## 5 Research Method  
In this section, the authors describe the NSL-KDD dataset, Weka tools, ML classifiers, feature selection/reduction approaches, and the performance measures they used in this study. NSL-KDD Dataset: This is a refined version of the well-known KDDcup99 dataset [27] that is widely used for building an IDS. This dataset contains 125,973 instances with 41 features and an assigned label classifying each record as either normal or an attack [Table 1]. Many researchers have used this dataset to conduct different types of analyses and to apply various methods and tools for developing effective IDSs [28]. The NSL-KDD dataset has a subset named KDDTrain+-20 Percent dataset, which has 25,192 instances and represents 20% of the entire train dataset. Researchers can group it into four main classes, namely denial of service (DoS), Probe, U2R, and R2L. **Weka Package:** This is an open-source package that contains a number of ML classifiers used to perform different types of data mining tasks. Written in JAVA [29], the Weka package consists of tools for data pre-processing, regression, classification, clustering, association rules, and visualization. Researchers can evaluate the performance of available classifiers in Weka directly on the NSL-KDD dataset. To easily compare the classifiers in this study, the authors used some default features provided by Weka for ML classifiers, feature selection/reduction techniques, and the discretize filter. Weka has four applications: Explorer, Experimenter, Knowledge Flow, and Simple Command Line Interface. In this study, data were discretized using Weka, and the CfsSubsetEval wrapper method was used with a BestFirst search and 10-fold cross-validation. The InfoGainAttributeEval filter method was also used with Ranker search and 10-fold cross-validation. **Machine Learning Algorithms:** Researchers have proposed many ML classifiers to monitor and analyze network traffic for various anomalies. Among the several classifiers available in Weka, six well-known supervised classifiers that were compatible with the NSL-KDD training dataset were evaluated by the authors. They ran each classifier only once on the NSL-KDD training dataset, and the outcome performance was analyzed. To minimize any possible overfitting problem, a cross-validation mode and global minima adjustment were used. The supervised classifiers used were as follows: \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Number** & **Function** & **Number** & **Function** \\ \hline
1 & Duration & 22 & is\_guest\_login \\
2 & protocol\_type & 23 & Count \\
3 & Service & 24 & srv\_count \\
4 & Flag & 25 & serror\_rate \\
5 & src\_bytes & 26 & srv\_server\_rate \\
6 & dst\_bytes & 27 & rerror\_rate \\
7 & Land & 28 & srv\_error\_rate \\
8 & worng\_fragment & 29 & same\_srv\_rate \\
9 & Urgent & 30 & diff\_srv\_rate \\
10 & Hot & 31 & srv\_diff\_host\_rate \\
11 & num\_failed\_logins & 32 & dst\_host\_count \\
12 & logged\_in & 33 & dst\_host\_srv\_count \\
13 & num\_compromised & 34 & dst\_host\_same\_srv\_rate \\
14 & root\_shell & 35 & dst\_host\_diff\_srv\_rate \\
15 & su\_attempted & 36 & dst\_host\_same\_src\_port\_rate \\
16 & num\_root & 37 & dst\_host\_srv\_diff\_host\_rate \\
17 & num\_file\_creations & 38 & dst\_host\_server\_rate \\
18 & num\_shells & 39 & dst\_host\_srv\_server\_rate \\
19 & num\_access\_files & 40 & dst\_host\_error\_rate \\
20 & num\_outbound\_cmds & 41 & dst\_host\_srv\_error\_rate \\
21 & is\_host\_login & & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: The 41 features of the NSL-KDD dataset. **Reduced Error Pruning Tree (REPTree)**: This is a rapid decision tree learner based on C4.5. It is an algorithm used as a representative method in an attempt to clarify the problems of decision tree learning. REPTree builds a decision/regression tree based on information gain or by reducing variance [30].