## 3 Materials and Methods
### Proposed Methodology  
The proposed approach is based on the ensemble of deep learning and machine learning models for intrusion detection, as shown in Figure 1. Ensemble approaches have been applied by researchers to improve the efficacy of various classification tasks.  
However, for the said purpose this study combines MLP and RF using soft voting criteria. In soft voting, the result of high probability is considered as the final output. The working of the proposed ensemble model is presented in Algorithm 1.  
The soft voting criteria of the proposed model are expressed as  
\[\widehat{p}=argmax\underset{i}{\sum}RF_{i},\underset{i}{\sum}\,MLP_{i} \tag{5}\]  
where \(\underset{i}{\sum}\,RF_{i}\) and \(\underset{i}{\sum}\,MLP_{i}\) are the probability values against the test sample. Then, the probability values for each instance by RF and MLP pass through the criteria based on soft voting as presented in Figure 2.  
The working of the RFMLP can be discussed with an example. A probability score is assigned to each sample that has passed through the RF and MLP. For example, let the probability value of the RF model be 0.4, 0.7, 0.3, and 0.6 for 4 classes, respectively and the  
\begin{table}
\begin{tabular}{l l l} \hline \hline
**Domain** & **Attack Type** & **Attack Time** \\ \hline \multirow{8}{*}{Terrestrial attacks} & Botnet & 15:01\(\rightarrow\)15:10 \\  & Web attack & 15:21\(\rightarrow\)15:31 \\  & Backdoor & 15:41\(\rightarrow\)15:52 \\  & LDAP DDoS & 16:01\(\rightarrow\)16:11 \\  & MSSQL DDoS & 16:21\(\rightarrow\)16:30 \\  & NetBIO DDoS & 16:41\(\rightarrow\)16:50 \\  & Portmap DDoS & 17:01\(\rightarrow\)17:13 \\  & Syn DDoS & 17:21\(\rightarrow\)17:32 \\  & UDP DDoS & 17:41\(\rightarrow\)17:52 \\ \hline \multirow{2}{*}{Satellite attacks} & Syn DDoS & 15:23\(\rightarrow\)15:570 \\  & DUP DDoS & 16:52\(\rightarrow\)17:20 \\ \hline \hline \end{tabular}
\end{table}
Table 4: Detail of STIN dataset.  
\begin{table}
\begin{tabular}{l l} \hline \hline
**Class** & **Description** \\ \hline Normal & User behavior simulate connections. \\ DoS attack & Resources or services use is denied to authorized users. \\ Prob attack & Information about the system is revealed to unauthorized entities. \\ U2R attack & Access to account types of administrators is gained by unauthorized entities. \\ R2L attacks & Access to hosts is gained by unauthorized entities. \\ \hline \hline \end{tabular}
\end{table}
Table 3: Detail of classes in KDD-CUP 99 and NSL-KDD datasets.  
probability value of the MLP model be 0.5, 0.4, 0.6, and 0.8 for 4 classes, respectively where \(P(x)\) presents the probability value of \(x\) that ranges from 1 to 4, the final probability will be computed as:  
\[P(1) =(0.4+0.5)/2=0.45\] \[P(2) =(0.7+0.4)/2=0.55\] \[P(3) =(0.3+0.6)/2=0.45\] \[P(4) =(0.6+0.8)/2=0.7\]  
The proposed RFMLP predicts the final output by joining the predicted probability values of both models on the highest average probability.  
```
input data \((x,y)_{i=1}^{N}\) \(M_{RF}\) = Trained RF \(M_{MLP}\) = Trained MLP for\(i=1\) to \(M\)do if\(M_{RF}\
eq 0\) & \(M_{MLP}\
eq 0\) & \(training\_set\
eq 0\)then \(P_{MLP_{1}}=M_{MLP}.probability(class1))\) \(P_{MLP_{2}}=M_{MLP}.probability(class2))\) \(P_{MLP_{3}}=M_{MLP}.probability(class3))\) \(P_{MLP_{4}}=M_{MLP}.probability(class4))\) \(P_{RF_{1}}=M_{RF}.probability(class1))\) \(P_{RF_{2}}=M_{RF}.probability(class2))\) \(P_{RF_{3}}=M_{RF}.probability(class3))\) \(P_{RF_{4}}=M_{RF}.probability(class4))\)  Decision function = \(max(\frac{1}{n}\sum_{classifier}(Avg(P_{MLP_{1}},P_{RF_{1}}),Avg(P_{MLP_{2}},P_{ RF_{2}})\) \(,Avg(P_{MLP_{3}},P_{RF_{3}}),Avg(P_{MLP_{4}},P_{RF_{4}}))\) endif  return final label \(\widehat{p}\) endfor
```  
**Algorithm 1** Ensembling RF and MLP.  
Figure 1: Architecture of the proposed methodology for DDoS attack detection.