## 5 Discussion of Experimental Results
### Second-Stage Experimental Results  
This section describes the experimental process and results of the second stage of the two-stage fine-tuning algorithm. The first step of the second stage was to rank all of the \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline  & \multicolumn{3}{c}{**MLP**} & \multicolumn{3}{c}{**CNN**} \\ \hline
**Attack Class** & **Original Data** & **Enhanced Data** & **Improved Rate** & **Original Data** & **Enhanced Data** & **Improved Rate** \\ \hline Probe & 67\% & 73\% & 6\% & 54\% & 60\% & 6\% \\ U2R & 7\% & 13\% & 6\% & 1\% & 8\% & 7\% \\ R2L & 0\% & 7\% & 7\% & 0\% & 15\% & 15\% \\ \hline \hline \end{tabular}
\end{table} 
Table 12: Accuracy of neural network models with SMOTE rare data enhancement (%). feature values of the NSL-KDD dataset in descending order by evaluating the information gain (I.G.) values [24]. Table 13 shows the ranking list values for the top 15 I.G. values. Information gain is calculated by entropy. Entropy is mainly used in machine learning to measure the amount of information obtained after the classification of each feature. The smaller the entropy, the larger the amount of information obtained. For classification, the greater the amount of information, the better the classification, that is, the higher the priority for decision making. Equation (8) represents the definition of entropy. For classification, when the entropy was larger, that is, the uncertainty of a certain classification feature \(X=x_{i}\) was greater, more information was needed to specify the classification status, that is, the classification was less effective. Equation (9) expresses the conditional entropy of a random variable Y conditional on a random variable X. Y is often used as a classification label. \(X=x_{i}\) is often used to indicate the selection of a feature \(x_{i}\). Finally, Equation (10) defines information gain as the information entropy of set Y to be classified, minus the conditional information entropy of Y for a feature X. Information gain is usually used as an indicator for feature selection in decision trees. For classification, a larger information gain means a better selection of feature X over label Y, that is, a better classification effect. In the second stage of the fine-tuning process, we first calculated the information gain values of all the NSL-KDD features and then arranged them in descending order to form Table 13. The higher the information gain of the features in this table was, the better the classification effect was. Therefore, in the next step of studying the optimal number of feature values, we followed the priority of deleting the feature with the smallest information gain in Table 13.  
\[Entropy(X)=-\sum_{i=1}^{n}p(x_{i})log_{2}p(x_{i}) \tag{8}\]  
\[Entropy(Y|X)=\sum_{x}p(x)Entropy(Y|X=x) \tag{9}\]  
\[Gain(Y|X)=Entropy(Y)-Entropy(Y|X) \tag{10}\] \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Ranking** & **Features No.** & **Features Values** & **I.G. Values** \\ \hline
1 & 5 & src\_bytes & 2.01736 \\ \hline
2 & 3 & service & 1.73376 \\ \hline
3 & 6 & dst\_bytes & 1.58831 \\ \hline
4 & 35 & dst\_host\_diff\_srv\_rate & 1.21264 \\ \hline
5 & 33 & dst\_host\_srv\_count & 1.18367 \\ \hline
6 & 34 & dst\_host\_same\_srv\_rate & 1.17743 \\ \hline
7 & 23 & count & 1.16354 \\ \hline
8 & 4 & flag & 1.02447 \\ \hline
9 & 40 & dst\_host\_rerror\_rate & 0.99752 \\ \hline
10 & 30 & diff\_srv\_rate & 0.96746 \\ \hline
11 & 29 & same\_srv\_rate & 0.93054 \\ \hline
12 & 41 & dst\_host\_srv\_rerror\_rate & 0.85818 \\ \hline
13 & 24 & srv\_count & 0.78858 \\ \hline
14 & 1 & duration & 0.67224 \\ \hline
15 & 27 & error\_rate & 0.62959 \\ \hline \hline \end{tabular}
\end{table} 
Table 13: Ranked list of top 15 information gain values. Figure 5a shows that when the feature number was changed to 15, the Probe recognition accuracy of the KNN classifier increased to 73% as the maximum.