## 3 The Proposed Model
### ANFIS-Based Intrusion Detection Model  
In this phase, the ANFIS model is applied to recognize intrusions. ANFIS, developed by [PERSON], integrates the benefits of neural networks (NNs) and fuzzy systems [27]. It employs an NN learning algorithm to automatically extract the input and rules of the sample dataset automatically, thus forming an ANFIS that includes five layers. Figure 2 demonstrates the infrastructure of ANFIS. ANFIS is a kind of artificial intelligence (AI) method which integrates the strength of fuzzy logic or artificial neural network (ANN) techniques. ANFIS is a hybrid method which utilizes a fuzzy inference system (FIS) embedding in an NN structure. The FIS module of ANFIS was utilized for representing the linguistic rules which describe the connections amongst inputs and outputs in a provided system. The NN module was utilized for adjusting the parameter of the FIS, namely the rule weights and the membership function parameters, based on the input-output training dataset. This enables the ANFIS to \"learn\" the relation between inputs and outputs, and to make prediction regarding new input value. ANFIS is used for a large number of tasks, involving time series prediction, control, and function approximation. It is an advanced type of fuzzy logic system that is able to learn and adapt by utilizing a learning mechanism. The learning method adjusts the parameter of the fuzzy system to enhance the performance based on the training dataset. The adaptive components of ANFIS make it especially pertinent for the application where the fundamental system is subjected to changes over time, viz., in modeling the dynamic system.  
It is an extension of the conventional fuzzy system and has an analogous structure that comprises the fuzzy inference, input and output layers. Briefly, the ANFIS integrates the capability to characterize vague or uncertain knowledge of the FIS with the capability to learn from information of the NNs. Therefore, it leverages the knowledge of human expertise and data from the environments to increase performance.  
Figure 2: Structure of ANFIS [27].  
Layer 1: Each node is an adaptive node. The output of layer 1 is the fuzzy membership grade of inputs, as shown in Equations (14) and (15):  
\[O_{i}^{1}=\mu_{A_{i}}(x)i=1,2 \tag{14}\]  
\[O_{i}^{1}=\mu_{B_{i-2}}(y)i=3,4 \tag{15}\]  
where \(\mu_{A_{i}}(x)\), \(\mu_{B_{i-2}}(y)\) adopts the fuzzy membership function.  
Layer 2: The nodes are fixed. They are labeled with \(M\), specifying that they play simple multipliers as given in Equation (16):  
\[O_{i}^{2}=\omega_{i}=\mu_{A_{i}}(x)\mu_{B_{i}}(y)i=1,2 \tag{16}\]  
Layer 3: The nodes are fixed nodes. They are labeled with \(N\), representing that they execute the normalization to the firing strength from the preceding layer as defined in Equation (17):  
\[O_{i}^{3}=\omega_{i}=\frac{\omega_{i}}{\omega_{1}+\omega_{2}}i=1,2 \tag{17}\]  
Layer 4: The node is adaptive. The output of all nodes is the product of the normalized firing strength and the first-order polynomial (first-order Sugeno model), as given in Equation (18):  
\[O_{i}^{4}=\overline{\omega}_{i}f_{i}=\overline{\omega}_{i}(p_{i}x+q_{i}y+r_{ i})i=1,2 \tag{18}\]  
Layer 5: There is one fixed node labeled with \(S\). This node is played as a summation of each incoming signal:  
\[O_{i}^{5}=\sum_{i=1}^{2}\overline{\omega}_{i}f_{i}=\frac{\sum_{i=1}^{2}\omega _{i}f_{i}}{\omega_{1}+\omega_{2}} \tag{19}\]  
The final output of ANFIS is defined in Equation (20):  
\[\begin{array}{ll}f_{out}&=\overline{\omega}_{1}f_{1}+\overline{\omega}_{2}f _{2}=\frac{\omega_{1}}{\omega_{1}+\omega_{2}}f_{1}+\frac{\omega_{2}}{\omega_{ 1}+\omega_{2}}f_{2}\\ &=(\overline{\omega}x)p_{1}+(\overline{\omega}x)q_{1}+(\overline{\omega}x)r_ {1}+(\overline{\omega}x)p_{2}+(\overline{\omega}x)q_{2}+(\overline{\omega}x) r_{2}\end{array} \tag{20}\]