## 3 Theoretical Background  
Everyday events rely on monitored input data. The IDS generates accurate alarms as informative output, reflecting the events under surveillance. Its primary function involves analyzing the input data [29; 30]. Alerts are generated and streamed to show whether intrusions are present. The categorization of every input data stream unit as either standard or invasive represents a random variable \(X\). A low value (\(X\) = 0) indicates regular and non-intrusive traffic. In contrast, a high value (\(X\) = 1) indicates an incursion. Similarly, a random variable \(Y\) represents the output information from the IDS, with \(Y\) = 1 denoting an intrusion warning and \(Y\) = 0 denoting no signal [29; 30]. Intrusion detection can be patterned using a binary symmetric channel, which incorporates information theory and provides a framework for understanding intrusion detection. The base rate, or prior probability (\(B\)), denotes the chance of intrusions in the input data that the Intrusion Detection System (IDS) has detected. Denoted as \(\gamma\), the false negative rate (\(FN\)) indicates the likelihood of an intrusion event being categorized as usual (\(p(Y=0\ \ |\ X=1)\)); on the other hand, the false positive rate (\(FP\)), represented by \(\alpha\), is the likelihood that a typical event will mistakenly be classified as an incursion (\(p(Y=1\ \ |\ X=0)\)). In this instance, \(X\) stands for the IDS input's random variable. For IDS output, \(Y\) stands for the random variable. It is, therefore, feasible to characterize intrusion detection capabilities accurately [29; 30]. Figure 3 illustrates the application of Binary Symmetry in an Intrusion Detection Model. We suggest a new metric called Intrusion Detection Capability, or CID. It is the simple ratio of the input's entropy to the mutual information between the IDS's input and output. Entropy and mutual information are related--\(H(X)\) = \(I(X;\,Y)\) + \(H(XjY)\), for instance. The entropy \(H(Y)\) is significantly greater than \(H(X)\) on the right. This represents a plausible IDS scenario in which \(H(X)\) is almost zero due to a minimal base rate that is almost zero. However, the IDS may generate a lot of false positives. Therefore, \(H(Y)\) may be greater than \(H(X)\). Let \(X\) and \(Y\) be the random variables representing the IDS input and output, respectively. The definition of Intrusion Detection Capability is Equation (1):  
\[C_{\text{ID}}=\frac{\text{I}\left(X\,;\,Y\right)}{\text{H}\left(X\,\right)} \tag{1}\]  
Equation (2) allows us to articulate the idea of \(C_{ID}\) (Conditional Intrusion Detection) based on our knowledge of mutual information and information theory:  
\[C_{\text{ID}}=\frac{\text{H}\left(X\right)-\text{H}\left(X1\,Y\right)}{\text{H }\left(X\right)} \tag{2}\]  
When considering this, we quantify the decrease in ambiguity about the Intrusion Detection System input using mutual information. Equation (2) illustrates that the \(C_{ID}\) represents the proportion of uncertainty reduction in the Intrusion Detection System input due to the Intrusion Detection System output. Practically speaking, the \(C_{ID}\) value is between 0 and 1. An increased \(C_{ID}\) value indicates an improved ability of the Intrusion Detection System to classify events [29; 30]. The mutual information \(H(X)\) formula (Equation (3)) defines the mutual information of an event [14].