## 4 Methodology  
Two phases are required to be undertaken in developing the proposed robust \(T^{2}\) chart based on the MRCD estimator. Phase I is building a typical profile from the in-control, while Phase II detects intrusion using the calculated statistics and control limit from Phase II. Phase I must calculate the mean vector, covariance matrix, and bootstrap control limit. The procedure of Phase I is shown as following these steps: \begin{tabular}{l} \hline \hline
**Phase I: Normal Profile Construction** \\ Step 1. & Form the in-control or normal data matrix \(\mathbf{X}_{normal}\) \\ Step 2. & Calculate \(\overline{\pi}_{MRCD}\) and \(\mathbf{S}_{MRCD}\), which are the robust estimated values of normal data \\ \(\mathbf{X}_{normal}\) using the MRCD algorithm in Equations (7) and (8) \\ Step 3. & Calculate \(T^{2}_{MRCD;i}\) using Equation (9) from normal data \(\mathbf{X}_{normal}\) \\ Step 4. & Determine \(\alpha\) and compute the bootstrap control limit \(CL_{B;MRCD}\) \\ \hline \hline \end{tabular}   
Then, the estimated normal profile and control limit from Phase I are utilized for the Phase II detection process. The steps of Phase II are shown as follows: \begin{tabular}{l} \hline \hline
**Phase II: Detection** \\ Step 1. & Form a new data matrix \(\mathbf{X}_{test}\) \\ Step 2. & Calculate \(T^{2}_{MRCD;i}\) from new data \(\mathbf{X}_{normal}\) as follows: \\ \(T^{2}_{MRCD;i}\)= \((\mathbf{x}_{test}-\overline{\pi}_{MRCD})^{T}\mathbf{\mathsf{S}}^{-1}_{MRCD}(\mathbf{x}_{ test;i}-\overline{\pi}_{MRCD})\) \\ where \(\overline{\pi}_{MRCD}\) and \(\mathbf{S}_{MRCD}\) are taken from Phase I \\ Step 3. & Detect if \(T^{2}_{MRCD;i}>CL_{B;MRCD}\) then the observation is labeled as an intrusion, and if \\ \(T^{2}_{MRCD;i}\leq CL_{B;MRCD}\) then the observation is labeled as normal \\ \hline \hline \end{tabular}   
Moreover, the evaluation of the proposed system can be conducted using the confusion matrix presented in Table 2. The assessment of classification effectiveness is determined by the degree of goodness and degree of error. In the context of intrusion detection, goodness is categorized into two types:  
1. True Positives (TPs) are intrusion records that are successfully detected as intrusions. 2. True Negatives (TNs) are normal records that are correctly stated as normal. \begin{tabular}{l c c} \hline \hline \multicolumn{1}{c}{\multirow{2}{*}{**Actual**}} & \multicolumn{2}{c}{**Detection**} \\ \cline{2-3} \cline{3-4}  & **Intrusion** & **Normal** \\ \hline Intrusion & True Positives (TPs) & False Negatives (FNs) \\ Normal & False Positives (FPs) & True Negatives (TNs) \\ \hline \hline \end{tabular}   
The errors in detecting intrusion also can be divided into two types:  
1. False Positives (FPs) are normal records that are incorrectly detected as intrusions. 2. False Negatives (FNs) are intrusion records that are unsuccessfully detected as normal. FPs led to a false alarm, while FNs result in undetected chart intrusions. These error types can be used to calculate the degree of error, namely FP Rate and FN Rate [43]. The level of goodness can be measured using the Area Under Curves (AUC) as follows [44]:  
\[AUC=\frac{1}{2}\bigg{(}\frac{TP}{TP+FN}+\frac{TN}{TN+FP}\bigg{)} \tag{10}\]  
\begin{table} \begin{tabular}{c c c c} \hline \hline \multicolumn{1}{c}{\multirow{2}{*}{**Phase II: Detection**}} & \multicolumn{2}{c}{**Phase II: Detection**} \\ Step 1. & Form a new data matrix \(\mathbf{X}_{test}\) \\ Step 2. & Calculate \(T^{2}_{MRCD;i}\) from new data \(\mathbf{X}_{normal}\) as follows: \\ \(T^{2}_{MRCD;i}\)= \((\mathbf{x}_{test}-\overline{\pi}_{MRCD})^{T}\mathbf{\mathsf{S}}^{-1}_{MRCD}(\mathbf{x}_{ test;i}-\overline{\pi}_{MRCD})\) \\ where \(\overline{\pi}_{MRCD}\) and \(\mathbf{S}_{MRCD}\) are taken from Phase I \\ Step 3. & Detect if \(T^{2}_{MRCD;i}>CL_{B;MRCD}\) then the observation is labeled as an intrusion, and if \\ \(T^{2}_{MRCD;i}\leq CL_{B;MRCD}\) then the observation is labeled as normal \\ \hline \hline \end{tabular}