## 4 Experiments and Results  
The BHL algorithm is applied as a clustering technique to identify the internal structure of the 3 datasets and any anomalous situations present in each one. As, the dataset condition in a great manner the selection of optimal parameters, different values combinations of \(\alpha\) and \(\beta\) parameters were tried and the best combination was selected (Table 1). Once the best parameters were obtained,several runs with random weights initialization were performed for validating the repeatability of the obtained results. In the case of the k-means algorithm, to ensure good results in the creation of the cluster, the k-means algorithm was random initialization of the centroids, and the training was repeated 20 times. These repetitions allow avoiding to finish the training in a local minimum. In all cases, Matlab software was used to analyze the 3 datasets with both algorithms. The implmentation of BHL was done according to previous researches [37] and the Matlab version of the k-means algorithm was used. Table 2 shows the best combination of parameters and Figures 1-6 the projections for each dataset and algorithm (BHL and k-means). The axes of BHL projections correspond to the first two components of the new subspace (as non-linear combinations of the original space), which do not have any meaning or direct relationship with the variables of the original dataset. Figure 2, shows the best projection of BHL for dataset 1, it shows that BHL can clearly identify 3 clusters which correspond to each scan port attack (port numbers 161, 162, and 3750). Figure 3 shows the results obtained in past researches. It can be observed that, like BHL, there also were 3 clusters in the results, which correspond to different types of scan port attacks. Therefore, due to the simplicity of this dataset, it is not possible to get better results, and in all cases, the scan port attack can be identified easily (k-means clustering was applied to the projected data representation). Nevertheless, in the case of dataset 2, the are significant differences. In the case of BHL, its projection shows a clear distinction between a normal (green crosses Figure 4), and an abnormal situation (MIB transfer source-destination, red dots in Figure 5). In the case of MOVICAB-IDS, the final projection mixes both classes (normal and attack), in different clusters (see Figure 5). \begin{table}
\begin{tabular}{|p{56.9 pt}|p{113.8 pt}|p{113.8 pt}|p{113.8 pt}|} \hline
**Dataset** & **Description** & **N\({}^{0}\) Samples** & **N\({}^{0}\) of Attacks** \\ \hline
1 & Type of attack: Scans. In this type of attack, diverse messages are sent to various host ports to extract information about the activity status. An external agent could send these messages with the aim of getting information about host network services. However, in the case of a network scan, the target of several hosts is a specific port (frequently, a single IP address range for all hosts). The target port numbers are 161, 162, and 3750 in the same IP address range for all machines. & 866 & 18 attacks \(\times\) 3 ports = 54 attacks \\ \hline
2 & Type of attack: MIB (management information base) Information Transfer. In this attack part of the information (or all) of SNMP MIB is captured, usually by means of get/get-bulk command, which represents a potentially dangerous situation. However, some queries of MIB could belong to a “normal” network behavior. & 5000 & 226 attacks \\ \hline
3 & Type of attack: It is a combination of Scan and MIB Information Transfer. & 5866 & 18 attacks \(\times\) 3 ports = 54 port attacks and 226 MIB attacks \\ \hline \end{tabular}
\end{table} 
Table 1: Dataset description.