# Intelligent Cyber Attack Detection and Classification for Network-Based Intrusion Detection Systems
## 3 Materials and Methods
### Models
\begin{table}
\begin{tabular}{c c} \hline \hline
**Parameter** & **Value** \\ \hline N\({}^{o}\) of Estimators & 100 \\ Split Criterion & Gini Impurity \\ Max Depth & 35 \\ Min Samples Split & 2 \\ Min Samples Leaf & 1 \\ Max Features & \(\sqrt{\text{N}^{o}}\) of Features \\ Class Weights & Balanced \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Summary of Random Forest configuration. Figure 1: Representation of Random Forest prediction process. \[tangent=\frac{e^{2x}-1}{e^{2x}+1} \tag{5}\]  
\[softmax(x_{i})=\frac{e^{x_{i}}}{\sum_{j=i}^{n}e^{x_{j}}} \tag{6}\]  
where \(x\) defines a given input. Figure 2 graphically represents a fully connected architecture of a MLP with one input layer, one hidden layer and one output layer. The employed MLP consists of the four-layered architecture described in Table 5. The input layer node number is the same as the number of considered features, 10 for single flow classification and 10 multiplied by the window size for multi-flow. The output layer node is 5, the same as the number of different categories for the _AttackType_ label. Two hidden layers of 100 neurons each were considered. For each layer, a Dropout probability of 0.2 was used. This method will remove some of the next layer inputs (20%) in order to reduce the probability of overfitting. Rectified Linear Unit (_ReLU_) was selected as the activation function of the hidden layers. This activation function has proven to be very computationally efficient and it was one of the main breakthroughs in the neural network history for reducing the vanishing and exploding gradient phenomenon [30]. Its mathematical representation is  
\[f(x)=max(0,x) \tag{7}\]  
where \(x\) defines the input. _Softmax_ was used for the output layer since it assigns decimal probabilities to the prediction of each class in a multi-classification problem. The sum of all probabilities adds up to one. Categorical Cross-Entropy was chosen as loss objective function and Adam was used as optimization function. The batch size was set to 1024, the epoch size to 50 and an early stopping method was employed in order to stop the training as soon as the loss value  
Figure 2: Architecture of a Multi-Layer Perceptron. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Layer** & **Size** & **Activation** & **Dropout** \\ \hline Dense & 10 \(\times\) Window & - & - \\ Dense & 100 & ReLU & 0.2 \\ Dense & 100 & ReLU & 0.2 \\ Dense & 5 & Softmax & - \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Employed MLP architecture. stabilized. The learning rate was set to 0.001 to avoid a quick convergence to a sub-optimal solution. Table 6 summarizes the main configurations of the MLP model. **Long-Short Term Memory**[31; 32]. A Long-Short Term Memory (LSTM) is a type of Recurrent Neural Network (RNN). An RNN contains feedback connections that allow information to travel in a loop from layer to layer. These networks store information about past computations through a hidden state that represents the network memory. Therefore, the output, \(o_{t}\), for a given input, \(x_{t}\), at a given timestep, \(t\), is influenced by the inputs of its previous timesteps, \(x_{t-1},x_{t-2},...,x_{t-n}\), where \(n\) defines the total number of prior timesteps. This characteristic allows RNNs to be very suited to working with sequential data. Figure 3 represents the unfold form of a standard _many to many_ RNN. Unfold is a concept associated with RNN graphical representation. The network is expanded according to the size of its input and output sequence. RNN can be modeled for _one to one, one to many, many to one_ and _many to many_ problems. The difference between each of the presented problems is the distinct cardinality between the input and output of the network. An RNN can be mathematically expressed by the following equations [33]  
\[h_{t}=g(h_{t-1},x_{t};\theta) \tag{8}\]  
\[o_{t}=f(h_{t};\theta) \tag{9}\]  
where \(x_{t}\) is the input, \(o_{t}\) is the output and \(h_{t}\) is the hidden state at a given timestep \(t\).