## 5 Data Analysis
### Complexity Analysis through Anomaly Detection Frame Work  
In the IDS domain it is observed that, one of the way to evaluate the complexity of the IDS data set is the utilization of anomaly detection or signature detection framework, where most of the frameworks are equipped with the machine learning algorithms. For instance, in [15; 16; 17] the authors utilized several machine learning algorithms as the part of anomaly detection framework, while the evaluation of ADFA-LD IDS data set [4]. Therefore, we implemented an anomaly detection frame-work for conducting a complexity analysis, by the use of machine-learning tool box in Matlab R2014a, Intel corei-7 @ 3.40 GHz processor with a 64-bit operating system and 16 GB of RAM. The framework is shown in the Figure 2 where it actually reflects the typical anomaly detection process or binary classification method assisted with machine -learning algorithms. Both data sets can be utilized at the data set entity point. After the acquisition of a process trace, a novel Distinct Dynamic Link Library Count (DDLLC) was introduced and applied as a scheme for constructing a Feature Vector (\(FV\)) for the trace. It is elaborated in Figure 3, in which each trace is transformed to the feature vector consisting of the count of distinct DLL calls. In order to generate a profile of the behaviors of traces and later classify test traces, we adopted the Support Vector Machine (SVM) with linear and RBF kernels [18], k-Nearest Neighbour (KNN) [19], Extreme Learning Machine (ELM) [20], Artificial Neural Network (ANN) [21] and an  
Figure 1: Audit data frequency distribution map. improved version of the Naive Bayes (NB) classifier [22] from Microsoft research. Algorithm 1 shows the binary classification task for \(N\) traces, where \(N\) represents the total number of training and test traces. In Algorithm 1_FM_ represents the feature matrix of size \(N\) rows and 9 columns, that is, 356 rows and 9 columns because the data set ADFA-WD has 356 normal training traces and each trace will have 9 features or attributes through DDLLC accordingly. The feature matrix for \(N\) traces can be formulated as:  
\[FM^{ij}(traces)=\Sigma_{i=1}^{N}\Sigma_{j=1}^{9}(FV^{i,j}) \tag{1}\]  
Figure 3: Distinct Dynamic Link Library Count (DDLLC) feature construction scheme. Figure 2: Anomaly detection frame work for the data sets complexity analysis. where \(j\) is the counter to the dimensions of \(FM\) and for implementing the scheme of DDLLC. In line 1, Algorithm 1 inputs feature matrices of the training and test traces, with lines 2 to 5 designed to construct a profile of normal traces behaviors using any machine learning algorithm respectively. Note that each algorithm has its own key properties while learning feature matrices and classifying test traces. SVM classifies data points of feature matrix into two classes through maximizing the margin of the hyper plane by first transforming the data points in a linear or circular way. In KNN the distance between points in the \(FV\) is measured and, based on close distance, traces are placed into either one of two classes (e.g., 0 or 1, normal or abnormal). In ANN, each data point in an \(FV\) is considered an input and then the initial weight \(w\) of each \(FV\), i.e., \(w.FV\), is calculated. The activation function (i.e., the sigmoid function) is applied on \(w.FV\) to fit the ANN output with the actual value (i.e., 0 or 1 about traces). In ELM, a single hidden layer feedforward neural network selects randomly hidden layers and determines the output weight \(w.FV\) required to fit the target output relevant to a trace in \(FM\). In contrast to the traditional ANN, the hidden layers do not need to be tuned iteratively and the activation functions are adoptable. Moreover, in NB, data points in the \(FV\) and class labels are processed according to their conditional probability to estimate the maximum likelihood of each trace in the \(FM\).