## 3 CCD Assault Detection Using Euclidean Distance-Based Anomaly Detection Schemes
### Dimensionality Reduction Using Genetic Algorithm-Based Feature Selection
Fitness function \(F\), which is adopted in this paper, is given as follows:  
\[F=\frac{\tilde{C}}{S}. \tag{14}\]  
In (14), \(\tilde{C}\) is the mean compactness of classes and is expressed as follows:  
\[\tilde{C}=\frac{1}{L}\sum_{i}^{L}{C_{i}}^{\prime}, \tag{15}\]  
where the mean separability, denoted by \(\tilde{S}\) in (14), is the separation between any two classes in an \(L\)-class problem, obtained as follows:  
\[\tilde{S}=\frac{2}{L\left(L-1\right)}\sum_{i\
eq j}^{L}{S_{ij}}. \tag{16}\]  
In this paper, we are dealing with a binary classification problem. Therefore, \(L=2\), i.e., normal and compromised SE-MF measurement data. GA finds a feature subspace that would minimize the ratio of the mean values of inter-class separability and intra-class compactness, defined as follows and illustrated in Figure 2.  
* Inter-class separability: measures how well separated two different clusters are from each other. * Intra-class compactness: indicates how well clustered the sample vectors are for a given class. To measure the compactness of a given class, GA calculates the mean or centroid, \(\mu^{(i)}\), of class \(i\) as follows:  
\[\mu=\frac{1}{N}\left(X_{1}+X_{2}+...+X_{N}\right). \tag{17}\]  
Here, \(N\) is the total number of samples of class \(i\). After that, the compactness of class \(i\) is determined by finding the mean value of the Euclidean norm, as follows:  
\[C_{i}=\frac{1}{N}\sum_{j=1}^{N}\Big{\|}X_{j}-\mu^{(i)}\Big{\|}. \tag{18}\]The Euclidean distance between the centroids of two classes describes the separability between the two classes \(i\) and \(j\). It is determined as follows:  
\[S_{ij}=\left\|\mu^{(i)}-\mu^{(j)}\right\|. \tag{19}\]  
GA encodes the SE-MF data into chromosomes, which goes through crossovers and mutations. Thus, new generations of chromosomes are yielded, which substitute for their parents, provided they are healthier, i.e., their fitness or objective function value is smaller. This process is iterated over many generations until there is no further improvement in the fitness function [29]. A binary encoding scheme is used to represent the features or attributes of the SE-MF dataset as chromosomes. A chromosome is simply a string of binary ones and zeroes, where one indicates that a certain SE-MF feature is selected and zero means it is rejected. The index of each one and zero in the chromosome corresponds to a distinct SE-MF attribute. In the beginning, the GA randomly selects different subsets of the SE-MF. In other words, a primary population of chromosomes (a string of ones and zeroes) initiates the algorithm. A new population of chromosomes is created by subjecting the primary (parent) chromosomes to crossover and mutations. Two parent chromosomes exchange information or swap fragments at randomly-chosen crossover points during the crossover process. However, during the mutation process, the bits are flipped at randomly-selected positions in a chromosome. Then, based on their respective fitness function value, chromosomes are ranked in the evaluation process. Finally, the chromosomes that minimize the proposed fitness function are selected to produce new chromosomes. This process is repeated for many generations until there is no further decrease in the value of the proposed fitness or objective function.