# Intrusion Detection Based on Gray-Level Co-Occurrence Matrix and 2D Dispersion Entropy
## 4 Results
### Optimization
The second is that they show that the 2 DDE features have a better performance than the other features. This result justifies the assumption done in this paper for the application of 2 DDE to the problem of IDS. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Hyper-Parameter** & **Description** & **Range** & **Optimal Value** \\ \hline \(Q_{F}\) & GLCM quantization function & [12,16,20,24,28, 32,36,40,44,48] & DDoS \(Q_{F}=44\), Port Scan \(Q_{F}=40\) \\ \(W_{S}\) & Size of the sliding window & [100,200,300,400,500] & DDoS and Port Scan \(W_{S}=100\) \\ \(G_{D}\) & GLCM distance & [1,2,3,4] & DDoS \(G_{D}=2\) and Port Scan \(G_{D}=1\) \\ \(N_{B}(DT)\) & Number of branches in the Decision Tree algorithm & [4... 20] & DDoS \(N_{B}=12\), Port Scan \(N_{B}=8\) \\ \(\gamma\) and \(C\) (SVM) & \(\gamma\) and \(C\) in the Support Vector Machine algorithm & \(2^{[4...12]}\),\(2^{[4...12]}\) & DDoS, Port Scan \(\gamma=2^{7}\) and \(C=2^{8}\) \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Summary of the hyperparameters in the proposed approach and related optimal values. Figure 7 shows only the first 8 features. Then, a more extensive analysis of the detection performance of each of the 64 features was carried on by setting the optimal value of the other hyperparameters (\(G_{D}\), \(Q_{F}\) and \(W_{S}\)). The results are shown in Figure 8a,b where the ER is reported for each feature identified with the \(F_{ID}\) identifier. To better visualize the features related to 2 DDE a red bar is used in the Figures. Figure 8a,b show that the 2 DDE is able to obtain a consistent high detection accuracy in comparison to the other features for all the 64 features. In particular, for both attacks, the values of \(m=2\) and \(c=3\) in the 2 DDE definition provides a better performance than the values of \(m=3\) and \(c=2\) in the 2 DDE definition. This result shows the higher detection performance of 2 DDE in comparison to the other features (e.g., Shannon entropy or variance). The results shown in these figures also give an indication on the GLCM angle, which is most performing. In general, the GLCM distance and angle defined by the 2-tuple [0 \(G_{D}\)] (which corresponds to \(F_{ID}=1\ldots 8\)) provides better results (in terms of detection accuracy) than the other 2-tuples. Figure 6: Dependence on GLCM distance \(G_{D}\) and Window size \(W_{S}\) using best selected features. DT algorithm is used. The importance of 2 DDE in comparison to other features for the IDS problem is also visible, once SFS is applied to select the optimal set of features on the basis of the value of hyperparameters already set. The results of the application of SFS is presented in Table 4, where the 10 best features are shown respectively for the DDoS and the Port Scan attack. In Table 4, the 2 DDE features are highlighted in red. It can be seen that the 2 DDE features are substantially present among the 10 best features, which shows the the application of 2 DDE to this specific problem is an important element to achieve an higher detection accuracy of the attack. \begin{table}
\begin{tabular}{l l} \hline \hline
**Attack** & **Ten Best Features** \\ \hline Port Scan (\(W_{S}=100\), \(G_{D}=1\)) & [2,7,13,15,38,42,49,53,54,62] \\ DDoS (\(W_{S}=100\), \(G_{D}=2\)) & [5,15,24,32,34,54,56,59,63,64] \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Ten best features obtained for the Port Scan and the DDoS attack using the SFS approach. DT algorithm is used. Figure 7: Dependence on GLCM distance \(G_{D}\) and \(W_{S}\) using the first 8 features (\(F_{ID}=1\ldots 8\)). DT algorithm is used.