## 3 The Proposed IDS Framework
\[f_{t}=\sigma(W_{t}^{xf}\Sigma_{i=1}^{n_{x}}x_{t}^{i}+W_{t}^{hf}\Sigma_{j=1}^{ n_{h}}h_{t-1}^{j}+W_{t}^{cf}\Sigma_{k=1}^{n_{c}}c_{t-1}^{k}) \tag{5}\]  
The second step, the decision is what new information is going to be stored in the cell state by two processing. First one is to decide which values to by update by the input gate. The second one is a vector of new candidate value \(c_{t}\) is created by the \(tanh\) layer. Figure 1:0  
Figure 1:1  
Figure 1:2 An architecture of long short-term memory networks by time. The final step, the output is calculated based on the cell state. The value of the output gates is computed and used it for the memory block output Figure 1:3 (8) Figure 1:4 (9) The output units \(y_{t}\) are computed with hidden vector \(h_{t}\) Figure 1:5 (10)
* GRU model A slightly more dramatic variation on the LSTM is GRU, introduced by [PERSON], et al. [34] in 2014. This model combines the forget gate and input gate into a single update gate. It also merges the cell state and hidden state and makes some other changes. The resulting model is simpler than standard LSTM models and has been growing increasingly popular. A GRU has two gates, a reset gate \(r_{t}\), and an update gate \(z_{t}\). Intuitively, the reset gate determines how to combine the new input with the previous memory, while the update gate defines how much of the previous memory to keep around. The basic idea of using a gating mechanism to learn long-term dependence is the same as in an LSTM. The assumption that the GRU model has two input units, and three GRU units are presented in Figure 1:6  
Similar to LSTM model, \(X_{t}\),\(H_{t}\), and \(Y_{t}\) are the input vector, hidden vector, and output vector, respectively. \(W_{t}^{xz}\), \(W_{t}^{xr}\) and \(W_{t}^{xH}\) are weight matrices from the input layer to the update gate, the reset gate, and the hidden state, respectively. \(W_{t}^{hz}\), \(W_{t}^{hr}\), and \(W_{t}^{hH}\) are weight matrices from the hidden layer to the update gate, the reset gate and the hidden state, respectively. \(W_{t}^{h}\) is the weight matrix from the hidden unit to the output. In the first step, the update gate \(z_{t}\) at time \(t\) is calculated as follows:  
Figure 1:7  
Figure 1:8 An architecture of Gated Recurrent Unit networks by time. In the second step, the reset gate \(r_{t}\) is calculated: Figure 1:9 (12) In the third step, the hidden state \(H_{t}\) is calculated: Figure 2:0 (13) Finally, the value of the memory block, output \(h_{t}\) is computed using \(H_{t}\) Figure 2:1 (14) In order to compute the output units in the output layer, the output units \(y_{t}\) of the GRU model is computed with hidden vector \(h_{t}\) Figure 2:2 (15)  
**Evaluation performance IDS classifiers**. This step is to evaluate the performance of the proposed IDS framework. The performance evaluation is based on two things. The first is comparison accuracy of the proposed IDS models to advance IDS models. The second is measurement memory profiler of the proposed IDS model on the complete feature set and the best-selected feature subset. In the experiment, confusion matrix and receiver operating characteristic (ROC) are used to measure multi-attack output. Besides, memory used and time executed are measured in memory profiler. * Confusion matrix is presented in Figure 2:3 The classifier's goal is to identify as many TPs and TNs as possible while FPs and FNs need to reduce. where True positive (TP) is an attack that is correctly classified as an intrusion; True negative (TN) normal traffic correctly classified as normal traffic; False positive (FP) is when normal traffic is classified as an intrusion; False negative (FN) is when an intrusion that is classified as normal traffic. * ROC curve is a two-dimensional graph in which the false positive rate is plotted on X-axis and the true positive rate is plotted on the Y-axis. The ROC curves are useful to visualize and compare the performance of classifier methods. Figure 7 shows the ROC curves example for multi-classes classification (10 classes).