# XI2S-IDS: An Explainable Intelligent 2-Stage Intrusion Detection System
## 2 Materials and Methods
### Dataset  
Two datasets were chosen as benchmarks for the evaluation of the framework: UNSW-NB15 and CICIDS2017. The CICIDS2017 dataset [42] comprises 2,273,097 normal records and 557,646 attack records distributed over 14 attack classes. It was collected over 5 days.  
The UNSW-NB15 dataset [43; 44; 45; 46; 47] dataset consists of both real normal behavior and imitated attack behaviors. It has 49 feature and 9 attack classes. It contains 2,540,047 records, of which approximately 87% are normal records and approximately 13% are attack records. Creators of the dataset also provided 10% of the original dataset as a subset of the dataset, containing a total of 257,673 records, split between train and test sets. In this research, we have opted to use the original complete dataset that contains 2,540,047 records.  
The percentage of records of each class in both datasets as well as a description of the attack classes are presented in Tables 1 and 2 for UNSW-NB15 and CICIDS2017 datasets, respectively, highlighting the high imbalance within the datasets.  
\begin{table}
\begin{tabular}{c c c} \hline
**Attack Type** & **Description** & **Frequency (\%)** \\ \hline Normal & Normal traffic records & 87.3\% \\  & Attacks that send a large volume of random and & \\ Fuzzers & invalid traffic to the target system causing & 8.4\% \\  & unexpected behavior & \\ Analysis & Attacks that use port scanning or malicious HTML & \\  & penetration scripts to breach web applications & 1.7\% \\ Backdoor & Attacker gains access to a system and leaves a & 0.9\% \\  & secret entry point for future access & \\  & Attacker overwhelms the targeted network or & \\ Denial of & server by flooding it with excessive data or requests & \\ Service (DoS) & to disrupt its normal functioning rendering & 0.6\% \\  & legitimate users unable to access its services & \\  & Intrusions that take advantage of vulnerabilities or & \\ Exploits & bugs within an operating system or software & 0.5\% \\  & known by the attackers & \\ Generics & Attempts made to break the key or cryptographic & 0.1\% \\  & system of a security system & \\ Reconnaissance & An attack that involves collecting information & \\  & about the targeted computer network with the & 0.09\% \\  & intention of circumventing its security controls & \\  & Attack that launches a command shell under the & \\ Shellcode (SC) & attacker’s control to evade security controls of a & 0.05\% \\  & computer network & \\ Worms & Malicious programs that self-replicate and spread & \\  & to other computer systems & 0.006\% \\ \hline \end{tabular}
\end{table}
Table 1: Types of attacks in the UNSW-NB15 dataset with descriptions and frequencies.  
\begin{table}
\begin{tabular}{c c c} \hline
**Attack Type** & **Description** & **Frequency (\%)** \\ \hline Benign & Normal traffic & 80.3 \\  & Distributed Denial of Service attack, & \\ DDoS & overwhelming a network by flooding it & 4.52 \\  & with traffic & \\ PortScan & Scanning multiple ports on a host to find & \\  & vulnerabilities & 5.61 \\ Bot & A compromised device controlled by an & 0.07 \\  & attacker, often part of a botnet & \\  & Repeated attempts to crack FTP credentials & \\ FTP-Patator & using different combinations of username & 0.28 \\  & and password & \\ SSH-Patator & Repeated attempts to crack SSH credentials & 0.21 \\ \hline \end{tabular}
\end{table}
Table 2: Types of attacks in the CICIDS2017 dataset with descriptions and frequencies.