## 4 Experimental Simulations
### Dataset and Evaluation Criteria
Only _TP_ indicates that the system's classification result consists of abnormal attack data and the classification result is correct; _TN_ indicates that the system's classification result is positive and correct; _FP_ indicates that the system predicts the data as abnormal attack data although the classification result is wrong; _FN_ indicates that the system predicts the data as normal data although the classification result is incorrect. The classification results of the model for the data are represented by the confusion matrix, as shown in Table 6. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Classification** & **Predicted Positive Category** & **Predicted Negative Category** \\ \hline Actual Positive Category & _TP_ & _FN_ \\ Actual Negative Category & _FP_ & _TN_ \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Confusion matrix. \begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Dataset**} & \multicolumn{8}{c}{**Attack Behaviors**} & \multirow{2}{*}{**Total**} \\ \cline{2-2} \cline{4-10}  & **Normal** & **Fuzzers** & **Analysis** & **Backdoors** & **DoS** & **Exploits** & **Generic** & **Recon.** & **Shellcode** & **Worms** \\ \hline Train & 56,000 & 18,174 & 2000 & 1746 & 12,264 & 33,393 & 40,000 & 10,491 & 1133 & 130 & 175,341 \\ Test & 37,000 & 6062 & 677 & 583 & 4089 & 11,132 & 18,871 & 3496 & 378 & 44 & 82,332 \\ Total & 93,000 & 24,246 & 2677 & 2329 & 16,353 & 44,525 & 58,871 & 13,987 & 1511 & 174 & 257,673 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Distribution of different attack behaviors in the UNSW_NB15 dataset. \begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Dataset**} & \multicolumn{8}{c}{**Attack Behaviors**} & \multirow{2}{*}{**Total**} \\ \cline{2-2} \cline{4-10}  & **BENIGN** & **Dos** & **Portscan** & **Patator** & **Ddos** & **Bot** & **Attack** & **Infiltration** & **Heartbleed** & \\ \hline Train & 1,654,737 & 176,863 & 111,251 & 9685 & 89,619 & 2752 & 1526 & 25 & 7 & 2,046,465 \\ Test & 709,173 & 75,798 & 47,679 & 4150 & 38,408 & 1180 & 654 & 11 & 4 & 877,057 \\ Total & 2,363,910 & 252,661 & 158,930 & 13,835 & 128,027 & 3932 & 2180 & 36 & 11 & 2,923,522 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Distribution of different attack behaviors in the CIC-IDS2017 dataset. _Accuracy_ describes the ratio of the number of correct samples predicted to the total number of samples and is calculated as follows:  
\[Accuracy=\frac{TP+TN}{TP+FP+TN+FN} \tag{7}\]  
_Precision_ describes the ratio of the number of classes predicted to be positive to the number of classes actually predicted to be positive, calculated as follows. \[Precision=\frac{TP}{TP+FP} \tag{8}\]  
_Recall_ describes the ratio of the number of predicted positive classes that are actually positive to the number of all positive classes and is calculated as follows. \[Recall=\frac{TP}{TP+FN} \tag{9}\]  
\(F_{1}-score\) describes the magnitude of the harmonic mean between precision and recall, calculated as follows. \[F_{1}-score=\frac{2\times recall\times precision}{recall+precision} \tag{10}\]  
It can be seen that \(F_{1}\) achieves larger values when both recall and precision have larger values.