## 5 Results and Discussions
### Illustration for IDS on UNSW-NB15 Dataset
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Actual**} & \multicolumn{2}{c}{**Detection**} & \multirow{2}{*}{**Accuracy**} & \multirow{2}{*}{**AUC**} & \multirow{2}{*}{**FP Rate**} & \multirow{2}{*}{**FN Rate**} \\ \cline{2-2} \cline{5-6}  & **Intrusion** & & & & & & \\ \hline Intrusion & 81,871 & 37,470 & 0.711 & 0.718 & 0.250 & 0.314 \\ Normal & 13,991 & 42,009 & & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Confusion Matrix and Performance Evaluation for Fast-MCD-based \(T^{2}\) Chart. Figure 7: Fast-MCD-based \(T^{2}\) Chart of (**a**) Control Limit Selection, (**b**) Statistic Plot, and (**c**) ROC Curve Plot. For constructing the proposed chart of Robust \(T^{2}\) based on MRCD, the \(T^{2}\) statistic is calculated, and the control limits are determined based on the significance level using the criteria of the highest AUC value, \(\alpha\) = 30%, as depicted in Figure 8a. The control chart can be visualized after computing the statistics and establishing control limits, as shown in Figure 8b. The statistical plot depicted in Figure 8 shows two types of data labels: green for normal data and red for intrusion data. These statistics will be tested against the control limits. If the value of the statistic \(T^{2}\)MRCD \(>CL_{B}\), the observation is detected as an intrusion. If the statistic \(T^{2}\)MRCD \(\leq CL_{B}\), the observation is normal. Based on the labels and the detection outcomes obtained, a confusion matrix table can be formed. Visualization in the form of an ROC Curve can also be generated, as shown in Figure 8c, which can be used subsequently for calculating the AUC value. A confusion matrix and AUC value can be seen in Table 8. Based on Table 8, it is apparent that the performance of Robust \(T^{2}\) based on MRCD on the UNSW-NB15 data is excellent, with an AUC value of 0.849. Additionally, with an FP Rate of 0.298, there is a shallow FN rate of only 0.004. After applying the UNSW-NB15 data using these three methods, the performance of each chart can be compared by the shape of the ROC Curve in Figure 9. MRCD-based \(T^{2}\) has a larger area; therefore, it has better performance than the other methods, which have a smaller area. The performance of each chart also can be compared and evaluated based on several goodness and error criteria, as presented in Table 9.  
Table 9 displays the accuracy, AUC, FP rate, FN rate, and execution time of the three methods used in this study. The conventional \(T^{2}\) method, with its straightforward steps, took only 286 s. The Fast-MCD-based \(T^{2}\) method, known for its efficiency, required 1470 s. Meanwhile, the MRCD-based \(T^{2}\), which features a complex algorithm, took a longer time of 8108 s.  
The duration of execution time correlates with the quality of the chart's performance in detecting intrusions. Based on the AUC values, the conventional \(T^{2}\) Hotelling chart showed poor performance in intrusion detection, achieving an AUC of only 0.511. Both robust \(T^{2}\) charts demonstrated better performance than the conventional \(T^{2}\). The Fast-MCD-based \(T^{2}\) had a relatively good AUC value of 0.718. On the other hand, the proposed MRCD-based \(T^{2}\) had the best performance, with the highest AUC value of 0.849 and a shallow FN Rate of 0.004, indicating a meager chance of undetected intrusions. Figure 8: MRCD-based \(T^{2}\) Chart of (**a**) Control Limit Selection, (**b**) Statistic Plot, and (**c**) ROC Curve Plot. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Actual**} & \multicolumn{2}{c}{**Detection**} & \multirow{2}{*}{**Accuracy**} & \multirow{2}{*}{**AUC**} & \multirow{2}{*}{**FP Rate**} & \multirow{2}{*}{**FN Rate**} \\ \cline{2-2} \cline{5-6}  & **Intrusion** & & & & & \\ \hline Intrusion & 118,915 & 426 & 0.902 & 0.849 & 0.298 & 0.004 \\ Normal & 16,671 & 39,329 & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Confusion Matrix and Performance Evaluation for MRCD-based \(T^{2}\) Chart.