## 5 Research Method
It significantly improves upon the performance of its constituents by inducing highly perfect classifiers. **Feature Selection/Reduction Approaches:** Professionals understand that feature selection/reduction is essential to use data mining tools effectively. Feature selection/reduction has been an active area of research and development for many years in the field of ML and data mining [4]. This method selectsa subset of original features according to certain criteria by removing irrelevant or redundant features from the dataset to improve mining performance, such as prediction accuracy and the reduction of model building time [4; 36]. There are mainly two methods for feature selection/reduction, namely the wrapper method and the filter method. Researchers can use these methods with or without the discretize filter. The wrapper model needs one predetermined mining algorithm and uses its performance as the assessment criterion. It searches for features better suited to the mining algorithm in order to improve mining performance, but it is most likely to be more computationally expensive than the filter model. In this study, the authors used the procedure presented in the work of [PERSON] and [PERSON] [4] to identify a subset of features that has the best performance with the classification algorithm using an attribute evaluator and a search method (CfsSubsetEval + BestFirst). Next, the filter method depends on the general structures of data to evaluate and select feature subsets without involving any mining algorithm. In this study, the authors assigned ranks to all attributes in the dataset by using an attribute evaluator and a ranker method (InfoGainAttributeEval + Ranker), as described in the work of [PERSON] and [PERSON] [4]. The attribute ranked first had the highest priority. The authors omitted features with a lower rank at a time to assess the accuracy of the classifier at that point in time, as well as omitted features one after the other until the global minimum was reached. After the global minima, the dataset started overfitting and generating additional instances that were incorrectly classified. [PERSON] and [PERSON] [4] described discretization as a process of altering numeric attributes into nominal attributes by dividing each attribute's numeric values into a number of intervals. Consequently, discretization assists in improving accuracy and reducing the learning complexity of the classifier with which it is used. To attain this benefit, the authors discretized the dataset by applying an unsupervised discretize filter to the attributes. **Performance Measures:** The authors used performance measurements, particularly accuracy, time taken to build the model, and correctly and incorrectly classified instances, to evaluate and compare the performance of the tested classifiers. The descriptions of these parameters are as follows:  
The confusion matrix is a visualization tool that works as a basis for calculating all other parameters. It includes four values: true positive (TP), false negative (FN), false positive (FP), and true negative (TN). They are described as follows:  
**True Positive (TP):** Normal instances that are identified correctly  
**False Negative (FN):** Abnormal instances incorrectly identified as normal  
**False Positive (FP):** Anomalous instances incorrectly recognized as normal  
**True Negative (TN):** Anomalous instances identified correctly as an attack  
**Accuracy** is one of the essential measures for describing the performance of any algorithm. It is the degree to which an algorithm can properly predict positive and negative instances, and it can be determined by the following formula: Accuracy = TP + TN/TP + FN + FP + TN. **Correctly Classified Instances:** Number of instances that were correctly identified  
**Incorrectly Classified Instances:** Number of instances that were incorrectly identified  
**Time Taken to Build the Model:** Time taken by a classifier to generate a model. Researchers usually measure it in seconds (s).