## 5 Experimental Results
### Experiment 2: Intrusion Detection after Feature Filtration  
This experiment focused on reducing the network features using the FLAME algorithm and exploring its impact on ID in terms of the DR, AC, and the FAR. Following the same approach adopted in Experiment 1, we first attempted to identify the best combination of parameter settings conducive to the highest DR and AC and the lowest FAR.  
Three sets of features are produced by applying the FLAME algorithm. Internal comparisons between these feature sets were performed to select the most appropriate features. All sets were evaluated by calculating their DR, AC, and FAR values to avoid redundancy when only one measurement was applied.  
The experimental results (Table 2) show that the proposed IDS can produce a DR of 100% when the number of features is reduced from 41 to 20. Furthermore, the detection accuracy values are approximately the same for the three sets of features. However, the FAR value was used to differentiate the three sets. This value can help to specify the optimal set of features. The highest FAR value (4.9). This was associated with a set of 25 features (Table 2). The second-highest FAR value was 1.6%. This is associated with 18 features. In contrast, the lowest FAR value (0.05% [Table 2]) was associated with a set consisting of 20 features. As a result, the optimal number of features for the process was 20.  
The results of the performance evaluation of the proposed IDS after feature filtration using the FLAME algorithm (Table 2) reveal that feature filtration has a positive impact on the detection of accuracy. The ID results were the best for the 20-feature set, and deteriorated when the number of features was reduced to 18. This suggests that the optimum number of features in the KDD99 dataset for ID is 20 and that reducing the number further results in the deterioration of the ID performance. It can be concluded that the actual number of critical features in this dataset is 20. Reducing the number of features below this number (20) corresponds to the exclusion of meaningful features, which deteriorates system performance. For comparison, the IDS parameter settings and associated values of the three performance metrics adopted in this study are listed in Table 3 for the ID experiments using the proposed IDS with and without feature filtration by the FLAME algorithm. Table 3 lists the best ID results obtained in the performance tests of the proposed IDS, indicating that the values presented in the last column of this table pertain to the 20-feature set.  
The comparison reveals that feature filtration significantly improves the performance of the proposed IDS after processing only 20 meaningful network features. The DR increased from 93.7% to 100% and the accuracy increased significantly from 84.3% to 99.9%. In addition, the FAR decreased substantially from 6.3% to 0.5% (Table 3). Moreover, Table 3 points out that the crossover probability increased after applying the FLAME algorithm from 0.7 to 0.9 and that Pm increased from 0.1 to 0.3. Increases in Pc and Pm indicate the breeding of new classifiers with high crossover and mutation capabilities. Attempting different combinations of network records helped obtain the optimal DR, accuracy, and  
\begin{table}
\begin{tabular}{c c c c} \hline
**DR\%** & **AC\%** & **FAR\%** & **\# Features** \\ \hline
99.98 & 99.90 & 1.6 & 18 \\ \hline
100 & 99.99 & 0. 05 & 20 \\ \hline
99.98 & 99.91 & 4.9 & 25 \\ \hline \end{tabular}
\end{table}
Table 2: Performance of proposed IDS after use of the FLAME algorithm for feature filtration.  
FAR values (Table 3). In addition, the number of generations decreased after the application of the FLAME algorithm from 1000 to 100 generations, which reduced the execution time and helped obtain better than before the DR, accuracy, and FAR values.