# Intrusion Detection Based on Gray-Level Co-Occurrence Matrix and 2D Dispersion Entropy
## 3 Methodology and Materials
### Gray Level Co-Occurrence Matrices  
The GLCM is a statistical method for examining texture that considers the spatial relationship of pixels. The GLCM functions characterize the texture of an image by calculating how often pairs of pixel with specific values and in a specified spatial relationship occur in an image, creating a GLCM. In this context, the network flows features are used to create a grayscale image (256 levels of gray) X of size \(W_{S}\) (where \(W_{S}\) is the size of the sliding window) for \(N_{F}\) (where \(N_{F}\) is equal to the number of features or 78). Then, the GLCM is created on this grayscale image by calculating how often a pixel with the intensity (gray-level) value \(i\) occurs in a specific spatial relationship to a pixel with the value \(j\). Each element (\(i\),\(j\)) in the resultant GLCM is simply the sum of the number of times that the pixel with value \(i\) occurred in the specified spatial relationship to a pixel with value \(j\) in the input image. The GLCM is characterized by a number of hyperparameters in its definition: the most important is the quantization factor \(Q_{F}\) or the number of levels. From the original 256 gray levels of the source image, the GLCM introduces a new number of gray levels, specified as an integer: the \(Q_{F}\). This parameter is quite important because the number of gray-levels determines the size of the resulting GLCM. This means that regardless of the size (\(W_{S}*N_{F}\)) of the input grayscale image, the resulting GLCM image has size \(Q_{F}*Q_{F}\). The trade-off is that a larger \(Q_{F}\) may increase the granularity of the features on which the ML is applied, thus potentially increasing the detection accuracy. On the other side of the coin, a larger GLCM (and greater values of \(Q_{F}\)) increases the time to calculate the GLCM features and 2D Dispersion Entropy (2 DDE). Then the value of \(Q_{F}\) must be optimized. Another hyperparameter is the distance between a pixel of interest and its neighbor. It is possible to define not only the absolute distance among pixels but also the angle as shown in Figure 3. In the rest of this paper, the absolute distance is named \(G_{D}\) and each distance and angle is defined by a 2-tuple (e.g., [0 \(G_{D}\)]). A third parameter (Symmetric or Not Symmetric) is the order of values which can be counted only once or twice. When the hyperparameter is set to Symmetric the GLCM is calculated by counting the pairings twice. When the hyperparameter is set to Not Symmetric the GLCM is calculated by counting the pairings only once. Figure 3: GLCM distance and angle parameter with \(G_{D}=1\). An example of the calculation of the GLCM applied to a grayscale image of size \(4*5\) is provided in Figure 4 where \(Q_{F}=8\) and the distance/angle 2-tuple is set to [0 1]. In the original GLCM definition, it is possible to calculate the GLCM along all the possible directions, but an evaluation of the data set by the authors in this specific IDS context has shown that the additional directions not described in Figure 3 are duplications of the directions already identified and they would add unneeded computing efforts as they would grow the number of features on which the ML has to be applied. A quantitative confirmation that the angles shown in Figure 3 have an higher detection performance than using all the angles of the GLCM is provided in Section 4. Then, in the rest of this paper, we will use the 2-tuples [0 \(G_{D}\)], [\(-G_{D}\)], [\(-G_{D}-G_{D}\)], [\(-G_{D}\)\(G_{D}\)]. As described in the Introduction Section 1, the idea to use GLCM in the context of IDS is that the sequential structure of the network flows in case of an intrusion is altered in comparison to the legitimate traffic. Since the GLCM is created by calculating how often pairs of pixels with a specific value and offset occur in the image, the underlying idea of the approach is that numbers of pairs of pixels will be altered when an attack is implemented.