# Intelligent Cyber Attack Detection and Classification for Network-Based Intrusion Detection Systems
## 3 Materials and Methods
### Models  
One machine learning model, Random Forest [20], and two deep learning models, Multi-Layer Perceptron [25] and Long-Short Term Memory [14; 15] were employed. These state-of-the-art techniques for intrusion detection systems presented very promising results in previous research for multiple state-of-the-art datasets, namely for the CICIDS2017 [10] and the UNSW-NB15 [11]. In order to better understand the main differences in each technique, a brief description of their nature is provided as well as all the considered parameters and configurations. **Random Forest Classifier**[26]. A Random Forest (RF) consists in a large number of Decision Trees that operate together as an ensemble. Each Decision Tree is a decision tool that works in a tree-like model of decisions and outcomes. For a given dataset entry, each tree of a Random Forest model predicts a given class and the most voted one is elected as the model's output. The underlying theory behind Random Forests is the wisdom of crowds. In order to assure good performance, the algorithm must be trained with good representative data and the correlation between the predictions of each tree must be low [27]. Figure 1 represents the behaviour of the classifier. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Class** & **Dataset** & **OpenStack 1 st Half** & **Sample** \\ \hline Total Records & 32,630,424(100\%) & 18,762,253(100\%) & 2,535,456(100\%) \\ Brute Force & 9888(0.03\%) & 4992(0.03\%) & 1262(0.05\%) \\ DoS & 2,959,027(9.07\%) & 2,959,027(15.77\%) & 390,440(15.40\%) \\ No Attack & 29,352,063(89.95\%) & 15,526,226(82.75\%) & 2,092,550(82.53\%) \\ Ping Scan & 6090(0.02\%) & 6090(0.03\%) & 1068(0.04\%) \\ Port Scan & 303,356(0.93\%) & 265,918(1.41\%) & 50,136(1.98\%) \\ \hline \hline \end{tabular}
\end{table} 
Table 3: AttackType class distribution comparison. The Random Forest Classifier has multiple parameters that can be configured. Table 4 summarizes some important parameters that were applied. Max tree depth was set to 35 to prevent the occurrence of overfitting and to ensure generalization. Class weights were adjusted to be inversely proportional to class frequencies in the input data in order to avoid poor classification on the minority classes, since the CIDDS-001 dataset is highly unbalanced [20]. This way, it was possible to tune the classifier to favor the minority classes over the majority classes by using weights obtained through the following equation  
\[w_{c1}=\frac{n_{c1}}{n_{total}} \tag{2}\]  
where \(w_{c1}\) is the weight of class one, \(n_{c1}\) is the number of occurrences of class one in the input data and \(n_{total}\) represents the total number of samples of the input. The remaining values for the number of estimators, split criterion, min samples split, min samples leaf and max features were set to the default of Scikit-learn [28] python library, since they are recognised as well established configurations for a vast majority of contexts. **Multi-Layer Perceptron**[29]. A Multi-Layer Perceptron (MLP) is a type of Feed-Forward Network which can be represented as an acyclic graph with no feedback connections (the outputs of the model are not fed back into itself). An MLP comprises three or more layers, having one input layer, one or more hidden layers and an output layer, in which each layer has multiple neurons that can be represented in mathematical notation. Each hidden layer \(h_{i}\) can be mathematically described by  
\[h_{i}(x)=f(w_{i}^{\top}x+b_{i}) \tag{3}\]  
where \(x=x_{1},x_{2},...,x_{n-1},x_{u}\) is the input vector, \(w_{i}\) is the weights vector, \(b_{i}\) is the bias and \(f\) is a non-linear activation function like _sigmoid_, _hyperbolic tangent_ or _softmax_ (preferred for the output layer). These activation function are mathematically represented as  
\[sigmoid=\frac{1}{1+e^{-x}} \tag{4}\]