## 4 Experiment Results and Discussion
### Dataset Description  
NSL-KDD dataset ([[http://www.unb.ca/research/iscx/dataset/iscx-NSL-KDD-dataset.html](http://www.unb.ca/research/iscx/dataset/iscx-NSL-KDD-dataset.html)]([http://www.unb.ca/research/iscx/dataset/iscx-NSL-KDD-dataset.html](http://www.unb.ca/research/iscx/dataset/iscx-NSL-KDD-dataset.html))) [35] is a new version of KDD Cup'99 dataset. The KDD Cup'99 contains train and test sets which are duplicated about 78% and 75% of the records, respectively. Thus, NSL-KDD dataset was redundant records in the train set and no duplicate records in new test sets. Besides, this dataset still remains 41 input features and 1 output feature. The input features include [_duration_, _protocol_type_, _service_, _flag_, _src_bytes_, _dst_bytes_, _land_, _wrong_fragment_, _urgent_, _hot_, _num_failed_logins_, _logged_in_, _num_compromised_, _root_shell_, _su_attempted_, _num_root_, _num_file_creations_, _num_shells_, _num_access_files_, _num_outbound_cnds_, _is_host_login_, _is_guest_login_, _count_, _srv_count_, _serro_rate_, _srv_error_rate_, _error_rate_, _srv_error_rate_, _same_sr_rate_, _diff_srv_rate_, _srv_diff_host_rate_, _dst_host_count_, _dst_host_sr_count_, _dst_host_same_srv_rate_, _dst_host_diff_srv_rate_, _dst_host_same_src_por_rate_, _dst_host_srv_diff_host_rate_, _dst_host_serro_rate_, _dst_host_serro_rate_, _dst_host_error_rate_, _dst_host_serro_rate_]. The output name is [_Attack_]. The output value consists of [ 'Normal', 'R2L', 'DoS, 'U2R', 'Probe']. As a result, several records in train and test sets are reasonable which makes it affordable to run the experiments on the complete set without the need to randomly select a small partition. The experiment uses KDDTest+ dataset file in learned models. In ISCX dataset ([[http://www.unb.ca/cic/research/datasets/ids.html](http://www.unb.ca/cic/research/datasets/ids.html)]([http://www.unb.ca/cic/research/datasets/ids.html](http://www.unb.ca/cic/research/datasets/ids.html))), the real-life dataset was created by collecting network traffic data for several consecutive days. ISCX in 2012 is a real-life dataset that builds on the concept of profiles which include details on intrusions. This dataset is created by [PERSON], et al. [36]. This dataset was designed specifically for developing, testing, and evaluating network intrusion and anomaly detection algorithms. It uses two profiles, \(\alpha\) and \(\beta\), during the generation of the datasets. The \(\alpha\) profiles were constructed using the knowledge of specific traces. Real packet traces were analyzed to create \(\alpha\) and \(\beta\) profiles for agents that generated real-time traffic for HTTP, SMTP, SSH, IMAP, POP3, and FPT protocols. Various multi-stage attack scenarios were explored to generate malicious traffic. This dataset consists of seven days of network activities, both normal and malicious. A pcap extension file (*pcap) and XML extension file (*xml) are two extension files. In data preparation, the ready-made training and testing datasets are not available in the original dataset, and it is difficult to perform experiments on huge data (*pcap files). Hence, the file \"labelled_flows_xml\" which contained flow information in XML format for each day are used. Furthermore, the labeled flow file supports the use of supervised machine learning algorithms. The flows were generated using IBM WRadar appliance. The flow file was labeled with \"Normal\" and \"Attack\". The [_Tag_] feature indicates whether the flow is normal or part of an attack scenario. However, all flows from day 1-Friday (11 June 2010) were normal; therefore no flow XML file was included. The XML files contained 19 attributes for input values and one attribute for the output value.