## 3 The Proposed Approach of SCDNN
### The SCDNN Algorithm
First is clustering the training dataset; the numbers of clusters \(k\) ranges from 2 to 6, and the value range of \(\sigma\) in the SC algorithm is 0.1 to 1.0. The training data subsets are divided based on the values of \(k\) and \(\sigma\). Different parameters impact the experiment results. In order to obtain the best efficiency, the average detection accuracy rate of the SCDNN is determined for the six datasets. These results are shown in Figure 3.

\begin{table}
\begin{tabular}{l c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Dataset**} & \multicolumn{6}{c}{**Training Dataset**} & \multicolumn{6}{c}{**Testing Dataset**} \\ \cline{2-11}  & **Normal\%** & **DoS\%** & **Probe\%** & **U2R\%** & **R2L\%** & **Normal\%** & **DoS\%** & **Probe\%** & **U2R\%** & **R2L\%** \\ \hline Dataset 1 & 17.96 & 72.28 & 7.583 & 0.096 & 2.079 & 19.48 & 73.90 & 1.339 & 0.073 & 5.205 \\ Dataset 2 & 19.48 & 78.40 & 1.645 & 0.021 & 0.451 & 19.48 &



Figure 3a-f shows testing results from the six datasets obtained from different values of \(k\) and \(\sigma\). For almost all datasets, SCDNN performs best when \(\sigma\) is between 0.4 and 0.5; likewise, the optimal value of \(k\) is between 2 and 5. In order to clearly explain the testing selection process, the best parameters for the five attack types in each dataset are shown in Figure 4.

SCDNN prediction accuracy of the five network intrusion types with optimum \(\sigma\) values are highly volatile with increasing values of \(k\) in all datasets. A high \(k\) value can efficiently improve SCDNN accuracy; more clusters can be divided into smaller data subsets, which damages the integrity of the input data features and leads to poor SCDNN performance. U2R and R2L attacks comprise a small proportion of the dataset, which prevents the classifier from learning enough information and causes unbalanced dataset categories. Cluster number can determine how well the particular features of underrepresented attack types are mined; therefore, it is necessary to strikes a balance between the number of cluster and efficiency. The optimal values of \(k\) for each dataset (that is, those with the best SCDNN accuracy) are presented in Table 2.

Figure 3: (**a–f**) Comparing SCDNN accuracy over several cluster numbers \(k\) and \(\sigma\) values for the six datasets. Figures 3 and 4 and Table 2 show that accuracy rates are volatile when \(k\) is less than 4, while great stability can be obtained when \(k\) is greater than 5. The best results occur when \(k\) is set to 2 in Dataset 1, with an overall accuracy of 91.97% and high DoS, probe and R2L detection rates. This implies that the clustering process can be classified into normal and attack types, which helps the SCDNN maintain efficient network intrusion categories. In the same way, the best results occur when \(k\) is 4, 5, 3 and 3 in Datasets 2 to 5, respectively. The total accuracy is 44.55% in the Dataset 6 when \(k\) is set to 5. \begin{table}
\begin{tabular}{l c c c c c c c c} \hline \hline
**Dataset** & \(k\) & \(\sigma\) & **Nor (\%)** & **DoS (\%)** & **Probe (\%)** & **U2R (\%)** & **R2L (\%)** & **Accuracy (\%)** \\ \hline Dataset 1 & \(k\!=\!2\) & 0.5 & 97.21 & 96.87 & 80.32 & 11.4 & 6.88 & 91.97 \\ Dataset 2 & \(k\!=\!4\) & 0.4 & 98.42 & 97.2 & 70.64 & 3.51 & 1.57 & 92.03 \\ Dataset 3 & \(k\!=\!5\) & 0.5 & 97.61 & 97.23 & 65.96 & 4.39 & 6.59 & 92.1 \\ Dataset 4 & \(k\!=\!3\) & 0.4 & 96.17 & 75.84 & 53.37 & 3.00 & 3.01 & 72.64 \\ Dataset 5 & \(k\!=\!3\) & 0.4 & 97.19 & 74.51 & 48.37 & 5.00 & 0.62 & 71.83 \\ Dataset 6 & \(k\!=\!5\) & 0.5 & 84.20 & 50.02 & 52.66 & 1.50 & 0.98 & 44.55 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Detection accuracy of five attack types using the optimal number of clusters for each dataset. Figure 4: (**a–f**) Comparing SCDNN accuracy for different numbers of clusters \(k\) for the six datasets. Accuracy is low across attack types because attack features are similar to those of normal data and are hard to detect.