## 3 The Proposed IDS Framework
This proposed model can solve the high-dimensional data leading to the curse of dimensionality phenomenon in big data. The main reason reduces accuracy performance prediction because of this problem. In order to solve this issue, input patterns need to be reduced the dimensionality. SFSDT Algorithm 1 is started from the empty set, sequentially add the features \(x^{+}\) that results in the highest accuracy score of the DT model. The accuracy of the DT model on the validation dataset (feature subset) is the maximum value. This reduces the number of features which is likely due to a decrease of the curse of dimensionality. Figure 2: The feature selection concept. * **Input**. The input of SFSDT algorithm is the set of all features, denoted by \(Y=y_{1},y_{2},...,y_{d}\) and the output of class data is the type of each attach in each dataset, denoted by \(output\_class\). The SFSDT algorithm takes the whole \(d\)-dimensional feature set as input. The \(output\_class\) is actual output which used in DT model to compare the predicted class of DT model. After that, DT can measure accuracy and error scores corresponds to each subset feature generated. * **Output**. Feature subsets, accuracy_scores, and error_scores are output values. Feature subset is denoted by \(Y_{k}\), \(Y_{k}=y_{j}|j=1,2,...,k\), where \(k=(0,1,2,...,d)\). The algorithm returns a subset of the feature space of a specified size \(k\), where \(k<d\), has to be specified a prior. * **Initialization**. Initialization of the algorithm with an empty set \(Y_{0}=\emptyset\), so that k = 0, where \(k\) is the size of the subset. * **Searching procedure**. Adding an additional feature \(x^{+}\) to the feature subset \(Y_{k}\). \(x^{+}\) is the feature that maximizes the criterion function. _accuracy_ is the criterion function with the best classifier performance of DT model if it is added to \(Y_{k}\). Hence, the best feature subset is contained in \(Y_{k}\). This process is repeated until reaching the termination criterion. * **Termination**. Termination is stopped when \(k\) equal to the number of combination desired features. The new feature subset \(Y_{k}\) are added until the feature subset of size \(k\) contains the number of desired feature \(d\) that specified a prior. **Various RNNs**. * Traditional RNN model RNN is a traditional recurrent neural network incorporates either supervised learning or unsupervised learning. This model has an input sequence data whole length could be as large as its depth. The RNN model architecture consists of a feedback loop that links each layer with the ability to store data of the previous input. Thus it can increase the reliability of the model. Elman and Jordan RNNs are two types of RNN model. While the Elman model has a simple feedback loop in each layer, the Jordan model has a feedback loop for all neurons within a layer to the next layer. There is also a feedback loop connecting a neuron to itself. RNNs are recurrent because they perform the same task for each element in a sequence, with the output is dependent on the previous computations. In other words, the RNN is a memory that captures the information that has been computed so far. The structure of an RNN is shown in Figure 3.  
In this model, \(x(t)\) is input layer at time \(t\) with index \(i\). \(h(t-1)\) is hidden layer at time \(t-1\) with index \(s\). \(h(t)\) is hidden layer at time \(t\) with index \(j\). \(y(t)\) is output layer at time \(t\) with index \(e\). \(U\) is weight matrix connects input to hidden layer with index \(i,j\). \(W\) is weight matrix connects previously hidden to hidden layer with index \(s,j\). \(V\) is weight matrix connects hidden to output layer with index \(j,e\). \(m\) is number of input units. \(n\) is number of hidden units. \(k\) is number of output units. The formulas that govern the computations in an RNN are as follows.