# Intrusion Detection Based on Gray-Level Co-Occurrence Matrix and 2D Dispersion Entropy
## 3 Methodology and Materials
### Features and Hyperparameters  
As specified before, the proposed approach is based on a number of hyperparameters, which are summarized in the following bullet list with the related trade-offs:  
* \(W_{S}\) = the size of the sliding window. The trade-off is that a small value of \(W_{S}\) does not provide an image large enough for the application of GLCM while a large value of \(W_{S}\) limits the number of samples for the application of ML. * \(Q_{F}\) = Quantization factor in GLCM. A value too small may not provide enough granularity for an effective detection of the threat while a value, which is too large increases significantly the computing time. * GLCM distance and angle parameter in GLCM definition. There are no trade-offs but the optimal value must be selected. * GLCM symmetry. If the GLCM is applied with symmetry or asymmetry. There are no trade-offs but the optimal value must be selected. * \(c\) and \(m\) in the 2 DDE definition. \(c\) and \(m\) are bound by the value of \(Q_{F}\) as specified in [4]. * hyperparameters in the ML algorithm. For example, the maximum number of branches at each split in the Decision Tree algorithm. Beyond the hyperparameters identified above, a number of features were proposed by [PERSON] in its seminal paper on the design of GLCM and the related feature [30; 31], but not all the Haralick features are applicable to this context, either because they are computing intensive, because they are unstable for small images or because they are not relevant for the context. In addition, the use of all the Haralick Features in combination for the hyperparameters identified above would generate a search space which would be too large for the optimization process. After a preliminary assessment of the Haralick features, the following set of features were used for this study and they are listed in Table 2. The approach presented in this paper was to combine a pre-selected set of Haralick features in addition to 2 DDE with the _GLCM symmetry_ and _GLCM distance and angle parameter_ hyperparameters. The other Haralick features described in [31] were not used because their detection performance using ER was suboptimal in comparison to the features identified in Table 2: Difference Variance, Difference Entropy, Info Measure of Correlation, Maximum Correlation Coefficient. Note that in Table 2, Energy indicates the angular second momentand Homogeneity is the inverse difference moment on the basis of the terms described in [31]. As it is shown in Table 2 the GLCM is calculated on the gray image (created from the sliding window) for different values of the angle for a specific value of the distance \(G_{D}\). Then, the related features for each specific GLCM are calculated. For example, one GLCM is calculated for the angle [0 \(G_{D}\)] while another GLCM is calculated for the angle [\(-G_{D}\)]. The optimal set of features are selected using the forward sequential feature selection. In the forward sequential search algorithm, optimal features are added to a candidate subset while evaluating the criterion. Since an exhaustive comparison of the criterion value at all subsets of the 64 features from Table 2 (repeated for all the values of the hyperparameters) is typically infeasible, the forward sequential search moves only in the direction of growing from an initial feature (the one with the lowest ER when all the features are considered). The best ten features are used to calculate the final metrics of evaluation: ER, FPR, FNR. The number of ten has been adopted because it was the optimal value between the need to limit the number of features for the application of ML and the increase of detection accuracy (beyond ten features, the improvement in detection accuracy was minimal). Apart from the application of the ML algorithms, the difference of the discriminating power of 2 DDE in comparison to the other features to detect an attack can be visualized by the trends of the features in comparison to the network flows features.