## 4 Evaluation
### Dataset Overview  
The KDD Cup is the leading data mining competition in the world. The NSL-KDD dataset was proposed to solve many issues represented in the KDD Cup 1999 dataset. Many researchers have used the NSL-KDD dataset to develop and evaluate the NIDS problem. The dataset includes all types of attacks. The dataset has 41 features, categorized into three main types (basic feature, content-based, and traffic-based features) and labeled  
Figure 2: Proposed System Architecture. This flow chart represents the overall process. The process starts with the data source, the NSL-KDD dataset, followed by data analysis and some pre-processing techniques for data cleaning. Feature normalization and feature selection are performed in order to implement the later selected tree-based machine learning algorithm to classify whether there is an attack or not and the types of attack. as either normal or attack, with the attack type precisely categorized. The categories can be classified into four main groups Table 1, with a brief description of each attack type and its impact. The authors propose the NSL-KDD dataset with two separate datasets; the training and test sets, with randomized sampling containing numeric and symbolic data. The training set is not at the same probability distribution as the test set, making the task more realistic to a real-world application problem. The NSL-KDD dataset does not have a redundant record in the training and test sets, which may cause the specific algorithm to be biased toward a specific record during the training (learning) process. As shown in Table 2, the generated dataset consists of training and test sets, each associated with 41 features. In the NSL-KDD dataset, there are no duplicated records in the test set, helping the algorithms during learning to have a better detection rate. The categories in the test set are excluded in the training, which is also advantageous for our selection, as stated in Tables 2 and 3. As shown in Figures 3 and 4, dataset statistics are proposed for five attack categories for the training and test sets. \begin{table}
\begin{tabular}{c c} \hline \hline
**Attack Name** & **Attack Type** \\ \hline Denial of Service (DoS) & Memory resources \\ User to Root (U2R) & Passwords, root access \\ Remote to Local (R2L) & Network resources \\ Probe & Network sniffing and security control \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Attacks in the NSL-KDD dataset and their impact. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Attack Categories** & **Training Set Attack Names** & **Test Set Attack Names** \\ \hline \multirow{2}{*}{**Dos**} & back, land, Neptune, pod, smurf, & back, land, neptune, pod, smurf, \\  & teardrop & teardrop,(mail bomb), process table, \\  & ipsweep, nmap, portsweep, satan & ipsweep, nmap, portsweep, satan, \\  & ipsweep, nmap, portsweep, satan & mscan, saint \\ \hline \multirow{2}{*}{**U2R**} & Buffer overflow, load module, perl, & Buffer overflow, load module, perl, \\  & rootkit & rootkit, sqlattack, xterm, pst \\ \hline \multirow{4}{*}{**R2L**} & ftp-write, guess-passwd, imap, & ftp-write, guess-passwd, imap, \\  & multihop, phf, spy, warezmaster, & multihop, phf, spy, warezmaster, \\  & multihop, phf, spy, warezmaster. & xlock, xsnoop, rampguess, \\  & mpgetattack, HTTP tunnel, \\  & send-mail, named, warez client \\ \hline \end{tabular}
\end{table} 
Table 2: Training set and test set size.