## 3 The Proposed Approach of SCDNN
### The SCDNN Algorithm  
The SCDNN algorithm adopts a deep learning approach to categorise network attack types and fine-tune its weights and thresholds using backpropagation. The input vectors map low-dimensional space with DAEs and SAE to discover patterns in the data. The SCDNN algorithm is detailed in Algorithm 2. ```
Input: dataset, cluster number, number of hidden-layer nodes \(HLN\), number of hidden layers \(HL\). Output: Final prediction results /*Note the symbols of /*\" and \"*/\" represent comments in this algorithm. */
1 Divide the raw dataset into two components: a training dataset and a testing dataset. /*get the largest matrix eigenvectors and training data subsets*/
2 Obtain the cluster centres and SC results using Algorithm 1. Here, the clustering results are regarded as training data subsets. /*Train each DNN with each training data subset*/
3 The learning rate, denoising and sparsity parameters are set and the weight and bias are randomly initialised. 4 The HL are set two hidden layers, HLN is set 40 nodes of the first hidden layer and 20 nodes of second hidden layer. 5 Compute the sparsity cost function \(J_{sparse}(W,b)=J(W,b)+\beta\sum_{j=1}^{s_{2}}KL(\rho\parallel\hat{\rho}_{j})\). 6 Parameter weights and bias are updated as \(W_{ij}(l)=W_{ij}(l)-\epsilon\frac{\partial}{\partial W_{ij}(l)}C_{sparse}(W,b)\) and \(b_{i}(l)=bi(l)-\epsilon\frac{\partial}{\partial W_{ij}(l)}C_{sparse}(W,b)\). 7 Train \(k\) sub-DNNs corresponding to the training data subsets. 8 Fine-tune the sub-DNNs by using backpropagation to train them. 9 The final structure of the trained sub-DNNs is obtained and they are labelled with each training data subset. 10 Divide the testing dataset into subsets with SC. Cluster centre parameters from the training data clusters are used. 11 The testing data subsets are used to test corresponding sub-DNNs, based on each corresponding cluster centre between the testing and training data subsets. /*aggregate each prediction result*/
12 Results are generated by each sub-DNN, are integrated and the final outputs are obtained. 13
14 returnclassification result = final output
```  
**Algorithm 2**SCDNN  
**returnclassification result = final output ```
**Algorithm 3**SCDNN  
**returnclassification result = final output
```

**Algorithm 4**SCDNN

**Theorem 4**. : _The training data subset \The eigenvectors of the point matrix and training dataset are generated by the SC output in Lines 1-2, the \(k\) DNNs are trained in Lines 3-9, the testing data subsets are obtained by calculating distance with the NJW algorithm in Line 10, the testing data subsets are used to test the DNNs, and the final results are predicted by the aggregation in Lines 11-13. ## 4 Experimental Results

These experiments examine and compare SCDNNs with other detection models: SVMs, BPNNs, RFs and Bayes. Six datasets from the KDD-CUP99 and NSL-KDD are used to evaluate the performance of all models. Then, the parameters, number of cluster and DNN weights are discussed and analysed. ### Evaluation Methods

In this study, accuracy, recall, error rate (ER) and specificity are used to evaluate the performance of the detection models. The formulas of the above criteria are calculated as follows [44]:

\[Accuracy=\frac{TP+TN}{TP+TN+FP+FN} \tag{20}\]

\[Recall=\frac{TP}{TP+FN} \tag{21}\]

\[ErrorRate=\frac{FP+FN}{FP+TP+TN+FN} \tag{22}\]

\[SPEC=\frac{TN}{TN+FP} \tag{23}\]

A true positive (TP) is a case that correctly distinguishes network attack type, a true negative (TN) shows normal network data classified correctly as normal, a false negative (FN) denotes a case in which an attack was classified as normal dataflow, and a false positive (FP) means that the a normal case was classified as an attack. The accuracy rate shows the overall correct detection accuracy of the dataset, ER refers to the robustness of the classifier, recall indicates the degree of correctly detected attack types of all cases classified as attacks, and specificity shows the percentage of correctly classified normal data.