# A New Method of Fuzzy Support Vector Machine Algorithm for Intrusion Detection
## 4 Experimental Evaluation
### The Experimental Performance  
The experimental data of UNM_live_lpr process were composed of 4298 normal tracks and 1003 abnormal tracks. The 1003 anomaly traces contain LPRCP attacks that control and tamper with host files. The experimental data for the UNM_sendmail process consisted of 346 normal traces and 25 abnormal traces, including 20 SCCPS that used E-mail to obtain root directory information and 5 decode attacks that remotely modified local files. False alarm is to judge the normal behavior of the program as abnormal behavior. If \(L_{N}\) normal traces participate in the evaluation, and \(N_{FAR}\) normal traces are misjudged as abnormal traces, then the false alarm rate is equal to \(N_{FAR}\) /\(L_{N}\). Detection rate refers to the proportion of detected abnormal traces in the total number of abnormal traces. If \(L_{AN}\) abnormal traces participate in the test and \(\ N_{\text{HR}}\) were detected, then the detection rate is \(N_{HR}\) /\(L_{AN}\). The missing rate indicates the proportion of unrecognized abnormal traces in the total number of abnormal traces. If \(L_{AN}\) abnormal traces participate in the evaluation and \(N_{M}\) cannot be detected, then the missing rate is \(N_{M}\) /\(L_{AN}\). \(DR=\rho_{HR}*\)(1\(-\rho_{FAR}\)) is used as the comprehensive detection formula, in which \(\ \rho_{HR}\) and \(\rho_{FAR}\) stands for detection rate and missing rate respectively. Gauss kernel \(k\) (\(x\), \(y\)) = exp (\(-\|x-y\|^{2}/2\sigma^{2}\)) is used in all algorithms during training. \(\sigma_{1}\) and \(\sigma_{2}\) can be selected according to the maximum error rate allowed in the target set. \(C_{1}\) and \(C_{2}\) can be adjusted according to the equality of upper bound of positive and negative error rate. That is, \(1/\)\(l_{1}C_{1}=1/\)\(l_{2}C_{2}\), \(1/\)\(l_{1}\)\(\leq C_{1}\leq 1\), \(1/\)\(l_{2}\)\(\leq C_{2}\leq 1\). Grid search method is adopted to select the optimal parameters. The search range of parameter C is \(\{2^{-24}\), \(2^{-23}\), \(\cdots\), \(2^{23}\), \(2^{24}\}\). The parameter \(\sigma\) and \(\beta\) both have a search range of \([2^{-24}\), \(2^{-23}\), \(\cdots\), \(2^{23}\), \(2^{24}\}\). The step length and short sequence length are set to 1 and 6 respectively. Table 1 summarizes the comparison results of detection performance between our method and the other eight methods on UNM_live_lp. The detection rate of SVM, FSVM1, FSVM2, FSVM3, and our algorithm are 61.53%,76.92%, 76.92%, 83.21%, and 84.61% respectively. The missing rates of SVM, FSVM1, FSVM2, FSVM3, and our algorithm are 38.47%, 23.08%, 23.08%, 16.23%, and 15.39% respectively. The false alarm rates of SVM, FSVM1, FSVM2, FSVM3, and our algorithm are 10.14%, 9.57%, 8.17%, 6.92%, and 4.51% respectively. In all the algorithms, our algorithm has the highest detection rate and the lowest false alarm rate and missing rate. As shown in Table 1, SVM has the lowest detection rate, 79.88%, among the five algorithms. Due to the construction of a fuzzy membership function, the other four algorithms treat the different contributions of different samples in the construction of the objective function differently, which makes their average detection rate reach 87.03%. FSVM1 algorithm designs a fuzzy membership function \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Algorithm** & **Detection Rate (\%)** & **Missing Rate (\%)** & **False Alarm Rate (\%)** \\ \hline SVM & 79.88\% & 20.12\% & 8.64\% \\ FSVM1 & 83.71\% & 16.29\% & 7.30\% \\ FSVM2 & 85.56\% & 14.44\% & 8.17\% \\ FSVM3 & 86.20\% & 13.80\% & 6.92\% \\ Our algorithm & 92.63\% & 7.37\% & 6.16\% \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Performance comparison on data set UNM_live_lp. based on the linear function of the distance between the sample and its cluster center. The larger the distance is, the smaller the coefficients is. However, this membership design method is sometimes unable to distinguish abnormal points effectively.