## 3 Application of Proposed RF Algorithm for Intrusion Detection
Let the information gain of attribute \(A\) be represented as \(IG(S,A)\). The measure of the difference in entropy before and after \(S\) is split by \(A\) is  
\[IG(S,A)=\ E(S)-\sum_{i=1}^{n}p(S_{i})E(S_{i})=E(S)-\sum_{i=1}^{n}\frac{|S_{i} |}{|S|}E(S_{i}). \tag{4}\]  
\[E(S)=-\sum_{i=1}^{n}p(S_{i})\log_{2}p(S_{i}), \tag{5}\]  
where the entropy \(E(S)\) is a measure of the amount of uncertainty in the data set \(S\)[27, 28], \(S_{i}\) represents the subsets created from splitting set \(S\) by attribute \(A\) such that \(k=5\). \(S=U_{i}\), \((s_{i})\), \(p(s_{i})\) is the ratio of the number of elements in \(S_{i}\) (\(|S_{i}|\)) to the number of elements in set \(S\) (\(|S|\)), and \(E(s_{i})\) is the entropy of subset \(s_{i}\). Equation (3) describes the uncertainty in \(S\), which is reduced after set \(S\) is split in terms of attribute \(A\). Theoretically, the attribute that maximizes the difference is selected. In practice, however, choosing a suitable threshold value for determining the exact the number of features (\(N\)) extracted from the possible feature candidates is difficult. However, information gain tends to be biased in favour of attributes with many distinct values, such as social ID, in the data set. Therefore, the information gain ratio (IGR) is selected as a measure to reduce bias towards multivalued attributes by accounting for the number and size of the branches when choosing an attribute. IGR corrects the information gain by considering the intrinsic information of a split (_Split Info\({}_{A}(S)\)_) through the normalization process of the information gain [28] as follows. \[Split\ Info_{A}(S)=-\sum_{i=1}^{n}\frac{|S_{i}|}{|S|}\log_{2}\frac{|S_{i}|}{|S|}. \tag{6}\]  
Features with a large amount of intrinsic information are less useful for classifying the data. In the C4.5 DT, the ratio of information gain of the attribute \(IG(A)\) is used to calculate the \(IGR\) for each attribute to determine the relevant subset of features used in splitting in the tree based on the maximum gain in information for C4.5 DT. \(IGR(A)\) is defined as  
\[IGR(A)=\frac{IG(S,A)}{Split\ Info_{A}(S)}. \tag{7}\]  
The C4.5 DT uses the \(IGR\) measure, which is the information gain divided by the split information (S). Step 2. Model training and optimization In this phase, the RF-based classifier is trained to detect specific network attacks from the behavioral patterns, in the data, that are associated with families of real threats. RF classifiers obtain predictions from each DT and select the best solution by means of PV rule. Step 2.1. Bootstrapping  
To create DTs with randomly selected data samples, the bootstrapping method is applied to segment the training data set. This method is a resampling technique used to estimate statistics on a population by sampling a data set with replacement. In statistics, bootstrapping involves drawing sample data repeatedly with replacement from a data source to achieve an unbiased estimate of a population parameter [29]. Step 2.2. Model training using RF  
Typically, four steps are included in the RF process. Step RF.1--The bagging algorithm is used to randomly generate \(n\) training data sets that are subsets of a given data set. A bootstrap sample is obtained from the original data through sampling with replacement. In the case of \(n\) training samples, each sample has \(M\) features and training data sets are randomly selected (but replaced) to form \(n\) training data sets that are subsets of the data set. Given a training data set (\(X\),\(Y\)) in which \(X=x_{1}\),..., \(x_{n}\) and the target \(Y=y_{1}\),..., \(y_{n}\), the bagging method executes bootstrap sampling \(B\) times to construct multiple DT models, and the method then trains the DT model on the new samples. For example, for b = 1,..., \(B\), the sample is replaced with \(n\) training examples from \(X\), \(Y\), noted as \(X_{b}\), \(Y_{b}\). A classification tree \(f_{b}\) is then trained on \(X_{b}\) and \(Y_{b}\). Step RF.2--AT is created for every subset of the data set.