## 4 Experimental Results and Discussion
### KDD Cup 1999 Dataset  
The third international KDD '99 dataset has been used to build a network intrusion detector (IDS) in order to identify and distinguish between normal and abnormal events in the context of the network systems. It can be argued that the KDD '99 dataset that we have used in our analysis may not be an ideal representative of the existing networks of contemporary world; however this is a sensible choice due to the lack of public intrusion detection datasets in the computer networking research community. We believe that the dataset can be applied as an effective benchmark dataset for the general problem of security analysis to help networking researchers to work with different ML techniques in order to perform intrusion detection. Moreover, the Defense Advanced Research Project Agency (DARPA) evaluated a program for the IDS that was set up for a network environment  
Figure 4: A taxonomy of SPLR for the IDS.  
in 1998. Moreover, a TCP/IP dump packet for LAN (local area network) has been carried out by Massachusetts Institute of Technology (MIT's) Lincoln lab to examine the performance of different IDS methods by using the dataset [29]. Therefore it can be said that the dataset has been used as a realistic type of network systems by many researchers in the field. Soon after that, many researchers paid significant attention towards the IDS domain. The KDD '99 dataset contains five classes, one normal class, and rest of all are attacks such as DOS, Probe, U2R, and R2L. The number of attacks contained in the training datasets is 22 and 16; additional attacks are included into the test datasets. The probability of attacks in both (training & testing) is different. Therefore, it makes the most realistic environment for IDS experiments. The number of KDD '99 samples are listed in Table 1 and list of 41 features in Table 2, while Table 3 shows attack categories.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Class** & **Training Samples** & **Testing Sample** \\ \hline Normal & 972,780 & 60,592 \\ Denial of Service (DoS) & 3,883,370 & 237,594 \\ Probe & 41,102 & 2377 \\ Remote-to-Local (R2L) & 16,347 & 8606 \\ User-to Root-(U2R) & 52 & 70 \\ Total Samples & 4,898,430 & 311,028 \\ \hline \hline \end{tabular}
\end{table}
Table 1: KDD ’99 dataset descriptions.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**S.No** & **Attributes** & **S.No** & **Attributes** \\ \hline
1 & Duration & 22 & is\_guest\_login \\
2 & protocol\_type & 23 & count \\
3 & Service & 24 & srv\_count \\
4 & Flag & 25 & serror\_rate \\
5 & src\_byte & 26 & srv\_serveror\_rate \\
6 & dst\_bytes & 27 & rerror\_rate \\
7 & land & 28 & srv\_error\_rate \\
8 & wrong\_fragmnet & 29 & same\_srv\_rate \\
9 & urgent & 30 & diff\_srv\_rate \\
10 & Hot & 31 & srv\_diff\_host\_rate \\
11 & num\_failed\_logins & 32 & dst\_host\_count \\
12 & logged\_in & 33 & dst\_host\_srv\_count \\
13 & num\_compromised & 34 & dst\_host\_srv\_rate \\
14 & root\_shell & 35 & dst\_host\_diff\_srv\_rate \\
15 & su\_attempted & 36 & dst\_host\_same\_src\_port\_rate \\
16 & num\_root & 37 & dst\_host\_srv\_diff\_host\_rate \\
17 & num\_file\_creations & 38 & dst\_host\_serveror\_rate \\
18 & num\_shells & 39 & dst\_host\_svr\_serveror\_rate \\
19 & num\_access\_files & 40 & dst\_host\_error\_rate \\
20 & num\_outbound\_cmds & 41 & dst\_host\_srv\_error\_rate \\
21 & is\_hot\_login & \\ \hline \hline \end{tabular}
\end{table}
Table 2: Feature list of KDD ’99.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Attack Classes** & **Training Dataset Attacks (22)** \\ \hline Denial of Service (DOS) & Back, Land, neptune, pod, smurf, teardrop \\ Remote to Local (R2L) & ftp\_write, guess\_passwd, imap, multihop, phf, spy, warezclient, warezmaster \\ User To Root (U2R) & buffer\_overflow, perl, loadmodule, rootkit \\ Probing & ipsweep, nmap, portsweep, satan \\ \hline \hline \end{tabular}
\end{table}
Table 3: KDD ’99 attack descriptions.