CUP-99 datasets contain more frequent and harmful attack records. The NLS-KDD dataset has removed surplus records and is more suitable to evaluating the real-world performance of an intrusion detection algorithm. In order to fairly compare the capability of each algorithm, six datasets were randomly generated from the two KDD-CUP-99 and NSL-KDD datasets, which reduces the amount of data [47]. These are labelled Datasets 1 through 6. Probe, U2R and R2L attack classes occur with low frequency in the raw dataset, so these three types were manually distributed, whereas normal and DoS records were randomly selected based on three scales with 1%, 5% and 10% of total in the KDD-CUP-99 dataset, labelled Dataset 1-3, respectively [48]. For the NLS-KDD dataset, the three data subsets are generated from two training and two testing sets and designated Datasets 4-6. The training sets randomly selected 20% and 50% of the raw dataset, and the testing sets are KDDTest+ and KDDTest-21, respectively. Table 1 describes the six new datasets in detail. The training data of the six datasets include 24 attack types, and the testing data contain 38 attack types. Therefore, the test dataset includes specific attack types which are not presented in the training dataset, which is closer to the actual condition of network intrusion. In this way, we can evaluate the ability of each model to find new attack types. The six new datasets are used to evaluate the performance of the SCDNN and to compare it to the other detection methods previously mentioned. In addition, these experiments evaluate model performance for one of the novel network architectures arising in today's networking environment, such as ad hoc wireless networks, WSNs and wireless mesh networks. These networks have developed rapidly and are easier to attack than wired networks. In order to determine the detection performance of the proposed model in WSNs, the following experiments were carried out [49]. ### SCDNN Experiment I

In this section, the number of clusters \(k\) in SCDNN is evaluated on the six datasets, because the values of \(k\) and \(\sigma\) (a parameter of SC), are different in each dataset. \(k\) and \(\sigma\) have a serious impact on the precision of SCDNN results. Next, the testing datasets are used to compare the performance of the remaining five models. #### 4.3.1 Efficiency of Varied Cluster Numbers and Values of \(\sigma\)

The SCDNN algorithm is composed of three steps.