## 3 The Proposed Approach of SCDNN
### The SCDNN Algorithm
The compared AUC value results for these ROCs in the six dataset are shown in Table 6.

Figure 7: (**a–f**) Receiver operating curves (ROC) curves of the five models in the six datasets, shown with optimal values of \(k\) and \(\sigma\). Table 6 and Figure 7 show that the SCDNN has the largest AUC of the five models for the six datasets. This indicates that the SCDNN performed better than other models and can obtain higher detection rates in networks. Overall accuracy is used to generate the histograms and compare the results from the six datasets, as shown in Figure 8. This is a more detailed evaluation of classification performance for all five types (one normal and four attacks). In real intrusion data, there is an unbalanced distribution among the four attack cases, and the scale of the data is larger [54]. Models in literature are difficult to categorise, so it is important for intrusion detection models to detect sparse attack cases. The results shown in Figures 7 and 8 indicate that the SCDNN produces higher accuracy than other methods in the six datasets; thus, the proposed algorithm performs well on datasets with a range of distributions. In particular, the Bayes algorithm has best recall of 92.57% and the SCDNN method obtains best accuracy of 91.97% in Dataset 1. In Dataset 2, the BPNN has a best recall, of 92.88%, higher than that of the SCDNN method. The reason for this disparity may be that the percentage of attack cases is larger in the training dataset, which leads to the Bayesian and BPNN approaches developing larger probabilities for these active cases. From the above experiment, we see that the SCDNN algorithm is not only good at detecting normal dataflow, as well as DoS and Probe attacks, but also obtained higher accuracy for sparse attack types, U2R and R2L, in the six datasets. The SCDNN model is a suitable approach for intrusion detection in complex networks. From the above discussion, the problem of selection number clusters is a general problem for all clustering methods [7]. In this paper, the proposed method combined the SC clustering technique \begin{table}
\begin{tabular}{l c c c c c} \hline \hline
**Dataset** & **SVM** & **BP** & **RF** & **Bayes** & **SCDNN** \\ \hline Dataset 1 & 0.88 & 0.82 & 0.94 & 0.93 & 0.95 \\ Dataset 2 & 0.95 & 0.78 & 0.94 & 0.94 & 0.95 \\ Dataset 3 & 0.95 & 0.88 & 0.94 & 0.94 & 0.95 \\ Dataset 4 & 0.82 & 0.72 & 0.78 & 0.80 & 0.83 \\ Dataset 5 & 0.71 & 0.61 & 0.80 & 0.79 & 0.82 \\ Dataset 6 & 0.61 & 0.56 & 0.58 & 0.61 & 0.65 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Area under curve (AUC) values for the ROCs of each model in the six datasets. Figure 8: Average precision histograms for the five models compared between the six datasets. and DNN ensemble algorithm; the parameters of the number \(k\) of clusters and \(\sigma\) were obtained from experiment results of six datasets. For other domain datasets, according the distribution of datasets, the range of \(k\) is set 2 through \(n\) and the range of \(\sigma\) is set 0.4 through 0.6 can be detected the effectiveness of the proposed method, in which \(n\) is number of categories [28; 55]. Otherwise, for a large data set, the time complexity should be a major consideration because it spends more time for processing the training and detecting intrusion network. The novel optimized algorithm is considered for parallel computing and cloud computing. ## 6 Conclusions

In security technology, low-frequency attack events are challenging to predict and can severely threaten networks. As such, this paper puts forward a novel approach that takes advantage of spectral clustering and deep neural networks to detect attack types. In the first stage, network features are captured by clusters and divided into \(k\) subsets in a bid to discover more knowledge and patterns from similar clusters. In the second stage, highly abstract features are obtained by deep learning networks from the subsets produced during the clustering process. Finally, testing subsets are used to detect attacks.