# A Filter Feature Selection Algorithm Based on Mutual Information for Intrusion Detection
## 4 Experiment and Results
### Data Set  
The datasets used in this paper are the Knowledge Discovery and Data Mining (KDD) Cup 1999 [23; 24; 25] and Kyoto 2006+ datasets [33; 40]. Although the KDD Cup 1999 dataset has existed for a long time, it is still the standard tagged dataset [27; 28; 29; 30] and has been widely used in the research and evaluation of network intrusion detection. In comparison, the Kyoto 2006+ dataset is relatively new. It is built on real 10-year traffic data from 2006 to 2015, which are obtained from diverse types of honeypots. Researchers specialized in intrusion detection may take advantage of the Kyoto 2006+ dataset to obtain more practical, useful and accurate evaluation results. It can also be used as a public dataset for verifying network intrusion detection algorithms. Although the KDD Cup 99 data set has some shortages, it is widely used as a benchmark for IDS evaluation. There are three independent datasets: the entire KDD training data, 10% KDD training data and KDD correct data. In the KDD Cup 99 dataset, every network connection represents a data record that consists of 41 features and a label specifying the status of this record. In the 10% KDD training data, the label includes the normal class and 22 attack types [26; 27]. The 22 attack types are divided into four groups: the remote-to-login (R2L), the denial-of-service (DOS), the user-to-root (U2R) and the Probe. In the KDD correct data, the label includes the normal class and 37 attack types. The 37 attack types are also divided into four groups: the R2L, the DOS, the U2R and the Probe. In the 37 attack types, there are 17 new attack types, which are not present in the 10% KDD training data. Like many experiments, the size of the dataset is reduced by random selection in our experiment. The data used is the 10% KDD training data and the KDD correct data. The distributions of these data are shown in Tables 1 and 2. As mentioned above, in the KDD Cup 1999 dataset, each record contains 41 features: 3 nonnumeric features and 38 numeric features. These nonnumeric features are the protocol type, service and flag, and must be transformed into numeric data. The protocol type has three kinds of types: tcp, udp and \begin{table}
\begin{tabular}{c c c} \hline \hline
**Class** & **Number of Records** & **Percentage** \\ \hline Normal & 97,278 & 19.69 \\ DOS & 391,458 & 79.24 \\ U2R & 52 & 0.01 \\ Probe & 4107 & 0.83 \\ R2L & 1126 & 0.23 \\ Total & 494,021 & 100 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: The distribution of the 10% knowledge discovery and data mining (KDD) training data. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Class** & **Number of Records** & **Number of Novel Attacks** \\ \hline Normal & 60,593 & — \\ DOS & 229,853 & 6555 \\ U2R & 228 & 189 \\ Probe & 4166 & 1789 \\ R2L & 16,189 & 10,196 \\ Total & 311,029 & 18,729 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The distribution of the KDD test data. icmp. Based on the different types, the \"protocol type\" feature is transformed into three features. Because the \"service\" feature containing 70 different types will heavily increase the dimensionality, it is not used in our experiments. As can be seen in Table 3, the nonnumeric feature conversion is achieved. The Kyoto 2006+ dataset is described for evaluating the performance of intrusion detection in Reference [40, 41]. In Section 4.3.5, the dataset in 2015 from the Kyoto 2006+ dataset is used. There are 24 features for each data in the Kyoto 2006+ dataset [40, 42]. In addition, 4 nonnumeric features and 20 kinds of numeric features are included in 24 features. These nonnumeric features need to be converted to numerical ones. Data normalization is a process of scaling the value of each feature into a well-proportioned range so that the bias in favor of features with greater values is eliminated from the dataset [33]. In the detection process, the test data are normalized by the Min-Max standardized method.