# Intrusion Detection Based on Gray-Level Co-Occurrence Matrix and 2D Dispersion Entropy
## 5 Conclusions  
This study proposes a novel approach for IDS based on anomaly detection which is based on the transformation of the network flows metrics into grayscale images. Then, the Gray-Level Co-occurrence Matrices (GLCM) are calculated on the grayscale images and features are calculated on the GLCM. Beyond the application of well known GLCM Haralick features (i.e., contract, homogeneity, entropy), this paper proposes the novel application of 2D Dispersion Entropy (2 DDE) recently proposed in literature. The results show that the application of 2 DDE to GLCM significantly enhances the detection accuracy of the proposed IDS. The approach is applied to the recently published CICIDS2017 data set for two specific attacks: DDoS and Port Scan. The results of this approach are compared with the results obtained by other studies on the same CICIDS2017 data set obtaining an Error Rate (ER) which is higher or comparable with the results obtained with more sophisticated approach based on Deep Learning, which requires considerable more computing resources than our proposed approach. In addition, the False Negative Rate (FNR) obtained with our approach is significantly better than all the other results obtained in literature. On the other side, the False Positive Rate (FPR) is slightly worse than the results obtained in literature. This may due to the possibility that the transformation of the network flows features to gray level images and then GLCM-base features has the tendency to lose the specific characteristics of the attack related traffic in comparison to the normal traffic. Future developments will try to improve the FPR by adopting improvements of the proposed approach in different directions. One direction would be to use Fuzzy Gray-Level Co-occurrence Matrices since it has demonstrated a superior performance in some \begin{table}
\begin{tabular}{l l l l l l} \hline
**Attack and Set of Angles** & \(W_{S}=100\) & \(W_{S}=200\) & \(W_{S}=300\) & \(W_{S}=400\) & \(W_{S}=500\) \\ \hline Port Scan (all angles: 128 features) & 0.0081 & 0.0279 & 0.0311 & 0.0311 & 0.0292 \\ \hline Port Scan (subset of angles: 64 features) & 0.0048 & 0.0078 & 0.0098 & 0.0112 & 0.0125 \\ \hline DDoS (all angles: 128 features) & 0.0026 & 0.0032 & 0.0045 & 0.0048 & 0.0062 \\ \hline DDoS (subset of angles: 64 features) & 0.0016 & 0.0029 & 0.0035 & 0.0046 & 0.0051 \\ \hline \end{tabular}
\end{table} 
Table 6: Comparison on the set of GLCM angles using Error Rate (ER): subset of angles used in this study in comparison to the use of all the GLCM angles. \begin{table}
\begin{tabular}{l l l} \hline
**Approach Step** & **Computing Time (s)** & **Attack** \\ \hline Decision Tree algorithm execution & 1 s & DDoS \\ \hline GLCM computation & 34 s GLCM & DDoS \\ \hline
2 DDE computation & 63 s GLCM & DDoS \\ \hline Decision Tree algorithm execution & 1 s & PortScan \\ \hline GLCM computation & 31 s GLCM & PortScan \\ \hline
2 DDE computation & 83 s GLCM & PortScan \\ \hline \end{tabular}
\end{table} 
Table 7: Computing times in seconds (s). applications, but it has not been used in IDS problems. Another direction would be the application of non linear GLCM where the quantization factor is calculated in a non linear way. The significant number of hyperparameters to tune in the approach (both in the GLCM definition and 2D dispersion entropy definition) is also a challenge to mitigate for a practical deployment of this approach. One possibility to resolve the challenge would be to investigate the application of meta-heuristics algorithms (e.g., particle swarm optimization) to automatically tune the hyperparameters. Another possibility would be to investigate the hyperparameters optimization in other data sets to generalize the selection of the optimal values. Finally, the combination of GLCM together with Deep Learning algorithms will also be considered. For example, Convolutional Neural Networks (CNN) could be applied to the GLCM representations rather than the initial gray-scale images derived directly from the network flows statistics.