## 5 Results and Discussions
### Illustration for IDS on UNSW-NB15 Dataset  
The data application is conducted through three methods: conventional Hotelling's \(T^{2}\), robust \(T^{2}\) based on Fast-MCD, and the proposed diagram, which is the robust \(T^{2}\) based on MRCD. The construction of the control chart is divided into two phases: Phase I for establishing control limits and Phase II for the detection process and calculating the performance of the control chart. In the conventional Hotelling's \(T^{2}\) control chart, the \(T^{2}\) statistic is calculated using Equation (1), with control limits determined based on the significance level using the criteria of the highest AUC value, which is \(\alpha=6\%\), as depicted in Figure 5(a). The control chart can be visualized after computing the statistics and establishing control limits, as shown in Figure 5(b). The statistical plot depicted in Figure 6 shows two types of data labels: green for normal data and red for intrusion data. These statistics will be tested against the control  
Figure 4: Statistics Plot of Simulation on \(p=20\) using (a) \(T^{2}\) (b) \(T^{2}\)-FMCD (c) \(T^{2}\)-MRCD. Figure 5: Statistics Plot of Simulation on \(p=50\) using (a) \(T^{2}\) (b) \(T^{2}\)-FMCD (c) \(T^{2}\)-MRCD. Figure 6: \(T^{2}\) Chart of (a) Control Limit Selection, (b) Statistic Plot, and (c) ROC Curve Plot. limits. If the value of the statistic \(T^{2}>CL_{B}\), the observation is detected as an intrusion. If the statistic \(T^{2}\leq CL_{B}\), the observation is detected as normal. Based on the labels and the detection outcomes obtained, a confusion matrix table can be formed. Visualization in the form of an ROC Curve can also be generated, as shown in Figure 6c, which can subsequently be used for calculating the AUC value. A confusion matrix and AUC value can be seen in Table 6.  
Based on Table 6, it can be seen that the performance of conventional Hotelling's \(T^{2}\) on UNSW-NB15 data is not good, where the AUC value obtained is only 0.511. Then, with an FP Rate of 0.060, a very high FN rate is obtained, namely, 0.917. Next, in the construction of a control chart for Robust \(T^{2}\) based on Fast-MCD, the \(T^{2}\) statistic is calculated, and the control limits are determined based on the significance level using the criteria of the highest AUC value, which is \(\alpha=25\%\), as depicted in Figure 7a. The control chart can be visualized after computing the statistics and establishing the control limits, as seen in Figure 7b. Based on the figure, the statistical plot depicts two types of data labels: green for normal data and red for intrusion data. These statistics will be tested against the control limits. If the value of the statistic \(T^{2}\)FrMCD \(>CL_{B}\), the observation is detected as an intrusion. If the statistic \(T^{2}\)FrMCD \(\leq CL_{B}\), the observation is normal. Based on the labels and the detection outcomes obtained, a confusion matrix table can be formed. Visualization in the form of an ROC Curve can also be generated, as shown in Figure 7c, which can subsequently be used for calculating the AUC value. A confusion matrix and AUC value can be seen in Table 7. Table 7 shows that the performance of Robust \(T^{2}\) based on Fast-MCD on the UNSW-NB15 data is quite good, with an AUC value of 0.718. Additionally, with an FP rate of 0.25, there is a relatively low FN rate of 0.314. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Actual**} & \multicolumn{2}{c}{**Detection**} & \multirow{2}{*}{**Accuracy**} & \multirow{2}{*}{**AUC**} & \multirow{2}{*}{**FP Rate**} & \multirow{2}{*}{**FN Rate**} \\ \cline{2-2} \cline{5-6}  & **Intrusion** & & & & & & \\ \hline Intrusion & 9853 & 109,488 & 0.376 & 0.511 & 0.060 & 0.917 \\ Normal & 3354 & 52,646 & & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Confusion Matrix and Performance Evaluation for Conventional Hotelling’s \(T^{2}\) Chart.