# Intrusion Detection Based on Gray-Level Co-Occurrence Matrix and 2D Dispersion Entropy
## 4 Results  
### Optimization  
This sub-section provides the results on the optimization of the hyperparameters described in the previous sections. A grid approach was used to determine the optimum values of the hyperparameters. While, other methods (e.g., gradient, meta-heuristics algorithms) could be more efficient, it should be considered that the ranges of values for each hyperparameter are quite limited. In addition, the intention is to show in an explicit way the impact of each hyperparameter for the detection performance. The metric is used to determine the optimal values of the hyperparameters. Figure 5: Trends of two features on the CICIDS2017 data set (DDoS and legitimate traffic only) and \(W_{S}=100\). The purple bars indicate the labels of the DDoS attack. The summary of the hyperparameters used in this study, the optimal values and the range of the hyperparameters are shown in Table 3. In the rest of this sub-section and related figures, we show how a specific hyperparameter impacts the detection accuracy of the threat both for DDoS attack and Port Scan attack. For each presented result, the other hyperparameters are set to the values identified in Table 3. The Decision Trees (DT) ML algorithm was used to generate the results provided in this sub-section. As shown in Section 4.3 the DT algorithm has a higher detection performance than the SVM and Naive Bayes algorithms. The following figures describe the results for the evaluation of the proposed approach for different values of the hyperparameters and for the different features used in the study. In most cases, the evaluation of a single hyperparameter is provided while the other hyperparameters are set to the values described in Table 3 unless otherwise noted. Figure 6a,b show respectively for the Port Scan and the DDoS attacks, the impact of the GLCM distance \(G_{D}\) for different values of the window size \(W_{S}\). These results are obtained using all the 64 features identified in Table 2. It can be noted that the optimal value of \(W_{S}\) is 100 network flows, as the ER increases with larger values of \(W_{S}\). This may due to the reasons that the difference between legitimate traffic and the traffic related to the attack are more evident when the \(W_{S}\) is relatively small. On the other side, \(W_{S}=100\) is the lower limit of \(W_{S}\) to allow the GLCM to operate on a grayscale picture large enough to obtain meaningful values. Figure 6a shows that a value of \(G_{D}=1\) is optimal to detect the Port Scan attack, while Figure 6a shows that a value of \(G_{D}=2\) is optimal for the DDoS attack. These results seem to indicate that there is no need to use values of \(G_{D}\) larger than 2, which would also be more computing intensive. Then, the impact of the quantization factor \(Q_{F}\) was evaluated. As described before, the quantization factor in the GLCM definition is an important factor in the application of GLCM. A large value of \(Q_{F}\) provides an higher granularity which can be beneficial in the application of the ML algorithm for the detection of the threat. On the other side, a large value of \(Q_{F}\) is more computing expensive for the calculation of the GLCM features and 2 DDE as the resulting GLCM matrix are larger (the GLCM size is \(Q_{F}*Q_{F}\)). This is an important trade-off, which was investigated for each specific feature and for each attack. Figure 7a,b shows the impact of the \(Q_{F}\) parameter on the detection accuracy respectively for the Port Scan and the DDoS attack for the first 8 features (only the first 8 features are provided in these figures for reasons of space, but subsequent figures will consider all features). The value of \(W_{S}\) is set to 100 since the previous Figure 6 has shown that \(W_{S}=100\) is the optimal value for attack detection. Figure 7a,b provide two important results: the first is that they identify the optimal value of the \(Q_{F}\) parameter (\(Q_{F}=40\) for the Port Scan attack and \(Q_{F}=44\) for the DDoS attack).