## 2 Materials and Methods
### Features Selection  
The features are acquired with the Spleen application [18], and the structure of the variables are similar to KDD99 [19]. It is important to make clear that neither the database nor the same number of features of KDD99 were used, just its structure. The dataset is acquired from normal traffic and under attack samples and finally labeled by the application. The data is captured from the network traffic samples during peak hours.  
Principal component analysis (PCA) was the method selected to extract the attributes, because it is a useful technique for very large-dimensional datasets compared to other analysis tools that are limited to low-dimensional datasets [20]. The relevant advantage of PCA for anomaly detection is its capacity to identify high and low values of the features with high accuracy [21]. In this work, PCA is employed for the feature selection phase, in order to reduce the dimensionality in the feature space. The method has been employed in previous approaches for feature selection for IDSs, specifically with KDD, NSL-KDD and CAIDA, among others [22, 23, 24]. In the work of [PERSON], _et al._[24], they employed the critical eigenvalue test. The test recommends using the principal components whose eigenvalues exceed the threshold \(\tau_{e}=d^{0.6}/15\), where \(d\) is the dimension of the dataset before the feature selection process. With our dataset, the threshold is \(\tau_{e}=0.7136\). The rest of the features are assumed to contain redundancy and noise. In previous works, the significant features of KDD were calculated for 19 of the original 42,but we had to calculate the relevant features again, because our dataset is different from KDD, as was stated before.  
With the selected features, it is necessary to learn the search space with a machine learning technique. Many machine learning approaches, such as genetic algorithms (GA), support vector machines (SVM), artificial immune systems (AIS), decision trees or ANN, among others, have been applied to anomaly detection, and although it is possible to find differences regarding the detection results between those methods, their effectiveness is not so different, so the machine learning technique employed in this work is ANN [25], because it is a well-known Machine Learning (ML) method with proven performance for anomaly detection and there are many approaches to compare with our results [2,5,9,10,21,26].  
The basic attributes are analyzed in different network scenarios as unusual TCP flags, the number of out of sequence packets and the average of the payload size [27]. The number of connections and the percentage of connections are statistical features based on the host checking the number of packets with the optimal connection during the three-way hand-shake process and synchronization. Other features are based on the behavior change detector (BCD) as shown in Table 1. The advantage of BCD features for IDS is their capacity to detect anomaly changes in events during connection [28, 29, 30].  
The features are shown in lines through an array of \(m\) trainings and \(n\) features. Datasets are generated in comma separated value (CSV) files, and they contain 52 features. The selected features are numeric and the non-selected features are represented as a null value with the \"S\" symbol. Null fields for the non-selected features are then simplified into a new variable. The connections structure is represented in the next matrix. The feature representation is based on the number of connections and the number of features.  
\[\begin{array}{cccc}F_{11}&F_{12}&...&F_{1 xn}\\ F_{21}&F_{22}&...&F_{2 xn}\\ \vdots&\vdots&\vdots&\vdots\\ F_{mx1}&F_{mx2}&...&F_{mxn}\end{array}\]  
The main variables are a combination of the original features stored in a new matrix that represents the network profiles. Network scenarios have different features and data traffic, according to frequent services, virtual ports, traffic requests, the number of users, among others.