# A Filter Feature Selection Algorithm Based on Mutual Information for Intrusion Detection
## 4 Experiment and Results
### Experiment and Analysis
#### 4.3.2 User-to-Root Test Experiment  
In this section, the detection performances of different models are shown for the U2R and normal samples in the test set. In the training phase, the numbers of normal samples and U2R samples are 1800 and 200, respectively, while in the testing phase, the numbers of normal samples and U2R samples are 1800 and 200, respectively.  
In the U2R test data, due to the small amount of data, repeated sampling is used. The selected features with different feature selection methods are summarized in Table 7 and are used to detect U2R. It can be seen that the numbers of selected features with the MIFS (\(\beta\) = 0.3) [19], mRMR [20], MMIFS [32] and RPFMI algorithms are almost the same.  
Table 8 shows the results of the confusion matrices for the normal and U2R data in different models. Among these 10 models, the RPFMI + SVM models has fourth largest TN and the second highest TP. The ACC, DR, FPR and PR with these models are illustrated. The highest ACC (i.e., 96.19%) is obtained with the RPFMI algorithm (Figure 5). Compared with the other models, the RPFMI model has the second highest DR (Figure 6) and the FPR of RPMI is only larger than those of the MIFS [19] and FMIFS [33] models (Figure 7). The RPFMI model ranks second in terms of the PR (Figure 8). Therefore, the proposed RPFMI algorithm demonstrates its ability to improve both the ACC and the PR.  
\begin{table}
\begin{tabular}{c c c} \hline
**Algorithm** & **Number of Features** & **Selected Features** \\ \hline MIFS (\(\beta\) = 0.3) [19] & 15 & 8, 9, 16, 21, 22, 23, 4, 27, 10, 12, 20, 19, 26, 39, 15 \\ MIFS (\(\beta\) = 0.7) [19] & 19 & 8, 9, 16, 21, 22, 23, 10, 4, 27, 12, 20, 19, 26, 17, 15, 5, 39, 14, 18 \\ mRMR [20] & 16 & 8, 9, 16, 21, 22, 23, 4, 27, 10, 39, 15, 12, 11, 18, 14, 19 \\ MIPS \(-\) U (\(\beta\) = 0.3) [21] & 3 & 8, 1, 2 \\ MIFS \(-\) U (\(\beta\) = 0.7) [21] & 3 & 8, 1 \\ CIMI [22] & 2 & 8, 1 \\ MMIPS [32] & 14 & 8, 9, 16, 21, 22, 23, 4, 27, 39, 10, 15, 11, 18, 14 \\ FMIFS [33] & 9 & 8, 9, 16, 21, 22, 23, 27, 4, 10 \\ RPFMI & 16 & 8, 9, 16, 21, 22, 23, 10, 4, 27, 39, 15, 11, 14, 18, 12, 19 \\ \hline \end{tabular}
\end{table}
Table 7: Features selected by different feature selection algorithms using the user to root (U2R) classifier.  
Figure 4: Precision Rate on the DOS test data.  
Figure 5: Accuracy on the U2R test data.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Model** & **FP** & **FN** & **TN** & **TP** \\ \hline All features & 670.7667 & 119.8667 & 1129.233 & 80.1333 \\ MIFS (\(\beta=0.3\)) [19] & 0.8 & 139.0333 & 1799.2 & 60.9667 \\ MIFS (\(\beta=0.7\)) [19] & 4.6667 & 128.2333 & 1795.333 & 71.7667 \\ mRMR [20] & 7.3333 & 70.5333 & 1792.667 & 129.4667 \\ MIFS \(-\) U (\(\beta=0.3\)) [21] & 9.8333 & 90.9 & 1790.167 & 109.1 \\ MIFS \(-\) U (\(\beta=0.7\)) [21] & 9.8333 & 90.9 & 1790.167 & 109.1 \\ CIMI [22] & 9.9333 & 101 & 1790.067 & 99 \\ MMIFS [32] & 5.2400 & 101.6 & 1794.76 & 98.4 \\ FMIFS [33] & 1525 & 0.0273 & 275 & 199.9727 \\ RPFMI & 6.6667 & 69.5333 & 1793.333 & 130.4667 \\ \hline \hline \end{tabular}
\end{table}
Table 8: Confusion matrices in different models using the U2R test data.  
Figure 6: Detection Rate on the U2R test data.