## 5 Data Analysis
### Complexity Analysis through Anomaly Detection Frame Work
```
0: FMtrain\(\mathcal{GF}\)\(\mathcal{FM}^{test}\)
1:\(l\)\(\leftarrow\)[(FM^{train},label)]
2:Build\(\_\)Profile\(train\)\(\leftarrow\)[1]\(\mathcal{GF}\)[\(SVM\)\(\mid\)\(KNN\)\(\mid\)\(ANN\)\(\mid\)\(ELM\)\(\mid\)\(NB\)]
3:for\(i=1\) to \(N\)do
4:Learn [Build\(\_\)Profile\(test\)]\(\leftarrow\)Trace\(i\)\(\epsilon\)(\(FM^{test}\)) is -normal- or- abnormal
5:endfor
```  
**Algorithm 1** Building Profile and Classification of traces  
Each adopted ML algorithm is tested with different possible parameter values and the results with optimum ones are displayed in the Table 2. The libSVM with the parameters \(n=5\) (cross validation value), \(s=0\) (default type of SVM), \(t=2\) (radial basis kernel function), \(d=5\) (degree in kernel function), \(g=0.14\) (as we have 7 features of each trace so 1 divided by the 7) and rest all on default values. Similarly, KNN with \(k=5\) (e.g., \(k\)-fold cross validation), ELM with number of hidden neurons = 50, activation function = radbas, value to normalize DLL count = max DLL count plus 5 (e.g., this value is used to divide each feature instance of \(FM\) in the ELM case to normalize the data points between 1 and \(-1\)), and ANN with \(i=21\) (\(i\) shows the number of neurons) and activation function = sigmoid. The DR, FAR and the processing time of each algorithm along with DDLLC feature construction scheme are calculated with these parameters. In Table 2 the result actually reflects the complexity of both data sets, mainly in terms of accuracy. The DR was obtained by dividing the number of traces detected as attack by the total number of test attack traces. The FAR is a joint average error related to an FNR and FPR [3]. An FNR was obtained by dividing the number of incorrectly detected traces as attacks by the total number of test attack \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Algorithms**} & \multicolumn{3}{c}{**ADEA-WD**} & \multicolumn{3}{c}{**ADEA-WD-SAA**} \\ \cline{2-7}  & **DR\%** & **FAR\%** & **Processing Time** & **DR\%** & **FAR\%** & **Processing Time** \\ \hline SVM & 64 & 13 & 55 & 61 & 18 & 52 \\ KNN & 59 & 16 & 12 & 53 & 23 & 12 \\ ANN & 48 & 10 & 32 & 42 & 12 & 34 \\ ELM & 69.3 & 15 & 72 & 65 & 21 & 72 \\ NB & 72 & 12 & 55 & 68 & 14 & 48 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Complexity of data sets using DDLLC as feature construction. traces, and FPR by dividing the number of incorrectly detected traces as attacks by the total number of normal validation traces. Therefore, FAR was given by:  
\[FAR=(FPR+FNR)/2\times 100\]  
It can be observed that both the linear and non-linear classifiers were unable to achieve the optimum performance for either data set for three main possible reasons: firstly, both data sets included sophisticated attacks, which resulted in a high similarity between the data points of normal and attacked traces; secondly, the feature construction scheme DDLLC was unable to assist classifiers in ascertaining natural differences between attacked and normal traces; and thirdly, an un-normalized distance was observed in the data points of the \(FV\) for all traces, which might have affected the classification capability of a particular classifier. Moreover, it can be observed in Table 2 that all the classifiers performed better for ADFA-WD than ADFA-WD-SAA which demonstrates the sophistication of stealth attacks.