## 3 Proposed Solution
### Proposed Advanced Fitness Function for Feature Selection  
In this study, an improved fitness function is proposed for the selection of optimized features; this function can address overfitting by solving the problem of anomaly-detection performance from imbalanced security datasets. In general cases, fitness is calculated using classification precision, which can improve simple detection rates but has difficulty in considering erroneous detection and incomplete detection, along with the possibility of overfitting. Lowering the erroneous detection probability is an important performance factor in anomaly detection as it is important in detecting attacks. In other words, it is necessary to reduce erroneous warnings that are issued by detecting a normal state as an anomalous state. In conclusion, it is necessary to develop a method to obtain optimal solutions that can simultaneously raise the detection rate and reduce the error rate. The fitness function proposed in this study solves the above problems. We introduce a new fitness function that uses detection probability, error detection probability, and the incomplete probability generated as a result of performing detection algorithms for the given data. The notations used are shown below. Figure 4: An example of binary decoding. \(\bullet\) NR = normal detection, AN = abnormal detection, FP = false positive, MD = miss detection \(\bullet\)\(c_{i}\triangleq i\)th chromosome = selected sub-feature set, \(i<population\) _size_ \(\bullet\)\(D_{k}\triangleq\) the number of \(k\) data instance, \(k\)\(\in\)(_NR_, _AN_, _FP_, _MD_) \(\bullet\)\(D_{k}(\epsilon_{i})\triangleq\) the number of predicted \(k\) data instance using the selected feature set \(\epsilon_{i}\), \(k\)\(\in\)(_NR_, _AN_, _FP_, _MD_) \(\bullet\)\(P_{k}(\epsilon_{i})\triangleq\) probability of \(k\), \(k\)\(\in\)(_NR_, _AN_, _FP_, _MD_) \(\bullet\)\(DR(\epsilon_{i})\triangleq\) detection rate using the selected feature set \(c_{i}\) \(\bullet\)\(ER(\epsilon_{i})\triangleq\) error rate using the selected feature set \(c_{i}\) \(\bullet\)\(\mathbf{w}_{bal}\triangleq\) balancing weight parameter of class imbalance = \(\frac{total\ number\ of\ anomalous\ record}{total\ number\ of\ normal\ record}\) To obtain the detection rate, normal and anomaly-detection probabilities should be calculated using the formula below. \[\mathbf{P}_{\text{NR}}(\epsilon_{i})=\mathbf{D}_{\text{NR}}(\epsilon_{i})/\mathbf{D}_{ \text{NR}} \tag{1a}\] \[\mathbf{P}_{\text{AN}}(\epsilon_{i})=\mathbf{D}_{\text{AN}}(\epsilon_{i})/\mathbf{D}_{ \text{AN}} \tag{1b}\]  
From Formulas (1a) and (1b), the detection rate \(DR(\epsilon_{i})\) can be obtained from the equation below. \[\mathbf{DR}(\epsilon_{i})\text{=}\frac{\mathbf{P}_{\text{NR}}(\epsilon_{i})+\mathbf{P}_{ \text{NR}}(\epsilon_{i})*\ w_{bal}}{\mathbf{2}} \tag{1c}\]  
Then the erroneous and incomplete detection probabilities should be obtained to calculate the error rate, which is expressed by the formulae below. \[\mathbf{P}_{\text{FP}}(\epsilon_{i})=\mathbf{D}_{\text{FP}}(\epsilon_{i})/\mathbf{D}_{ \text{NR}} \tag{1d}\]  
\[\mathbf{P}_{\text{MD}}(\epsilon_{i})=\mathbf{D}_{\text{MD}}(\epsilon_{i})/\mathbf{D}_{ \text{AN}} \tag{1e}\]  
From Formulas (1d) and (1e), the error rate \(ER(\epsilon_{i})\) can be obtained from the equation below. \[ER(c_{i})\text{=}\frac{\mathbf{P}_{\text{NR}}(\epsilon_{i})+\mathbf{P}_{\text{NR}}( \epsilon_{i})*\ w_{bal}}{\mathbf{2}} \tag{1f}\]  
\(\mathbf{w}_{bal}\) is used as a weight parameter for correcting the value of each rate to solve the class imbalance problem. The value is used to solve the problem that a measured class value is not evenly reflected in anomaly detection, where a class is very small or very large, which solves the problem of data imbalance. The fitness function obtained from the above derived Formulas (1c) and (1f) can be expressed as follows.