## 4 Discussions Alongside Numerical Experiments
### LTN-Based Intrusions Detection in Network Traffic  
Our second example aims to distinguish between normal connections and intrusion attacks on the same dataset. The ideal case for an intrusion detection model is to detect the exact type of attack, but as it can be observed in Figure 1, where a logarithmic scale was needed, the data for some attacks is scarce. It is helpful to note that in our dataset, each connection has a feature called _label_ that depicts the type. With the help of a Python Data Analysis Library called Pandas [26] and some background knowledge provided in [27], we know that all attack types fall into the category of DOS, R2L, U2R, or probe. As such, to help with the scarcity of some attacks and make a good prediction possible, we grouped all the intrusions by the category that they belong to. With **DOS (denial of service)** attack types, a huge amount of repeated server requests is sent with the malicious intent of using the victim resources, blocking any possible connections, or even forcing a shutdown/reboot. \"back\", \"land\", \"neptune\", \"pod\", \"smurf\" and \"teardrop\" are attacks from KDD99 dataset that fall into this category. **R2L** are attacks aimed to gather local data from another computer or server. The way this is conducted may be different, but the goal is the same. Attacks can try to query the computer/server, \"guess\" the password via social engineering, or create local Trojan files to log any activity. In our dataset, \"ftp_write\", \"imap\", \"multihop\", \"phf\", \"spy\", \"warezclient\" and \"waremaster\" are R2L attacks. **U2R** attacks happen when the attacker has access to another computer/user from the targeted network. It is meant to gain control of the root. This is possible by exploiting weaknesses in software and while it can be avoided, a complex software is prone to fall victim to this attack. In KDD99, \"buffer_overflow\", \"loadmodule\", \"perl\" and \"rootkit\" are attacks that target the root. **Probe** attacks are different from the ones mentioned before. Some of these attacks, such as \"ipsweep\", \"nmap\", \"portsweep\" and \"satan\" search for any possible weakness in the targeted computer. Usually in the form of connected IPs or open ports. A very helpful analysis of the KDD99 dataset and the impact of the features in intrusion detection can be found in [28]. Taking a look at that analysis and our exploration of the dataset, connections normal, smurf and neptune represent the vast majority and after grouping them, DOS and normal types are predominant. Figure 1: Distribution of connection types before removal of duplicatesIt is to be noted that most DOS attacks work by sending a large volume of traffic to the network system. This attack category is without a doubt the most popular one, with smurf attack type being by far the most predominant one in this category in the original dataset, see Figure 2. After removal of duplicates, with the intent of reducing the size of the dataset and improving its quality, that is no longer true. The results after the removal of duplicates can be observed in Figure 3.  
To classify the intrusions correctly, we normalized the data, one-hot encoded the categorical values, and kept only the relevant features. This feature relevance shapes the logic part of our neuro-symbolic framework and makes it possible to use real logic to detect possible attacks. The relevant features are used to split the dataset into a training set and a testing set, which are later used for training the model. As described, our goal with this exampled is to be able to use LTN to distinguish between a normal connection and an intrusion while also categorizing the latter. For that, logic needs to be defined and training of the model is necessary. Each of the possible groups of connections is represented as a label and is used to define the axioms. To cover all the possible scenarios and add some constraints to make overfitting less likely, we used the following set of real logic axioms. Figure 3: Data distribution after removal of duplicates.