\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={A New Networks Intrusion Detection Architecture based on Neural Networks},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2017-01-15 (revised: 15 January 2017)}
\def\TheID{\makeatother }
\def\TheDate{2017-01-15}
\title{A New Networks Intrusion Detection Architecture based on Neural Networks}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{Berlin H. LekagningK Djionang  }

             \author[2]{Dr. Gilbert  Tindo}

             \affil[1]{  University of Yaound I}

\renewcommand\Authands{ and }

\date{\small \em Received: 11 December 2016 Accepted: 1 January 2017 Published: 15 January 2017}

\maketitle


\begin{abstract}
        


Networks intrusion detection systems allow to detect attacks which cannot be detected by firewalls. The false positive and false negative problem tend to make IDS inefficient. To improve those systems? performances, it is necessary to select the most relevant that will lead to characterize a normal profile or an attack. We have proposed in this paper a new intrusion detection system architecture and a scheme to flexibly select groups of attributes using neural networks in order to improve results that we have got with our architecture. The selection approach is based on a contribution criteria that we have defined in function of precision measures of type HVS (Heuristic for Variable Selection).The selected subset depends on a threshold that we make vary in function of a defined criteria. He have done a comparative study of this approach and the one without attributes selection. A comparative study has also been done with others works. The NSL-KDD dataset has been used to train, teste and evaluate our scheme. Our Works shows satisfactory results.

\end{abstract}


\keywords{NIDS, neural network, features selection, MLP, NSL-KDD data set.}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{I. Introduction}]{I. Introduction}\par
nterconnecting systems via computer networks has been a necessity seen the 21st century. These net works are subjects to many attacks. Intrusion detection systems are a security mechanism that allows to detect attacks which has not been identified by the firewall. An intrusion being each action that can threaten confidentiality, integrity and resources availability in an information system.\par
The intrusion detections systems that use neural networks as classification scheme has been widely studied by many authors \hyperref[b10]{[1]}. Most of the solution proposed in the literature have the problem of pertinence and reliability. One of the problems major of the NIDS with neuronal networks is that the performance is governed by an only big system which takes care to detect either the types, or the categories of attacks. In this work, we have proposed a modular architecture and we have presented the efficiency. In this paper, we will explore the path of selecting attributes in order to improve the efficiency of this architecture that means to obtain a good approximation function, an acceptable false positive and negative rate and a recognition rate that is not far from the ideal one. It consists on displaying relevant attributes for each normal packet and for each type of attack.\par
The Learning quality of a scheme based on neural networks is linked to the quality of data that we submit to the classifier \hyperref[b11]{[2]}. Data submitted to the classifier can influence it in many manners \hyperref[b12]{[3,}\hyperref[b13]{4]}: -the recognition rate -The time required for the learning stage to obtain a satisfying recognition rate -The number of sample data necessary to obtain a satisfying recognition rate -The identification of relevant attributes -Reduce the complexity of the classifier and the execution time. Relevant attributes selection can lead to build a normal profile of a user or a particular type of attack. Input data characterization has a significant impact on many aspects of the classifier.\par
The follow-up of our work is organized as following: in section 2, we present the basics elements of attributes selection; in section 3, we will briefly present neural networks and their importance compared to other classifiers. In section 4 we will show some works related to attributes selection; in section 5 we will describe our attributes selection approach and algorithm, in section 6, we will present the dataset used and the preprocessing done, then in section 7 we'll present the results obtained and their analysis. We will end this work with a conclusion and prospects in section 8. 
\section[{II. Attributes Selection}]{II. Attributes Selection}\par
Relevant attributes selection is a difficult problem. Attributes selections consist on identifying a subset of attributes that allows to better the performances of detection system. It helps to remove non relevant attributes, redundant or noised ones. We will in the following subsection present the elements that help to implement an efficient selection process. 
\section[{a) Basics Elements of Selection}]{a) Basics Elements of Selection}\par
According to \hyperref[b14]{[5]}, the main procedure follows these four steps: a-Generation procedure: allows to explore the search space in order to find relevant subsets. \hyperref[b15]{[6]} regroups them in three categories:-complete generation that consists on exhaustively search in the whole dataset, which is done in O(2 N ). -Sequential generation which consists on incrementally generate the relevant subset on the whole dataset. -Heuristic generation which is similar to the complete generation with a predefined maximum number of iterations. The optimal subset is evaluated using an evaluation criteria \hyperref[b16]{[7]}. b-Evaluation: It takes as input a subset of attributes and outputs a numeric value. It allows to evaluate the examined subset. The aim of the search algorithm is to maximize the evaluation function. \hyperref[b14]{[5,}\hyperref[b17]{8]} consider many types of evaluation functions: The distance measure, the information measure, the dependency measure, the classifier recognition rate, the consistency criteria, and the precision measure. c-Stopping criteria: It allows to know when the learning algorithm should stop since the optimum number of variables is unknown in advance. d-Validation method: allows to make sure that the selected attributes subset is valid, to determine the number of relevant attributes, to choose different parameters and to test global performances of the system \hyperref[b17]{[8]}. 
\section[{b) Selection Method Based On Neural Networks}]{b) Selection Method Based On Neural Networks}\par
Three main approach has been proposed in the literature to implement this procedure \hyperref[b13]{[4,}\hyperref[b14]{5]}. We have the filter approach, the wrappers approach and the embedded approach. The filter approach selects attributes regardless of the classifier. The wrapper approach uses the classifier to validate the subset of relevant attributes. It uses for this purpose two strategies: the for ward selection which consists to gradually add attributes and the backward selection which consists to gradually remove the attributes. The embedded approach makes attributes selection in parallel to the classification process. 
\section[{III. Neural Networks}]{III. Neural Networks}\par
Neural networks are strongly linked networks made of elementary processors functioning in parallel and linked by weighs. These connections weighs chair the network functioning. Each elementary processor computes a unique output based on information taken as inputs. Neural networks has many advantages in implementing an intrusion detection system. They are really efficient and fast in the classification task. They are able to learn and easily identify new threats which are submitted to them. Neural networks are able to handle incomplete data, imprecise and from various sources. The natural speed of neural networks help to reduce damages when a threat is detected \hyperref[b19]{[10]}. Neural networks usage helps to extract nonlinear relationships that exist between different fields of a packet and to timely-detect complex attacks \hyperref[b20]{[11]}. Neural networks, after having correctly learnt, have a good generalization ability, which means that they are able to compute with precision corresponding outputs even for data which have not been learnt. The flexibility that offer neural networks is also one of the asset of intrusion detection \hyperref[b18]{[9]}. 
\section[{IV. Some Works Related to Attributes Selection}]{IV. Some Works Related to Attributes Selection}\par
Relevant variables selection help to improve the classifier efficiency. \hyperref[b21]{[12]} are the first to use neural networks for selecting attributes with the KDD dataset. They select relevant attributes by attack categories and use only one precision criteria from \hyperref[b0]{[13]}. \hyperref[b1]{[14]} uses selective analysis in their work to select relevant variables. They then use this set to classify attacks. \hyperref[b2]{[15]} Uses information gain to determine the attributes which allow to better distinguish each type of attack. \hyperref[b3]{[16]} Proposes a combination of approaches for network intrusion detection. They use for this purpose the genetic algorithm for attributes selection and SVM (Support Vector Machine) for classification. \hyperref[b4]{[17]} Proposes a new selection method based on the total mean of each field's class. The selected subset is evaluated using the decision tree classifier.\par
Attributes selection help to find out among a set of attributes, the most relevant and those which help to better the efficiency and the performance of the classifier for a given problem. Each selection depending on the system architecture, we will first present the architecture of our solution proposed in \hyperref[b9]{[22]}. Then we will present in this section the approach that we use and the selection algorithm that we have designed. 
\section[{a) Proposed Architecture}]{a) Proposed Architecture}\par
The architecture that we have used in our works is the one shown in \hyperref[b9]{[22]},on which performances have been studied. As shown in Figure \hyperref[fig_0]{1}, it is a modular architecture organised in four stages. We have called this architecture MAMBiM: Multiple Attack Multiple Binary MLP. 
\section[{Global Journal of Computer Science and Technology}]{Global Journal of Computer Science and Technology}\par
Volume XVII Issue I Version I In this four-level architecture, the first level helps to preprocess data. The second one discriminate normal packets from abnormal ones. If the packet analyzed is abnormal, the nit it is thrown to other models (third level) to determine the type of attack. Element A (fourth level) in this architecture stands as a referee which will decide which type of attack it is. Each module is a neural network with one entry stage, one hidden stage and one output stage.\par
To better the results obtained with our architecture in \hyperref[b9]{[22]}, we have chosen the heuristic approach bas -ed on neural network to select relevant attributes. 
\section[{b) Selection Approach Used}]{b) Selection Approach Used}\par
Evaluation criteria that we have used are presented in \hyperref[b11]{[2]}. The generation procedure is a heuristic. The approach that we use is the one based on using neural model to select relevant attributes. We have proposed a relevance measure inspired from entropy. This measure is presented in (a). We will also present the measure having zero order given in \hyperref[b11]{[2]} to evaluate the efficiency of our precision measure. This measure is described in diagram (b). The contribution formula that we propose in our work to evaluate an attribute contribution compared to the others is described in (c). Our approach implies a comparative study of the architecture performances in accordance with different precision measures chosen. ?? determines the influence of input neurons weighs on the hidden layer. ; -the last part?? ?? = ? ?? ??? ???? ? ? ??? ???? ? ?? ??=1 ?log ? ??? ???? ? ? ??? ???? ? ?? ??=1 ??? * ??? ?? ? ? |?? ?? | ? ??=1 ? ? ?? =1 (a) ?? ?? = ? ? ??? ???? ? ? ??? ???? ? ?? ??=1 ??? ?? ? ? |?? ?? | ? ??=1 ? ? ?? =1 (b) ?? ?? = ?? ?? ? ??? ?? ? ?? ?? =1\textbf{(}??? ?? ? ? |?? ?? | ? ??=1\par
determines the influence of output neurons on the target. ?? ?? determines the influence of the variable i on the final decision.\par
? Evaluate the pertinence of each attribute using formulas (a) or (b) ; ? Evaluate the contribution of each variable using formula (c) ; ? Choose a contribution criteria of our choice : a threshold ? ; ? select the variable which satisfy the threshold (?? ?? ? ?) as relevant, we obtain a set E' with size N-P, P being the number of variables that do not satisfy the condition ; ? Dynamically look for the number of neurons from hidden layer, which gives the best performance with this set of chosen variables ; ? Evaluate the network using this set and compare the performances with performances of networks with no variables selection; ? Repeat until the choice of the threshold (3) matches with the performance targeted in terms pf false positive, false negative and recognition rate. 
\section[{VI. Test Dataset and Preprocessing}]{VI. Test Dataset and Preprocessing}\par
Since 1999, KDD Cup 99 is used as sample dataset in behavioural intrusion detection systems. Each packet from the KDD Cup 99 dataset is made of 41 fields and is labeled as a normal or an abnormal packet with types of attacks. Amidst these fields, 37 are of type numeric and 4 are of type non numeric. KDD99 combine 37 types of attacks. These attacks are subdivided in four major classes: DOS, U2R, R2L and Probes \hyperref[b6]{[19,}\hyperref[b7]{20]}.\par
? DOS (Denial of service attacks): they are attacks that target to threaten availability of services by overloading computers resources, servers or target networks. These attacks succeeded in networks have as consequence to freeze network traffic.\par
? Probes: attack which aims to gather information on the target that can help an attacker to trigger an attack. There exist many types of probes attacks: some abuse legitimate users and others use engineering techniques to gather information.\par
? R2L (Remote to Local): attack which aims to bypass or usurp authentication credentials to execute commands. Most of these attacks derive from social engineering \hyperref[b5]{[18]}.\par
? U2R (User to Root): This attack comes from inside. The attacker usurp the super administrator password and thus the other users' passwords.\par
Most of these attacks come from buffer overloading caused by programming errors \hyperref[b6]{[19]}. KDD99 dataset contains many redundant packets in training data, as in test data \hyperref[b7]{[20]}. Redundant data are able to give more importance to a type of attack than it merits. \hyperref[b7]{[20]} propose NSL-KDD which is an excellent dataset for comparing network IDS. Our experimentation has been done with NSL-KDD, the type of attack and the number in the training and test datasets are proposed in table 4 in appendix. The fields in the packets are described in table 5 in appendix. 
\section[{a) Preprocessing}]{a) Preprocessing}\par
Pre-processing focus on non-numeric fields. Non numeric fields are: type of protocol (TCP, UDP, ICMP), type of service (AOL, auth, bgp, Z39\textunderscore 50), flag (OTH, REJ, RSTO, RSTOS0, RSTR, S0, S1, S2, S3, SF, SH) and the packet's class (Normal or Abnormal). For type of protocol, we assign the following numeric values: TCP=1, UDP=2 and ICMP=3. We assign 1 to normal packets and 0 to abnormal packets. For field type of service and flag, we can assign numeric values in their total number ascendant or descendant order. \hyperref[b8]{[21]} has shown the limits of such an approach. He propose to assign random values to those fields. In our work we have assigned random values from 1 to 10 to fields of type flag, and random values from 1 to 65 to fields of type of services. 
\section[{b) Normalization}]{b) Normalization}\par
It consist on transforming data to make them vary between 0 and 1, in order to make them homogeneous and thus simplify network learning. We will in this paper use the Min-Max normalization. Let be ?????? ?? and ?????? ?? respectively the minimum and the maximum of values of attribute ?? of value??, the normalized value is?? ' = ????????? ?? ?????? ?? ??????? ??\par
. For each attribute of data vector, compute its normalized value and replace it with the normalized value.\par
We will then make a comparative study of performances compared to the model which has been trained by the set of attributes from the variables space. The selection approach that we will use is a wrappers approach from blocks variables downward strategy. It is illustrated in figure \hyperref[fig_0]{1}. And this is based on criteria (c). 
\section[{c) Our Selection Algorihm}]{c) Our Selection Algorihm}\par
We do mention here that the error retro propagation algorithm which is used to train the neural net work.\par
The principle of our selection method is described in the following steps:\par
? Learn the network with the set of variables (of size N)from the space of variables using the errors retro propagation algorithm ; 
\section[{Global Journal of Computer Science and Technology}]{Global Journal of Computer Science and Technology}\par
Volume XVII Issue I Version I
\begin{quote}
22 Year 2017\end{quote}
\par
( ) E 
\section[{VII. Experiment Results Analysis}]{VII. Experiment Results Analysis}\par
To evaluate our models, we will use many indicators: recognition rat (TR), false positive recognition rate (TFP), detection rate (TR) and false negative rate (TFN). This rate is computed as following: For the attacks presented, we observe how the recognition rate gets better as we remove non relevant attributes. This allows us to present new descriptors for each type of attack. This work allows us to better the results we have presented in \hyperref[b9]{[22]}. NN: normal packet detected as normal; NA: normal packet detected as abnormal; AN: abnormal packet detected as Normal; AA: abnormal packet detected as abnormal.???? = ????+???? ????+????+????+???? * ??00, ?????? = ???? ????+???? *\par
(a).We have only presented some types of attacks. After that, we have presented the results per type of attack with our performance measure and we have compared with YACOUP measure.\par
For experiments, 80\% of data has been used for training purposes, in which 20\% are reserved for evaluation and 20\% of data are used for testing. The set of data that we submit to each network is reduced compared to initial data. 
\section[{a) Results analysis with a dynamic threshold}]{a) Results analysis with a dynamic threshold}\par
Here we present results obtained.   model, the learning rate also decreases for some type of attack.\par
The results clearly show that our results are clearly better than works of the authors who have dealt with intrusion detection by type of attack. 
\section[{VIII. Conclusion}]{VIII. Conclusion}\par
We have in this paper, proposed a modular architecture for network intrusion systems based on neural networks and proposed an algorithm for selecting attributes that allows us to propose descriptors for each type of attack. These new descriptors have helped us to better predict different types of attack. In terms of perspectives, we plan to propose a NIDS which timely detects networks attack.\begin{figure}[htbp]
\noindent\textbf{1}\includegraphics[]{image-2.png}
\caption{\label{fig_0}Figure 1 :}\end{figure}
  \begin{figure}[htbp]
\noindent\textbf{1} \par 
\begin{longtable}{P{0.034059233449477345\textwidth}P{0.0636759581881533\textwidth}P{0.6212108013937282\textwidth}P{0.05479094076655052\textwidth}P{0.03924216027874564\textwidth}P{0.03702090592334495\textwidth}}
ATTACKS\tabcellsep ? NV\tabcellsep VARIABLES SELECTED\tabcellsep TR\%\tabcellsep TFP\%\tabcellsep TFN\%\\
\tabcellsep 0 41\tabcellsep 11111111111111111111111111111111111111111\tabcellsep 100\tabcellsep 0\tabcellsep 0\\
\tabcellsep 1 32\tabcellsep 11110111111110011111111110100011110111110\tabcellsep 100\tabcellsep 0\tabcellsep 0\\
Warezmaster\tabcellsep 2 22\tabcellsep 01110101111110001010101110000000110011110\tabcellsep 100\tabcellsep 0\tabcellsep 0\\
\tabcellsep 3 11\tabcellsep 00010100001110000000001010000000000011110\tabcellsep 100\tabcellsep 0\tabcellsep 0\\
\tabcellsep 0 41\tabcellsep 11111111111111111111111111111111111111111\tabcellsep 95,9\tabcellsep 4,25\tabcellsep 4,78\\
Nmap\tabcellsep 1 38\tabcellsep 11111111111110111011111111111111111111100\tabcellsep 100\tabcellsep 0\tabcellsep 0\\
\tabcellsep 0 41\tabcellsep 11111111111111111111111111111111111111111\tabcellsep 99,9\tabcellsep 0,55\tabcellsep 0,15\\
portsweep\tabcellsep 1 31 2 19\tabcellsep 11111111111110111111111110110100000111110 11110110101000101011110110000000001010100\tabcellsep 98,0 97,5\tabcellsep 4,3 5,3\tabcellsep 0 0,4\\
\tabcellsep 3 12\tabcellsep 11100000100000101010100110000000001010000\tabcellsep 98,0\tabcellsep 1,8\tabcellsep 2,08\\
\tabcellsep 0 41\tabcellsep 11111111111111111111111111111111111111111\tabcellsep 96,9\tabcellsep 4,4\tabcellsep 2,7\\
\tabcellsep 1 25\tabcellsep 10001001011111100010011111111000100111111\tabcellsep 95,3\tabcellsep 6,2\tabcellsep 3,2\\
satan\tabcellsep 2 18\tabcellsep 10001000011111000010000111110000100001111\tabcellsep 91,2\tabcellsep 10,8\tabcellsep 7,4\\
\tabcellsep 3 14\tabcellsep 00001000011111000010000111110000100001111\tabcellsep 90,9\tabcellsep 11,8\tabcellsep 7,0\\
\tabcellsep 0 41\tabcellsep 11111111111111111111111111111111111111111\tabcellsep 96,5\tabcellsep 4,4\tabcellsep 2,4\\
\tabcellsep 1 30\tabcellsep 11001001101111111111111011111100100011111\tabcellsep 98,8\tabcellsep 0\tabcellsep 2,2\\
\tabcellsep 2 11\tabcellsep 11001000000100110010000011000100100000000\tabcellsep 100\tabcellsep 0\tabcellsep 0\\
pod\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
\tabcellsep 0 41\tabcellsep 11111111111111111111111111111111111111111\tabcellsep 80\tabcellsep 33,3\tabcellsep 0\\
\tabcellsep 1 17\tabcellsep 10000000000110110010000111111010000101011\tabcellsep 100\tabcellsep 0\tabcellsep 0\\
\tabcellsep 2 11\tabcellsep 10000000000110110010000001101000000000011\tabcellsep 80\tabcellsep 0\tabcellsep 25\\
rootkit\tabcellsep 3\tabcellsep \tabcellsep \tabcellsep \tabcellsep \end{longtable} \par
 
\caption{\label{tab_0}Table 1 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{} \par 
\begin{longtable}{P{0.21945454545454546\textwidth}P{0.2009090909090909\textwidth}P{0.08654545454545455\textwidth}P{0.04945454545454545\textwidth}P{0.07727272727272727\textwidth}P{0.06490909090909092\textwidth}P{0.08654545454545455\textwidth}P{0.06490909090909092\textwidth}}
\multicolumn{2}{l}{?????? =}\tabcellsep ???? ????+????\tabcellsep *  ??????, with:\tabcellsep \tabcellsep \\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep ( ) E\\
\multicolumn{5}{l}{i. Comparative study of our criteria with Yacoup one}\tabcellsep \\
\tabcellsep \tabcellsep \tabcellsep \tabcellsep \multicolumn{2}{l}{DJIONANG}\tabcellsep YACOUP\\
Category\tabcellsep \tabcellsep \multicolumn{2}{l}{Type of attack}\tabcellsep Number VA\tabcellsep TR (\%)\tabcellsep Number VA\tabcellsep TR (\%)\\
\tabcellsep \multicolumn{3}{l}{ftp\textunderscore write}\tabcellsep 39\tabcellsep 100\tabcellsep 37\tabcellsep 100\\
\tabcellsep \multicolumn{3}{l}{guess\textunderscore passwd}\tabcellsep 31\tabcellsep 93,02\tabcellsep 28\tabcellsep 93,02\\
R2L\tabcellsep \multicolumn{2}{l}{phf}\tabcellsep \tabcellsep 40\tabcellsep 100\tabcellsep 34\tabcellsep 100\\
\tabcellsep \multicolumn{3}{l}{warezmaster}\tabcellsep 11\tabcellsep 100\tabcellsep 11\tabcellsep 100\end{longtable} \par
  {\small\itshape [Note: A New Networks Intrusion Detection Architecture based on Neural Networks]} 
\caption{\label{tab_1}}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{2} \par 
\begin{longtable}{P{0.020901639344262295\textwidth}P{0.4319672131147541\textwidth}P{0.06270491803278688\textwidth}P{0.13934426229508196\textwidth}P{0.06270491803278688\textwidth}P{0.13237704918032786\textwidth}}
\tabcellsep buffer\textunderscore overflow\tabcellsep 40\tabcellsep 84,62\tabcellsep 30\tabcellsep 100\\
\tabcellsep loadmodule\tabcellsep 40\tabcellsep 100\tabcellsep 5\tabcellsep 100\\
U2R\tabcellsep perl\tabcellsep 41\tabcellsep 66,67\tabcellsep 30\tabcellsep 66,67\\
\tabcellsep rootkit\tabcellsep 7\tabcellsep 80\tabcellsep 17\tabcellsep 100\\
\tabcellsep warezclient\tabcellsep 41\tabcellsep 97,63\tabcellsep 34\tabcellsep 96,84\end{longtable} \par
  {\small\itshape [Note: A New Networks Intrusion Detection Architecture based on Neural Networks]} 
\caption{\label{tab_2}Table 2 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{3} \par 
\begin{longtable}{}
\end{longtable} \par
  {\small\itshape [Note: © 20 7 Global Journa ls Inc. (US) 1]} 
\caption{\label{tab_3}Table 3 :}\end{figure}
 			\footnote{© 20 7 Global Journa ls Inc. (US) 1} 			\footnote{© 2017 Global Journals Inc. (US)} 		 		\backmatter  			 			 			  				\begin{bibitemlist}{1}
\bibitem[Tavallaee and All ()]{b7}\label{b7} 	 		‘A Detailed Analysis of the KDD CUP 99 Data Set’.  		 			Mahbod Tavallaee 		,  		 			\&\& All 		.  	 	 		\textit{Proceding of the 2009 IEEE Symposium on Computational Intelligence in Security and Defense Application},  				 (eding of the 2009 IEEE Symposium on Computational Intelligence in Security and Defense Application)  		CISDA 2009.  	 
\bibitem[Vincent Mahoney (2003)]{b6}\label{b6} 	 		\textit{A Machine Learning Approach to Detecting Attacks by Identifying Anomalies in Network Traffic},  		 			Matthew Vincent Mahoney 		.  		May 2003.  		 			Florida Institute of Technology 		 	 
\bibitem[Behrooz Mabadi ()]{b3}\label{b3} 	 		‘A New Method for Detecting Network Intrusion by Using a combinaison of Genetic and Support Vector Machine’.  		 			Behrooz Mabadi 		.  	 	 		\textit{Journal Of Engineering and Applied Science}  		2016. 11  (4)  p. .  	 
\bibitem[Guyon and Elisseeff (2003)]{b17}\label{b17} 	 		‘An introduction to variable and feature selection’.  		 			I Guyon 		,  		 			A Elisseeff 		.  	 	 		\textit{Journal of Machine Learning Research}  		2003. October. 3 p. 998.  	 
\bibitem[Canady]{b18}\label{b18} 	 		‘Artificial Neural Networks for Misuse Detection’.  		 			James Canady 		.  	 	 		\textit{Proceedings, National Information Systems Security Conference (NISSC )},  				 (National Information Systems Security Conference (NISSC ))  		p. 98.  	 
\bibitem[Siva (2011)]{b1}\label{b1} 	 		‘Discriminant Anlysis based feature Selection in KDD Intrusion Dataset’.  		 			S Siva 		.  	 	 		\textit{International Journal of Computer Application}  		october 2011. 31  (11) .  	 
\bibitem[Meziane and Bennami ()]{b0}\label{b0} 	 		‘Feature selection and architecture optimization in connectionist system’.  		 			Yacoub \& Younes Meziane 		,  		 			Bennami 		.  	 	 		\textit{International journal of Neural Systems}  		2000. 10  (5)  p. .  	 
\bibitem[Dash and Liu ()]{b14}\label{b14} 	 		\textit{Feature selection for classification. Intelligent Data Analysis},  		 			M Dash 		,  		 			H Liu 		.  		1997. 1 p. .  	 
\bibitem[Chae et al. ()]{b4}\label{b4} 	 		‘Feature Selection for Intrusion Detection using NS L-KDD’.  		 			H Chae 		,  		 			B O Jo 		,  		 			S H Choi 		,  		 			T K Park 		.  	 	 		\textit{Recent Advances in Computer Science}  		2013. p. .  	 
\bibitem[Golovko and Kochurko ()]{b20}\label{b20} 	 		‘Intruision recognition using neural networks’.  		 			Vladimir Golovko 		,  		 			Pavel Kochurko 		.  	 	 		\textit{International Scientific Journal of computing}  		2005. 4 p. .  	 
\bibitem[Mukkamala and All ()]{b5}\label{b5} 	 		‘Intrusion detection using an ensemble of intelligent paradigms’.  		 			Srinivas Mukkamala 		,  		 			\&\& All 		.  	 	 		\textit{Journal Network and Computer Applications}  		2005. 28 p. .  	 
\bibitem[José Crispín HERNÁNDEZHERNÁNDEZ « Algorithmes métaheuristiques hybrides pour la sélection de gènes et la classification de données de biopuces » THESE UNIVERSITE de ANGERS novembre ()]{b15}\label{b15} 	 		\textit{José Crispín HERNÁNDEZHERNÁNDEZ « Algorithmes métaheuristiques hybrides pour la sélection de gènes et la classification de données de biopuces » THESE UNIVERSITE de ANGERS novembre},  				2008.  	 
\bibitem[Leray and Patrick ()]{b11}\label{b11} 	 		 			Philippe Leray 		,  		 			Gallinari « Patrick 		.  	 	 		\textit{Feature Selection with Neural Networks},  				1998. 26 p. .  	 
\bibitem[Dreyfus ()]{b19}\label{b19} 	 		‘les réseaux de neurones’.  		 			G Dreyfus 		.  	 	 		\textit{Mécanique Industriel et Matériaux}  		1998. p. 51.  	 	 (septembre) 
\bibitem[Berlin et al. (2017)]{b10}\label{b10} 	 		‘Network Intrusion Detection Systems based Neural Network:A Comparative Study’.  		 			Lekagning Berlin 		,  		 			Gilbert Djionang 		,  		 			Tindo 		.  	 	 		\textit{International Journal of Computer Applications}  		January 2017. 157  (5)  p. .  	 
\bibitem[Ammar and Al-Shalfan ()]{b21}\label{b21} 	 		‘On Attack-Relevant Ranking of Network Features’.  		 			Adel Ammar 		,  		 			Khaled Al-Shalfan 		.  	 	 		\textit{IJACSA) International Journal of Advanced Computer Science and Applications}  		2015. 6  (11) .  	 
\bibitem[Ozkaya and Bekir Karlik]{b8}\label{b8} 	 		‘Protocole Type Based Intrusion Detection Using RBF Neural Network’.  		 			Aslihan Ozkaya 		,  		 			\& Bekir Karlik 		.  	 	 		\textit{International Journal of Artificial Intelligence and Expert Systems}  		 (3)  p. 2012.  	 
\bibitem[Lezoray ()]{b12}\label{b12} 	 		\textit{Segmentation d'images par morphologie mathématique et classification de données par réseaux de neurones : Application a la classification de cellules en cytologie des séreuses},  		 			Olivier Lezoray 		,  		 			« 		.  		2000. UNIVERSITE de CAEN/BASSE-NORMANDIE janvier.  	 
\bibitem[Günes]{b2}\label{b2} 	 		\textit{Selecting Features for Intrusion Detection: A Feature Relevance Analysis on KDD 99 Intrusion Detection Datasets},  		 			H Günes 		.  		 	 
\bibitem[Saba and Ferchichi ()]{b13}\label{b13} 	 		\textit{sélection et extraction d'attributs pour les problèmes de classification" THESE UNIVERSITE de LILLE janvier},  		 			E L Saba 		,  		 			Ferchichi 		.  		2013.  	 
\bibitem[Saba and Ferchichi ()]{b16}\label{b16} 	 		\textit{sélection et extraction d'attributs pour les problèmes de classification" THESE UNIVERSITE de LILLE janvier},  		 			E L Saba 		,  		 			Ferchichi 		.  		2013.  	 
\bibitem[Bhl Djionang and Tindo ()]{b9}\label{b9} 	 		‘Towards A New Architecture of Detecting Networks Intrusion Based on Neural Network’.  		 			G Bhl Djionang 		,  		 			Tindo 		.  	 	 		\textit{International Journal of Computer Networks and Communications Security}  		2017. 5  (1)  p. .  	 
\end{bibitemlist}
 			 		 	 
\end{document}
