## 4 Application of Methodology
### KDD '99 Dataset  
The rationale for utilizing the KDD '99 dataset in this study is due to its large size and widespread use within the field. The dataset contains 41 features in total, including 9 basic features and 32 derived features. These derived features are divided into three different categories including content features, host-based traffic features, and time-based traffic features. The KDD '99 dataset is composed of 38 states and 5 groups, including normal, DoS, probe, u2r, and r2l. In the training dataset, 22 states are included, but the test dataset has 16 additional attack types that are not included in the training dataset. The KDD '99 training dataset was used to develop the proposed model for the training stage, and the attack types were labeled as \"dos\", \"probe\", \"u2r\", or \"r2l\", and normal situations were labeled as \"normal\" to identify whether the result was an attack or not. The proposed model utilized feature selection methods to choose important features and extracted rules from both signature-based situations, where the result could be directly determined, and anomaly-based behavior of the traffic. The KDD '99 testing dataset was utilized to evaluate the model's effectiveness during the testing phase. Each feature in the dataset is grouped with the traffic situation result (normal/dos/probe/u2r/r2l) (service-result, src_bytes-result, dst_bytes-result, etc.). To select important features for the result, the number of groups formed by each feature and their impact were compared to a threshold value that was previously calculated. Any feature above this threshold value was considered important and thus selected for use in the final analysis. In Figure 3b, when the \"service\" feature is separated according to the values and the attack status, 140 different groups have been formed. There is usually a heterogeneous distribution when looking at the connected service types and attack types. There are two different states for the \"IRC\" service, and the \"normal state\" is quite obvious. There are three different cases in the \"ecr_i\" service type. The type of attack in this service type also increased, but there is still a clear difference between the numerical distributions. As a result of the grouping of the \"service\" feature, \"probe\" attacks represented 48, \"dos\" attacks represented 56, \"r21\" attacks represented 7, \"u2r\" attacks represented 4, and \"normal\" situations represented 25 different service types. The \"service\" feature provides the algorithm with four cases in the dataset, but contains five different cases as a result of the developed algorithm. The proposed feature selection II method included specific parameters that were used to identify important features. Based on this method, the \"service\" feature was found to be significant and remained above the threshold value, thus meeting the criteria for inclusion in the final feature list. In summary, Table 2 displays the selected features that will be used in our model, as determined via the proposed feature selection approach. These features were identified using a combination of our previous study's equation and feature selection Algorithms 1 and 2. With the proposed feature selection algorithms, 10 features were selected among 41 features. In our previous study [38], 22 features were selected from 41 features when intrusions were  
Figure 3: (a) Grouping result of “_root_shell_” feature; (b) grouping result of “_service_” feature. distinguished from the normal network traffic flows. With the updated algorithms, we decreased the number of features from 22 to 10 features. By using the features that were selected from the basic features of the KDD '99 dataset specified in Table 2, rules for the signature-based model that can directly obtain an attack result were extracted. These rules were stored by labeling them as \"normal, dos, probe, u2r, r2l\". Within this step, 30% of the KDD '99 dataset could be classified for different attack types. This situation allows us to save time and memory.