## 3 Sparse Logistic Regression (SPLR)  
The goal of the sparse modeling is to select discriminative features for the IDS classification problem, while reducing the redundant and irrelevant features in order to obtain the high accuracy for the system. Suppose a prediction problem with \(N\) samples and \(y_{1},y_{1},y_{1},\ldots,y_{n}\) is outcomes. The features \(x_{j}^{i}\), where \(i=1,2,3,\ldots,N,j=1,2,3,\ldots,R\) and \(R\) is the input number of variable, let \(X\) represent the \(N\times R\) input matrix and \(Y\) represent the \(R\times 1\) output matrix.  
When the values \(\mathsf{y}\in\{+\mathbf{1},-\mathbf{1}\}\) class labels with (\(+1\)) corresponding to normal and (\(-1\)) corresponding to attack (abnormal). Logistic regression (LR) is a probability conditional model and can be defined as,  
\[p(y_{i}=\
icefrac{{+1}}{{w,x_{i}}})=\frac{1}{1+\exp^{(-w^{T}x_{i})}} \tag{1}\]  
For the attack classification problem, the values of \((y=+1/x_{i})\) correspond to the probability. It means that the decision to assign the category would be based on the probability estimate with a threshold based on maximizing the expected effectiveness.  
\[Y=\left\{\begin{array}{ll}+1&p\geq 0.5\\ -1&p\leq 0.5\end{array}\right.\]  
Maximum likelihood estimation of the parameter \(w\) corresponds to minimization of the negative log-likelihood.  
\[l(w)=-\sum_{i=1}^{n}\ln(1+\exp(-w^{T}x_{i}y_{i})) \tag{2}\]  
In many of the earlier works in the domain, the regularized logistic regression provides exceptional analytical performance across a range of fields such as text classification and image classification [24].  
Figure 1: Network Architecture for IDS.  
Different constraints on \(w\) is extensively studied. In order to overcome this problem, we employ sparsity constraint. One of the prominent sparse regression models is the least absolute shrinkage and selection operator (LASSO) proposed by [PERSON] [25], which utilize \(\ell 1\) regularizations; it can be defined as in (3).  
\[w^{*}=\arg\underset{w}{mix}|y-Xw|^{2}+\lambda|w|_{1} \tag{3}\]  
\[|w|_{1}=\sum_{j=1}^{R}|w|_{1} \tag{4}\]  
It has been proved that \(\ell 1\) regularization has the ability to estimate the feature selection into the loss function minimization [21]. The SPLR assume that the input features/variables are closely independent, meaning not highly correlated, which denotes the finest structure of input features. It can be said that a reasonable solution may be achieved in practice.  
In this work, we employ \(\ell 1\)-regularized logistic regression for discriminative feature selection and intrusion classification for the IDS via a sparse model as in Equation (5). Accordingly, for the purpose of feature selection, we have added a sparse regularization for the minimization of,  
\[f(w)=l(w)+\lambda g(w) \tag{5}\]  
Here, \(g(w)=\left\|w\right\|_{1}\) is the \(\ell 1\)-norm regularization and \(\lambda\) is a regularization parameter. As the direct approach to solving the logistic regression \(l(w)\) is ill-posed and may lead to overfitting in the classification results, a standard technique in avoiding overfitting is the sparse regularization/constraint which assumes \(\lambda>0\). The solution to the \(\ell 1\) norm regularized logistic regression can be interpreted in a Bayesian framework as the maximum a posteriori probability estimate of \(l(w)\). Figure 2 shows the taxonomy of discriminative feature selection and classification via SPLR.