\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={A Text Mining-based Anomaly Detection Model in Network Security},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2014 2014-01-15 (revised: 32 Year 2014 15 January 2014)}
\def\TheID{\makeatother }
\def\TheDate{2014 2014-01-15}
\title{A Text Mining-based Anomaly Detection Model in Network Security}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{Mohsen  Kakavand}

\renewcommand\Authands{ and }

\date{\small \em Received: 6 December 2013 Accepted: 3 January 2014 Published: 15 January 2014}

\maketitle


\begin{abstract}
        


Anomaly detection systems are extensively used security tools to detect cyber-threats and attack activities in computer systems and networks. In this paper, we present Text Mining-Based Anomaly Detection (TMAD) model. We discuss n-gram text categorization and focus our attention on a main contribution of method TF-IDF (Term frequency, inverse document frequency), which enhance the performance commonly term weighting schemes are used, where the weights reflect the importance of a word in a specific document of the considered collection. Mahalanobis Distances Map (MDM) and Support Vector Machine (SVM) are used to discover hidden correlations between the features and among the packet payloads. Experiments have been accomplished to estimate the performance of TMAD against ISCX dataset 2012 intrusion detection evaluation dataset. The results show TMAD has good accuracy.

\end{abstract}


\keywords{}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{Introduction}]{Introduction}\par
hanges in network security can be seen as a reliable estimation of transforming trends in the computer science. Information security is a significant issue in present and future life. It also seems to become more important with the development of cyber attacks against social media and mobile devices. \hyperref[b22]{Robertson et al. (2006)} referred to several web applications written by individuals with limited knowledge on security. According to CERT/CC, the number of cyber-attacks has increased from 1998 to 2002. Although attacks were relatively few in the early 1990s, a major increase has been reported since 2000 with about 25,000 attacks in 2000 \hyperref[b20]{(Malek \& Harmantzis, 2004)}. According to the Common Vulnerabilities and Exposures list (CVE) \hyperref[b5]{(Christey \& Martin, 2007}) and a recent survey on security threats dealing with security risks in digital network world, susceptibility of web application was 25\% of the total security issues \hyperref[b20]{(Malek \& Harmantzis, 2004)}.\par
In 1980 James Anderson introduced intrusion detection systems (IDS) \hyperref[b1]{(Anderson, 1980)} as a counteraction to the dramatic increase of hackers' attacks. There are two kinds IDS (Khalilian, Mustapha, Sulaiman, \& Mamat, 2011): misuse detection (MD) and anomaly detection (AD). The latter type generates a model of normal behavior, and removes skeptical behavior or any abnormality from the normal behavior. Anomaly detection is able to identify new attacks, but its main weakness is its vulnerability to false positive alarms. Misuse detection system or signature-based system utilizes knowledge to directly identify the effects of intrusion with high detection precision but is unable to detect new threats and attacks.\par
Some intrusions use the susceptibilities of a protocol; other attacks attempt to examine a site by probing and scanning. The attacks can be identified by analyzing the network packet headers, or controlling the network traffic connection affairs and session behavior. Patterns in the header fields are such as protocol ID (TCP, UDP, ICMP), Quality-of Service (QoS) flags, port number, and particular values at typical header fields, such as checksums, options, and time to live (TTL). Furthermore, attacks, such as worms, include the delivery of anomaly payload to a susceptible application or service. These attacks might be identified by checking the packet payload. Moreover, examples of payload patterns involve strings such as "GET" and "POST" in the payloads of the HTTP GET and POST request packets. Figure \hyperref[fig_0]{1} shows the structure of the HTTP GET-request packet, involving the "GET" subsequence pattern. This paper is organized as follows. In the second section, we review the related works and in the third section, we introduce text mining-based anomaly detection. In the fourth section, we present our system overview with its various subsections. Fifth section discusses the evaluation of TMAD model. Finally, we concluded the paper in the last section. 
\section[{II.}]{II.} 
\section[{Related work}]{Related work}\par
Many studies have examined anomaly detection in network traffic. The major obstacles to its practicality are high false-positive rates and lack of clarity and transparency in the detection procedure. The previous methods did not represent adequate precision of falsepositive rates. They also did not present diagnostic information to assist forensic analysis. Some previous methods considered packet header information or statistical properties of sets of packets and connections. Packet header anomaly detection systems such as SPADE  {\ref (} Analysis on packet header information typically reduces the data preprocessing necessities. Headers mainly constitute only a tiny part of the whole network data. Thus, processing needs less sources such as storage, memory and CPU. Additionally, features from packet header work quickly, with relatively low memory overheads and computation. Furthermore, they hinder some legal and privacy issues in regard to network packet analysis. Due to these benefits, several studies have utilized packet header as the major features in the intrusion detection systems. However, every request header feature set has its own features.\par
Therefore, they cannot be used to directly identify attacks bounded for application layer due to the attack bytes are often placed in the request body \hyperref[b7]{(Davis \& Clark, 2011)}.\par
Currently, approaches such as (Estévez-Tapiador, Garc?á-Teodoro, \& D?áz-Verdejo, 2004), PAYL \hyperref[b28]{(Wang \& Stolfo, 2004)}, \hyperref[b17]{(Kruegel, Vigna, \& Robertson, 2005)}, McPAD (Perdisci, Ariu, Fogla, Giacinto, \& Lee, 2009), SensorWebIDS \hyperref[b10]{(Ezeife, Dong, \& Aggarwal, 2008)} and FARM (Chan, Lee, \& Heng, 2013), were suggested for the analysis of packet payloads. These approaches were performed by defining features over payloads, and extracting models of normality based on these features. Packets being not fit into these models are anomalous and trigger alarms. These methods use fairly simple features computed over payload bytes.\par
Table \hyperref[tab_2]{2} summarizes the reviewed on packet payload approaches. The table classifies payload anomaly detections works based on the kinds of data preprocessing, major algorithms and detection of various attack categories such as DoS, Buffer overflow, R2L, XML DoS, U2R, etc.\par
Payload data analysis seems to be more expensive than packet header data analysis as it needs deeper packet inspection, more computation and obfuscation analysis approaches. Due to payload data analysis is complicated, most studies consider tiny subsets of the payload data or only the client-side sections of web content \hyperref[b7]{(Davis \& Clark, 2011)}.\par
This paper aims to examine language models derived from packet payload traffics. Additionally, this study attempts to develop a supervised and  G unsupervised learning algorithm that can be directly applied to extracted feature vectors. Thus, the present paper focuses on a major contribution of method TF-IDF (Term frequency, inverse document frequency) for improving an effective computation of measures between text categorization (n-grams).  
\section[{Text Mining-Based Anomaly Detection}]{Text Mining-Based Anomaly Detection}\par
Data mining seeks for patterns in data. Similarly, text mining seeks for patterns in text: Analyzing text involves extracting information useful for special goals(Ian H. Witten, Eibe Frank, 2011). Text mining seeks for patterns in natural language texts that are unstructured. Generally, text mining is influential in environments where huge numbers of text documents are managed. Knowledge discovery from text (KDT) considers the machine supported analysis of text. KDT employs methods from information retrieval, information extraction and natural language processing (NLP). Then, it links these three to the algorithms and approaches of Knowledge discovery from data (KDD), data mining, machine learning and statistics (Hotho, Andreas, Paaß, \& Augustin, 2005). Text mining is a popular area in anomaly detection which commonly involves the tasks such as clustering, classification, semi-supervised cluster, and so on.  In many practical application domains, the unsupervised learning approach is particularly suited when no labeling information is available. Moreover, in some applications the nature of the anomalous records is constantly changing. Thus, obtaining a training dataset that accurately describe anomaly is almost impossible. On the other hand, unsupervised anomaly detection is the most difficult setup since there is no decision boundary to learn and the decision is only based on intrinsic information of the dataset (Amer et al., 2013). 
\section[{Classification}]{Classification}\par
Semi-Supervised Cluster Analysis, in contrast with classification, is without direction from users. Thus, it may not produce highly valuable clusters. The quality of unsupervised can be highly developed through some weak forms of supervision. Such a clustering is called semi-supervised that is based on user's feedback or guidance constraints is called. (Jiawei Han and Micheline Kamber, 2011). In semi-supervised anomaly detection method, the algorithm models are the only normal records. Records that do not fit into this model are called outliers in the testing stage. Advantages of this semi-supervised anomaly detection can be easily understood of Models as well as normal behavior can be accurately learned but possible high false alarm rate -previously unseen (yet legitimate) data records may be recognized as anomalies \hyperref[b0]{(Amer et al., 2013)}.\par
However, TMAD model uses a machine learning method and statistical anomaly detection approach to determine an anomaly behavior in the network. 
\section[{IV.}]{IV.} 
\section[{System Overview}]{System Overview}\par
This section, represents a comprehensive introduction about the TMAD applying text mining techniques into payload-based anomaly detection. Additionally, the most important contribution of TMAD is the combination of TF-IDF approach and payload-based anomaly detection systems, which have not been investigated in previous studies. This intrusion detection system uses statistical analysis and machine learning algorithms, respectively and then comparison among supervised and unsupervised classifiers. Characters come into network traffic will be analyzed by Mahalanobis Distances Map (MDM) and Support Vector Machine (SVM) to recognize abnormal traffic data from normal ones. Figure \hyperref[fig_2]{2} shows the overview of TMAD model process. TF-IDF method: This study investigates the geometrical framework of language modeling. Furthermore, the vector space model and term frequency inverse document frequency (TF-IDF) weighting scheme are examined \hyperref[b3]{(Banchs, 2013)}. Term weighting schemes are often employed to develop the performance. In these schemes, the weights show the significance of a word in a particular document of the selected collection. Huge weights are appointed to terms often used in relevant documents but seldom in the whole document collection \hyperref[b12]{(Hotho et al., 2005)}. Thus, the data resources are processed and the vector space model is set up in order to represent a convenient data structure for text classification. This method is employed to explore similarity between the normal behaviors with the novel input traffic data. The vector space model presents documents as vectors in mdimensional space, i.e. each document d is explained by a numerical feature vector W(d) = (x (d , t 1 ), ? , x (d , t m ) . Therefore, a weight forW (d , t) a term t in document d is computed by term frequency tf (d,t) time inverse document frequency idf (t), describing the term specificity within the document collection. In addition to term frequency and inverse document frequency -defined as (1), a length normalization factor is employed to guarantee that all documents have equal chances of retrieving independent of their lengths \hyperref[b1]{(2)}. Where N is the size of the document collection D and nt is the number of documents in D containing term t. 
\section[{Global Journal of Computer Science and Technology}]{Global Journal of Computer Science and Technology}\par
Volume XIV Issue V Version I( D D D D D D D D ) G ?????? = (??) ?= ??????(?? ?? ?? ? ) (1) ??(??, ??) = ???? (?? ,??)?????? (?? ?? ?? ? ) ?? ?????? ?d,t j ? 2 ( ?????? (?? ?? ?? ?? ? )) 2 ?? ?? =1 ,\textbf{(2)}\par
In the following, the application of geometrical framework model in payload-based anomaly detection is explained.\par
Classifiers: two distinctive types of algorithms such as Mahalanobis Distances Map (MDM) \hyperref[b28]{(Wang \& Stolfo, 2004)} and Support Vector Machine (SVM) \hyperref[b23]{(Scholkopf et al., 1996)} are used. Mahalanobis Distances Map (MDM), some factors such as mean value and standard deviation are applied to each byte's frequency. For a payload model, the feature vector that is a set of relative frequencies is the occurrences of each ASCII character to the total number of characters that appear in the payload. Generally, each feature vector can be presented as \hyperref[b3]{(3)}. Then, the mean value and standard deviation of each byte's frequency are computed and explained as ( \hyperref[formula_2]{4}), ( \hyperref[formula_3]{5}), ( \hyperref[formula_4]{6}) and ( \hyperref[formula_6]{7}) respectively. The mean value and standard deviation vectors, and , are stored in a model M.?? = [?? 0 ?? 1 ? ?? 255 ]\textbf{(3)}?? ? = [??? 0 ??? 1 ? ??? 255 ]\textbf{(4)}?? ? = [?? ? 0 ?? ? 1 ? ?? ? 255 ]\textbf{(5)}??? ?? = 1 ?? ? ?? ??,?? ?? ??=1 (0 ? ?? ? 255) (\textbf{6})?? ? ?? = ? 1 ?? ? (?? ?? ? ??? ?? ) 2 ?? ??=1 (0 ? ?? ? 255)\textbf{(7)}\par
The model considers the correlations among various features (256 ASCII characters). Therefore, for each network packet, a feature vector is defined by (3). Here, there are the average value of features in the 1gram model (  {\ref 8}) and the covariance value of each feature \hyperref[b9]{(9)}. To investigate the association among the characters, where ? is the average frequency of each ASCII character presented in the payload, ?i is the covariance value of each feature. Next, the classifiers between two characters \hyperref[b10]{(10)} are presented:?? = 1 256 ? ?? ?? 255 ??=0 (8) ? ?? = (?? ?? ? ??) (?? ?? ? ??)? (0 ? ?? ? 255) (9) ?? (??,??) = ??? ?? ??? ?? ? ??? ?? ??? ?? ?? ? ?? + ? ?? (0 ? ?? ? 255)\textbf{(10)}\par
MDM is a statistical method or a model-based method that is created for the data. The objects of the study are evaluated with respect to how well they fit into the model. According to the above evaluation, the MDM of a network packet is made as matrix D. Then, the Mahalanobis distance between two distributions of D and the model M is evaluated. Then, the weight w is calculated using \hyperref[b11]{(11)}, if the weight is larger than a threshold, the input packet is considered as an intrusion.?? = ? 255 ,255 ??,?? ( ?? ???? (??,?? ) ? ?? ? ?????? (??,?? ) )2\par
?? ?????? (??,?? ) 2 \hyperref[b11]{(11)} In the following, the Support Vector Machine (SVM) algorithm is chosen. This algorithm is originally proposed by Scholkopf et al. in \hyperref[b23]{(Scholkopf et al., 1996)}. SVM have been shown to achieve good performance in text mining classification problems \hyperref[b25]{(Sebastiani, 2002)}. It is also known as a supervised classification algorithm that is able to process feature vectors of high dimensions for providing a fast and influential approach for learning text classifiers (LEOPOLD \& KINDERMANN, 2002). Typically, document d is presented by apossibly weighted -vector (?? ??1 , ? ?? ???? ) of the counts of its featur. A SVM can only separate two groups -a positive group L1 (shown by y = +1) and a negative group L2 (shown by y = -1). In input vectors, a hyperplane might be defined by setting y = 0 as follows: The SVM algorithm identifies a hyperplane placed between the positive and negative examples of the training set. Figure \hyperref[fig_4]{3} shows the parameters bj are adapted in a manner that the distance ?-called margin -between the hyperplane and the closest positive and negative example packet payload is maximized. This considers a limited quadratic optimization issue which can be resolved for a huge number of input vectors. The documents that have distance? from the hyperplane are known as support vectors and identify the actual location of the hyperplane \hyperref[b12]{(12)}.?? = ? ??? ?? ?????? ? = ?? 0 + ? ?? ?? ?? ???? ?? ?? =1\textbf{(12)}\par
Typically only a tiny fraction of payloads are considered as support vectors. A new document with term vector ?? ?? ????? is classified in L1 if the value ? ??? ?? ?????? ? > 0 and into L2 otherwise. If the packet payload vectors of the two classes are not linearly separable, a hyperplane is selected. Classifier approaches identify patterns of packet payloads in network traffic data. These are undertaken in extracting the hidden correlations V. 
\section[{Experimental Results}]{Experimental Results}\par
This The entire ISCX labeled dataset comprises nearly 1512000 packets and covered seven days of network activity. However, the ready-made training and testing dataset is not available. Thus, ISCX HTTP/GET traffic was randomly divided into two parts: a training set made of approximately 80\% of the HTTP/GET traffic and a testing set made of the remaining 20\% of the traffic. The present study focuses on the anomalous coming through inbound HTTP requests. HTTP-based attacks are mainly from the HTTP GET request at the server side. Request bodies carry data to the web server but sometimes the request message has no body, because no request message data is needed to give GET a simple document from a server  {\ref (Davide \& Brian, n.d.)}. Therefore, we removed all HTTP request packets begin without request message. 
\section[{b) Analysis And Result}]{b) Analysis And Result}\par
We directed experiments for our TMAD model with the extracted data from the ISCX dataset 2012. In the first part of our experiments, we present the model generation for normal HTTP traffic. Afterwards, we evaluate the accuracy of our TMAD model in detecting various attacks coming through HTTP services including scan, DoS, R2L, U2R and DDoS. We trained the TMAD model on the ISCX dataset 2012, and then evaluate the model on test dataset, which contains different attacks. For port 80, the attacks are often malformed HTTP requests and are very different from normal requests.\par
For our research, we have plan on the anomalous incoming through inbound HTTP requests. HTTP-based attacks are mostly from the HTTP GET request at the server side. Figure \hyperref[fig_7]{4} shows histogram of HTTP request distributions.     
\section[{Conclusions}]{Conclusions}\par
This study presented TMAD (Text Mining-Based Anomaly Detection), a new approach to detect HTTP attacks in the network traffic. TMAD is an anomaly detector based upon text categorization and TF-IDF method. The use of TF-IDF improves the performance usually term weighting schemes are used, where the weights reflect the importance of a word in a specific document of the considered collection.\par
The experimental result indicated that the method is effective at detection rate, but the notable detection accuracy suffered from high level of false positive rate for ISCX dataset 2012 \hyperref[b26]{(Shiravi et al., 2012)} collected under the sponsorship of Information Security Centre of Excellence (ISCX). For port 80, it achieved almost 97.44\% detection rate with around 1.3\% false positive rate in unsupervised learning method, and 97.45\% detection rate with around 0.4\% false positive rate in supervised learning. In future research, we intend to reduce the dimensionality of feature space and false positive rate by applying data-mining preprocessing techniques to ISCX dataset 2012.\par
In our future work we aim to evaluate the performance of TMAD model on 1999 DARPA/MIT Lincoln Laboratory, which produced the most prominent datasets for testing IDS. Moreover, we will try to reduce of false positive rate and improve detection rate. \begin{figure}[htbp]
\noindent\textbf{1}\includegraphics[]{image-2.png}
\caption{\label{fig_0}Figure 1 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{2}\includegraphics[]{image-3.png}
\caption{\label{fig_2}Figure 2 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-4.png}
\caption{\label{fig_3}}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{3}\includegraphics[]{image-5.png}
\caption{\label{fig_4}Figure 3 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-6.png}
\caption{\label{fig_5}}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-7.png}
\caption{\label{fig_6}}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{4}\includegraphics[]{image-8.png}
\caption{\label{fig_7}Figure 4 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{56}\includegraphics[]{image-9.png}
\caption{\label{fig_8}Figure 5 :Figure 6 :}\end{figure}
   \begin{figure}[htbp]
\noindent\textbf{} \par 
\begin{longtable}{}
\end{longtable} \par
 
\caption{\label{tab_0}}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{1} \par 
\begin{longtable}{P{0.11609360076408787\textwidth}P{0.07712511938872971\textwidth}P{0.37831900668576884\textwidth}P{0.19159503342884432\textwidth}P{0.017860553963705825\textwidth}P{0.06900668576886342\textwidth}}
Year 2014\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
Authors\tabcellsep Data input\tabcellsep Data preprocessing\tabcellsep Main algorithm\tabcellsep Method\tabcellsep Detection\\
SPADE, (Staniford et al.,2002 )\tabcellsep Packet headers\tabcellsep Preprocessing hold packets with high anomaly score. Score is event. inverse of probability of packet\tabcellsep Bayes network. Entropy, mutual information, or\tabcellsep MD/AD\tabcellsep Probes\\
PHAD,(Mahon ey and chan, 2001)\tabcellsep Ethernet, headers IP, TCP\tabcellsep Models each packet header using clustering\tabcellsep Univariate anomaly detection\tabcellsep AD\tabcellsep Probe, DoS\\
(Guennoun et al., 2008)\tabcellsep 802.11 frame headers\tabcellsep Apply feature construction for 3 higher level features. Feature selection is used to find optimal subset.\tabcellsep K-means Classifier used to detect attacks\tabcellsep AD\tabcellsep Wireless network attacks.\\
(Zhao et al., 2009)\tabcellsep TCP sessions\tabcellsep Create separate dataset for each application protocol. Quantization of TCP flags within each session.\tabcellsep HMM for HTTP, transitions. FTP and SSH to model TCP state\tabcellsep AD\tabcellsep FTP anomalies\\
\tabcellsep \tabcellsep Feature importance values\tabcellsep Random forests,\tabcellsep \tabcellsep \\
(Elbasiony et al., 2013)\tabcellsep Packet headers\tabcellsep calculated by the random forests algorithm are used in the misuse\tabcellsep k-means clustering,\tabcellsep MD/AD\tabcellsep DOS, R2L, U2R, probing\\
\tabcellsep \tabcellsep detection.\tabcellsep weighted k-means\tabcellsep \tabcellsep \end{longtable} \par
 
\caption{\label{tab_1}Table 1 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{2} \par 
\begin{longtable}{P{0.10454876273653566\textwidth}P{0.0383551673944687\textwidth}P{0.3786026200873362\textwidth}P{0.13053129548762735\textwidth}P{0.014847161572052401\textwidth}P{0.18311499272197962\textwidth}}
Authors\tabcellsep Data input\tabcellsep Data preprocessing\tabcellsep Main algorithm\tabcellsep Method\tabcellsep Detection\\
(Tapiador et al., 2004)\tabcellsep Payload\tabcellsep Statistical analysis payload length and mean probability density and\tabcellsep Markov chains\tabcellsep AD\tabcellsep HTTP attacks\\
\tabcellsep \tabcellsep standard deviation\tabcellsep \tabcellsep \tabcellsep \\
PAYL (Wag et al., 2004)\tabcellsep Payload\tabcellsep 1-g used to compute byte-frequency distribution models for each network destination\tabcellsep Mahalanobis Distance Map (MDM)\tabcellsep AD\tabcellsep Worms, Probe, DoS, R2L, U2R\\
(Kruegel,et al. 2005)\tabcellsep Web Requests\tabcellsep Construct content-based features from user supplied parameters in URL\tabcellsep Models of normal usage created for each web app. Compare requests to models.\tabcellsep AD/MD\tabcellsep Buffer overflow, Directory traversal, XSS, input validation, Code red\\
McPAD, (Perdisci, el al., 2009)\tabcellsep Payload\tabcellsep 2v-grams extracted from payload. Feature clustering used to reduce dimensionality\tabcellsep One-Class SVM\tabcellsep AD\tabcellsep Shellcode attacks to web servers\\
SensorWeb IDS (Ezeife, el al., 2008)\tabcellsep Web Requests\tabcellsep network sensor for extracting parameters and the log digger for extracting parameters from web log files\tabcellsep Association Rule Mining (ARM)\tabcellsep AD/MD\tabcellsep XSS, SQL injection, DoS, buffer overflow, cookie Poison\\
FARM (Chan, el al.,2013)\tabcellsep Payload\tabcellsep Validating User ID, password, service request's input values, input size and SOAP size to from associative patterns and then matching these patterns with interesting rules\tabcellsep Fuzzy Association Rule Mining (FARM)\tabcellsep AD\tabcellsep SQLinjection, XML injection, XML content , SOAP oversized payload, coercive parsing, XML DoS\\
III.\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \end{longtable} \par
 
\caption{\label{tab_2}Table 2 .}\end{figure}
 			\footnote{© 2014 Global Journals Inc. (US)} 		 		\backmatter   			 
\subsection[{Acknowledgement}]{Acknowledgement}\par
This research work supported by the Fundamental Research Grant Scheme (FRGS) under Ministry o Higher Education, Malaysia and it is gratefully appreciated. 			  			  				\begin{bibitemlist}{1}
\bibitem[
			Washington
		]{b2}\label{b2} 	 		\textit{},  		 			Washington 		.  		 	 
\bibitem[]{b14}\label{b14} 	 		\textit{},  		 \xref{http://dx.doi.org/10.1002/15213773(20010316)40:<923}{10.1002/15213773(20010316)40:<923}.  		 AID-ANIE9823>3.3.  		Elsevier. p. 2.  	 
\bibitem[Scholkopf et al. ()]{b23}\label{b23} 	 		\textit{},  		 			B Scholkopf 		,  		 			K Sung 		,  		 			C Burges 		,  		 			F Girosi 		,  		 			P Niyogi 		,  		 			T Poggio 		,  		 			V Vapnik 		.  		1996.  	 
\bibitem[Hotho et al. ()]{b12}\label{b12} 	 		‘A Brief Survey of Text Mining’.  		 			A Hotho 		,  		 			N Andreas 		,  		 			G Paaß 		,  		 			S Augustin 		.  	 	 		\textit{LDV Forum -GLDV Journal for Computational Linguistics and Language Technology}  		2005. p. .  	 
\bibitem[Elbasiony et al. ()]{b8}\label{b8} 	 		‘A hybrid network intrusion detection framework based on random forests and weighted k-means’.  		 			R M Elbasiony 		,  		 			E A Sallam 		,  		 			T E Eltobely 		,  		 			M M Fahmy 		.  		 \xref{http://dx.doi.org/10.1016/j.asej.2013.01.003}{10.1016/j.asej.2013.01.003}.  	 	 		\textit{Ain Shams Engineering Journal}  		2013. 4  (4)  p. .  	 
\bibitem[Kruegel et al. ()]{b17}\label{b17} 	 		‘A multi-model approach to the detection of webbased attacks’.  		 			C Kruegel 		,  		 			G Vigna 		,  		 			W Robertson 		.  		 \xref{http://dx.doi.org/10.1016/j.comnet.-2005.01.009}{10.1016/j.comnet.-2005.01.009}.  	 	 		\textit{Computer Networks}  		2005. Elsevier Science. 48  (5)  p. .  	 
\bibitem[Wang and Stolfo (2004)]{b28}\label{b28} 	 		‘Anomalous Payload-based Network Intrusion Detection’.  		 			K Wang 		,  		 			S J Stolfo 		.  		 RAID.  	 	 		\textit{7th International Symposium},  				 (Berlin Heidelberg; Sophia Antipolis, France)  		2004. September 15 -17. Springer. p. .  	 
\bibitem[Zhao et al. ()]{b29}\label{b29} 	 		‘Applications of HMM in Protocol Anomaly Detection’.  		 			J Zhao 		,  		 			H Huang 		,  		 			S Tian 		,  		 			X Zhao 		.  		 \xref{http://dx.doi.org/10.1109/CSO.2009.51}{10.1109/CSO.2009.51}.  	 	 		\textit{2009 International Joint Conference on Computational Sciences and Optimization},  				2009. Ieee. p. .  	 
\bibitem[Comparing Support Vector Machines with Gaussian Kernels to Radial Basis Function Classifiers IEEE Transactions on Signal Processing (1996)]{b24}\label{b24} 	 		‘Comparing Support Vector Machines with Gaussian Kernels to Radial Basis Function Classifiers’.  		 \xref{http://dx.doi.org/10.1109/78.650102}{10.1109/78.650102}.  	 	 		\textit{IEEE Transactions on Signal Processing}  		1996-12-01.  	 
\bibitem[Anderson ()]{b1}\label{b1} 	 		\textit{Computer Security Threat Monitoring And Surveillance},  		 			J P Anderson 		.  		1980. p. .  	 
\bibitem[Malek and Harmantzis ()]{b20}\label{b20} 	 		‘Data mining techniques for security of web services’.  		 			M ; Malek 		,  		 			F Harmantzis 		.  		 \url{http://www.stevens-tech.edu/perfectnet/publications/Papers/ICETE2004-paper.pdf}  	 	 		\textit{Proc. International Conference on E-Business and Telecommunication Networks (ICETE)},  				 (International Conference on E-Business and Telecommunication Networks (ICETE))  		2004. p. .  	 
\bibitem[Davis and Clark ()]{b7}\label{b7} 	 		‘Data preprocessing for anomaly based network intrusion detection: A review’.  		 			J J Davis 		,  		 			A J Clark 		.  		 \xref{http://dx.doi.org/10.1016/j.cose.2011.05.008}{10.1016/j.cose.2011.05.008}.  	 	 		\textit{Computers \& Security}  		2011. 30  (6-7)  p. .  	 
\bibitem[Davide and Brian]{b6}\label{b6} 	 		 			G Davide 		,  		 			T Brian 		.  		\textit{United States of America: Publisher: O'Reilly Media},  				p. 617.  	 	 (HTTP The Definitive Guide) 
\bibitem[Chan et al. ()]{b4}\label{b4} 	 		‘Discovering fuzzy association rule patterns and increasing sensitivity analysis of XML-related attacks’.  		 			G.-Y Chan 		,  		 			C.-S Lee 		,  		 			S.-H Heng 		.  	 	 		\textit{Journal of Network and Computer Applications}  		2013. Elsevier Science. p. 3.  	 
\bibitem[Amer et al. ()]{b0}\label{b0} 	 		‘Enhancing one-class support vector machines for unsupervised anomaly detection’.  		 			M Amer 		,  		 			M Goldstein 		,  		 			S Abdennadher 		.  		 doi:10.1145 /2500853.2500857.  	 	 		\textit{Proceedings of the ACM SIGKDD Workshop on Outlier Detection and Description-ODD '13},  				 (the ACM SIGKDD Workshop on Outlier Detection and Description-ODD '13)  		2013. p. .  	 
\bibitem[Han and Kamber ()]{b15}\label{b15} 	 		 			Jiawei Han 		,  		 			Micheline Kamber 		.  		\textit{Data Mining: Concepts and Techniques},  				 (San Francisco, CA, USA)  		2011. Morgan Kaufmann.  	 
\bibitem[Khalilian et al. ()]{b16}\label{b16} 	 		‘Intrusion Detection System with Data Mining Approach: A Review’.  		 			M Khalilian 		,  		 			N Mustapha 		,  		 			N Sulaiman 		,  		 			A Mamat 		.  	 	 		\textit{Global Journal Of Computer Science \& Technology}  		2011.  (5)  p. 11.  	 
\bibitem[Sebastiani ()]{b25}\label{b25} 	 		‘Machine learning in automated text categorization’.  		 			F Sebastiani 		.  		 \xref{http://dx.doi.org/10.1145/505282.505283}{10.1145/505282.505283}.  	 	 		\textit{ACM Computing Surveys}  		2002. 34  (1)  p. .  	 
\bibitem[Perdisci et al. ()]{b21}\label{b21} 	 		‘McPAD : A Multiple Classifier System for Accurate Payload-based Anomaly Detection’.  		 			R Perdisci 		,  		 			D Ariu 		,  		 			P Fogla 		,  		 			G Giacinto 		,  		 			W Lee 		.  	 	 		\textit{Computer Networks}  		2009. Elsevier Science. 5  (6)  p. .  	 
\bibitem[Estévez-Tapiador et al. ()]{b9}\label{b9} 	 		‘Measuring normality in HTTP traffic for anomaly-based intrusion detection’.  		 			J M Estévez-Tapiador 		,  		 			P Garc?á-Teodoro 		,  		 			J E D?áz-Verdejo 		.  		 \xref{http://dx.doi.org/10.1016/j.comnet.2003.12.016}{10.1016/j.comnet.2003.12.016}.  	 	 		\textit{Computer Networks}  		2004. Elsevier. 45  (2)  p. .  	 
\bibitem[Mahoney and Chan ()]{b19}\label{b19} 	 		‘PHAD : Packet Header Anomaly Detection for Identifying Hostile Network Traffic’.  		 			M V Mahoney 		,  		 			P K Chan 		.  	 	 		\textit{Florida Institute of Technology Technical Report}  		2001. 1998. p. .  	 
\bibitem[Staniford et al. ()]{b27}\label{b27} 	 		‘Practical automated detection of stealthy portscans’.  		 			S Staniford 		,  		 			J A Hoagland 		,  		 			J M Mcalerney 		.  	 	 		\textit{Journal of Computer Security}  		2002. 10 p. .  	 
\bibitem[Guennoun et al. ()]{b11}\label{b11} 	 		‘Selecting the Best Set of Features for Efficient Intrusion Detection in 802 . 11 Networks’.  		 			M Guennoun 		,  		 			A Lbekkouri 		,  		 			K El-Khatib 		.  	 	 		\textit{in:Information and communication technologies: from theory to applications, ICTTA 2008. 3rd International Conference},  				2008. p. .  	 
\bibitem[Ezeife et al. ()]{b10}\label{b10} 	 		‘SensorWebIDS: a web mining intrusion detection system’.  		 			C I Ezeife 		,  		 			J Dong 		,  		 			A K Aggarwal 		.  		 \xref{http://dx.doi.org/10.1108/17440080810865648}{10.1108/17440080810865648}.  	 	 		\textit{International Journal of Web Information Systems}  		2008. Emerald. 4  (1)  p. .  	 
\bibitem[Leopold and Kindermann ()]{b18}\label{b18} 	 		\textit{Text Categorization with Support Vector Machines .How to Represent Texts in Input Space ?},  		 			E Leopold 		,  		 			J Kindermann 		.  		2002. Kluwer Academic Publishers Machine Learning. p. .  	 
\bibitem[Banchs ()]{b3}\label{b3} 	 		\textit{Text Mining with MATLAB®},  		 			R E Banchs 		.  		 \xref{http://dx.doi.org/10.1007/978-1-4614-4151-9}{10.1007/978-1-4614-4151-9}.  		2013. New York, NY; New York: Springer. p. .  	 
\bibitem[Shiravi et al. ()]{b26}\label{b26} 	 		‘Toward developing a systematic approach to generate benchmark datasets for intrusion detection’.  		 			A Shiravi 		,  		 			H Shiravi 		,  		 			M Tavallaee 		,  		 			A Ghorbani 		.  		 \xref{http://dx.doi.org/10.1016/j.cose.2011.12.012}{10.1016/j.cose.2011.12.012}.  	 	 		\textit{Computers \& Security}  		2012. Elsevier. 31  (3)  p. .  	 
\bibitem[Robertson et al. ()]{b22}\label{b22} 	 		‘Using Generalization and Characterization Techniques in the Anomaly-based Detection of Web Attacks’.  		 			W Robertson 		,  		 			G Vigna 		,  		 			C Kruegel 		,  		 			R A Kemmerer 		.  		 \url{http://iseclab.org/papers/webfuzzing.pdf}  	 	 		\textit{Proceedings of the Network and Distributed System Security Symposium (NDSS)},  				 (the Network and Distributed System Security Symposium (NDSS))  		2006. 14.  	 
\bibitem[Christey and Martin (2007)]{b5}\label{b5} 	 		\textit{Vulnerability Type Distributions in CVE. MITRE, Common Weakness Enumeration (CWETM)},  		 			A S Christey 		,  		 			R A Martin 		.  		 \url{http://cwe.mitre.org/documents/vuln-trends/index.html}  		2007. May 22, 2007.  	 	 (Retrieved) 
\bibitem[Witten and Frank ()]{b13}\label{b13} 	 		 			Ian H Witten 		,  		 			M A H Frank 		.  		\textit{Data Mining Practical Machine Learning Tools and Techniques},  				2011. 40 p. .  	 
\end{bibitemlist}
 			 		 	 
\end{document}
