## 5 Results and Discussion  
The results of the proposed method with the extracted rules are given in Tables 7-11. The test results are compared with similar methods that were used in the literature, which used machine learning algorithms, based on the performance metrics. After testing the proposed method, a 99.89% accuracy rate was found when detecting attacks, as shown in Table 7. Although the Decision Table and Decision Tree techniques yielded similar results, their performance was inferior to the proposed method in terms of running time and memory usage. The AdaBoost algorithm could not detect \"u2r\" and \"r2l\" attacks. In addition, when the proposed performance values were compared with state-of-the-art studies, the detection rates of the proposed method were higher when detecting  
\begin{table}
\begin{tabular}{|l|l|l|l|} \hline sttl\textgreater{}=max(normal\_dest,time) & response\_body\_len\textgreater{}0 & attack \\ \hline sttl\textgreater{}=max(normal\_dest,time) & sc\_dst\_src\_ltm\textless{}min(normal) \& skbytes-cavg(normal) & attack \\ \hline sttl\textgreater{}=max(normal\_dest,time) & sc\_tim\textgreater{}min(normal)\textless{}ct\_dst\_src\_ltm\textless{}max(normal) \& min(normal)\textless{}bytes & normal \\ \hline ct\_dst\_src\_ltm\textgreater{}max(normal) & response\_body\_len\textgreater{}max(normal) \(\downarrow\) ct\_src\_dport\_ltm\textgreater{}max(normal) & attack \\ \hline service\text  
the U2R attack type in the dataset. These attacks are much fewer in the dataset compared to other types of attacks. Therefore, in cases where the distribution is not homogeneous, these algorithms cannot perform effectively. In order to reduce the overfitting, the datasets were split into training, validation, and test sets. Before the classification stage, the data preprocessing phase as well as the most appropriate features were selected to decrease the level of overfitting. In addition, a large amount of training data were used to reduce overfitting. Most of the time, using a bigger dataset helps the model to learn the underlying patterns of the data efficiently, which decreases the level of overfitting. The proposed method and ML algorithms' detection rates (DRs) are given in Table 8 when classifying types of attacks. After the attacks were separated from the normal network traffic flows, further classification was performed to find out the types of attacks. As can be seen in Table 8, the proposed method outperformed most of the ML classifiers when classifying attack types. For instance, when classifying probe attacks, the proposed method correctly detected 98.67%, while Naive Bayes detected 85.21%, DecisionTree 98.53%, Decision Table 93.10%, SMO 95.12%, and AdaBoost 63.41%, respectively. Similar results were obtained when normal and other attack types including DoS, U2R, and R2L were classified. When the proposed method was tested on the UNSW-NB15 dataset, it was seen that an accuracy rate of 98.84% was achieved for intrusion detection (Table 9). The Decision Table algorithm and Decision Tree algorithm also produced high results, but they were not as successful as the proposed method. In addition, the detection rates of other machine learning techniques in the dataset were quite low compared to the proposed technique in determining the attack types. At the same time, the SMO algorithm could not detect \"backdoor\", \"analysis\", or \"worms\" attack types. The AdaBoost algorithm, on the other hand, was not successful in detecting attack types other than \"normal\" and \"generic\". Although these algorithms were successful in identifying the attacks, they made the wrong choice when determining the type of attack. The traces of these attacks in the dataset are very close to each other. Therefore, the tested generic ML algorithms do not work effectively when the traces are not sharp.