# A Lightweight Perceptron-Based Intrusion Detection System for Fog Computing
## 3 Proposed Method
### Phase 1: Preprocessing  
#### 3.1.1 Feature Extraction  
The data used in this study consists of traces of system calls. The trace is a relatively short sequence of position integers (system call numbers) which is not an appropriate form of input for a typical machine learning model. In order to transform the sequence format of the input data to a matrix-like form, we need to implement what is known as feature extraction in the preprocessing stage. Feature extraction is the process of representing the input data in a form that is compatible with the modeling algorithm. In this work, we are interested in a feature extraction technique that is simple and can be computed efficiently. One approach is to use Boolean representation where the sequence is represented as a vector of length equal to the size of the set of all symbols (or system calls in this case). Boolean representation is one of the simplest and most commonly used techniques in  
Figure 3: A flowchart of the proposed method. text classification [31], where the interest is only on whether or not a system call is present in the trace. The issue with the Boolean method is the fact that it does not maintain the information about the frequency of the system call in the trace. On the other hand, the vector space technique gives a weight for each system call relative to its frequency. For example, the Term Frequency Inverse Document Frequency (TF-IDF) value is usually used as a weight for the vector space model in the field of information retrieval [31]. The problem with the vector space model is that the relative order of the symbols in the input data is not accounted for. In order to retain the information about the relative order of the terms (or symbols) in the input sequence, we need to consider tuples of terms (or calls) and not only the single term as in the vector space model. The \(n\)-gram is defined as tuple \(c=(c_{1},c_{2},\ldots,c_{n})\) of n terms where n is generally a small positive integer. This modified vector space model is used frequently in natural language processing and DNA and protein sequence analysis, see for example [32; 33]. For a given \(n\)-gram, \(c\), its weight \(w(c)\) in trace T is given by  
\[\omega(c)=\frac{f(c)}{|T|} \tag{1}\]  
where \(f(c)\) is the frequency of \(c\) in \(T\) and \(\mid T\mid\) is the length of the trace. **Example 1:**  
To illustrate the notions above, let's consider the following trace  
\[T=(6,174,174,174,6,45,33,192,33,192,174,174,6,174). \tag{2}\]  
Note that \(\mid T\mid=14\). For \(n=2\), we calculate, for every 2-gram, \(c\), its frequency and weight in the following Table 1:  
**End Example 1. **  
The advantage of using this type of features is the fact that calculating a weight of an \(n\)-gram is not computationally expensive. On the other hand, the \(n\)-gram approach leads to another issue which is the high sparsity of the data matrix. If we consider the dense form of the data matrix, we find it to be too large even for machines with ample resources. One way to overcome this problem is to use compressed matrix formatting and keep only the non-zero values of the matrix. In addition to that, we need to implement algorithms of small runtime which require limited memory space. We have adopted the aforementioned approach in this study. For the system calls encoding, we have considered only 1-gram and 2-gram as features. The feature vector is constructed by considering only those \(n\)-grams that appear in training data. The following step is to put the data in a form of sparse matrix by keeping only the weights of features that appear in the trace and ignore the zero weights.