I
AE
S
I
n
t
e
r
n
at
ion
al
Jou
r
n
al
of
Ar
t
if
icial
I
n
t
e
ll
ig
e
n
c
e
(
I
J
-
AI
)
Vol.
14
,
No.
4
,
Augus
t
2025
,
pp.
3047
~
3062
I
S
S
N:
2252
-
8938
,
DO
I
:
10
.
11591/i
jai
.
v
14
.i
4
.
pp
30
47
-
3062
3047
Jou
r
n
al
h
omepage
:
ht
tp:
//
ij
ai
.
iaes
c
or
e
.
c
om
R
e
vol
u
t
io
n
iz
in
g
in
t
e
r
n
e
t
o
f
t
h
in
gs
in
t
r
u
si
on
d
e
t
e
c
t
io
n
u
si
n
g
m
ac
h
i
n
e
l
e
a
r
n
i
n
g w
it
h
u
n
id
ir
e
c
t
io
n
al
, b
id
ir
e
c
t
io
n
al
,
an
d
p
ac
k
e
t
f
e
a
t
u
r
e
s
Z
u
lh
ip
n
i
Re
n
o
S
ap
u
t
r
a
E
ls
i
1
,
De
r
is
S
t
iawan
2
,
B
h
ak
t
i
Yu
d
h
o
S
u
p
r
ap
t
o
3
,
M
.
Agus
S
yam
s
u
l
Ar
if
i
n
4
,
M
oh
d
.
Yaz
id
I
d
r
is
5
,
Rahm
at
B
u
d
iart
o
6
1
F
a
c
ul
ty
of
E
ngi
ne
e
r
in
g, U
ni
ve
r
s
it
a
s
M
uha
mm
a
di
ya
h P
a
le
mb
a
n
g, P
a
le
mba
ng, I
ndone
s
ia
2
D
e
pa
r
tm
e
nt
of
C
omput
e
r
E
ngi
ne
e
r
in
g, F
a
c
ul
ty
of
C
omput
e
r
S
c
ie
nc
e
,
S
r
iwi
ja
ya
U
ni
ve
r
s
it
y
, P
a
le
mba
ng
,
I
ndone
s
ia
3
F
a
c
ul
ty
of
E
ngi
ne
e
r
in
g,
S
r
i
w
ij
a
ya
U
ni
ve
r
s
it
y
, P
a
le
mba
ng, I
nd
one
s
ia
4
D
e
pa
r
te
me
nt
of
I
nf
or
ma
ti
c
, F
a
c
ul
ty
of
E
ngi
ne
e
r
in
g, U
ni
ve
r
s
it
a
s
J
e
nde
r
a
l
S
oe
di
r
ma
n, P
ur
w
oke
r
to
, I
ndone
s
ia
5
F
a
c
ul
ty
of
C
omput
in
g, U
ni
ve
r
s
it
i
T
e
knol
ogi
M
a
l
a
ys
ia
,
J
ohor
B
a
hr
u, M
a
la
ys
ia
6
C
ol
le
ge
of
C
omput
in
g a
nd
I
nf
or
ma
ti
on, Al B
a
ha
U
ni
ve
r
s
it
y, A
l
B
a
ha
h, S
a
udi
A
r
a
bi
a
Ar
t
icle
I
n
f
o
AB
S
T
RA
CT
A
r
ti
c
le
h
is
tor
y
:
R
e
c
e
ived
J
ul
6,
2024
R
e
vis
e
d
J
un
17,
2025
Ac
c
e
pted
J
ul
10,
2025
D
et
ec
t
i
o
n
o
f
at
t
ack
s
o
n
i
n
t
er
n
et
o
f
t
h
i
n
g
s
(Io
T
)
n
e
t
w
o
rk
s
i
s
an
i
mp
o
rt
a
n
t
ch
al
l
en
g
e
t
h
a
t
req
u
i
res
effect
i
v
e
an
d
effi
c
i
en
t
s
o
l
u
t
i
o
n
s
.
T
h
i
s
s
t
u
d
y
p
ro
p
o
s
e
s
t
h
e
u
s
e
o
f
v
ar
i
o
u
s
mac
h
i
n
e
l
ear
n
i
n
g
(ML
)
t
ec
h
n
i
q
u
es
i
n
cl
a
s
s
i
fy
i
n
g
at
t
ack
s
u
s
i
n
g
u
n
i
d
i
rec
t
i
o
n
a
l
,
b
i
d
i
rec
t
i
o
n
a
l
,
an
d
p
ack
e
t
feat
u
res
.
T
h
e
p
r
o
p
o
s
e
d
met
h
o
d
s
t
h
at
i
m
p
l
eme
n
t
d
eci
s
i
o
n
t
ree
(D
T
),
ran
d
o
m
f
o
res
t
(RF),
ex
t
reme
g
rad
i
en
t
b
o
o
s
t
i
n
g
cl
as
s
i
f
i
er
(X
G
BC),
A
d
aBo
o
s
t
(A
B)
an
d
l
i
n
ear
d
i
s
cr
i
mi
n
an
t
an
al
y
s
i
s
(L
D
A
)
w
o
r
k
p
erfec
t
l
y
w
i
t
h
a
l
l
k
i
n
d
s
o
f
d
at
a
s
et
s
an
d
i
n
cl
u
d
e
s
.
It
a
l
s
o
w
o
r
k
s
v
e
ry
w
e
l
l
w
i
t
h
d
at
a
t
y
p
e
-
b
a
s
ed
fe
at
u
re
s
e
l
e
ct
i
o
n
(D
T
BFS)
an
d
co
rrel
a
t
i
o
n
-
b
as
e
d
feat
u
re
s
e
l
ect
i
o
n
(CBFS).
T
h
e
e
x
p
eri
men
t
re
s
u
l
t
s
s
h
o
w
a
s
i
g
n
i
f
i
ca
n
t
i
mp
r
o
v
eme
n
t
c
o
mp
are
d
t
o
p
rev
i
o
u
s
s
t
u
d
i
es
an
d
rev
ea
l
s
t
h
a
t
u
n
i
d
i
rect
i
o
n
al
an
d
b
i
d
i
rec
t
i
o
n
a
l
feat
u
re
s
p
r
o
v
i
d
e
h
i
g
h
er
accu
racy
co
mp
are
d
t
o
p
ac
k
et
feat
u
res
.
Fu
r
t
h
erm
o
re,
ML
mo
d
el
s
,
p
ar
t
i
c
u
l
ar
l
y
D
T
,
an
d
RF,
h
av
e
fas
t
er
co
m
p
u
t
i
n
g
t
i
mes
co
m
p
ared
t
o
mo
re
co
mp
l
e
x
d
e
ep
l
earn
i
n
g
mo
d
e
l
s
.
T
h
i
s
a
n
al
y
s
i
s
a
l
s
o
s
h
o
w
s
p
o
t
e
n
t
i
al
o
v
erf
i
t
t
i
n
g
i
n
s
o
me
mo
d
el
s
,
w
h
i
c
h
req
u
i
res
fu
r
t
h
er
v
a
l
i
d
at
i
o
n
w
i
t
h
d
i
ffere
n
t
d
a
t
as
e
t
s
.
Bas
e
d
o
n
t
h
es
e
fi
n
d
i
n
g
s
,
w
e
reco
mme
n
d
t
h
e
u
s
e
o
f
RF
an
d
D
T
f
o
r
s
cen
ar
i
o
s
w
i
t
h
u
n
i
d
i
rec
t
i
o
n
a
l
a
n
d
b
i
d
i
rec
t
i
o
n
a
l
feat
u
res
,
w
h
i
l
e
A
B
an
d
L
D
A
fo
r
p
ack
e
t
feat
u
res
.
T
h
e
s
t
u
d
y
co
n
c
l
u
d
es
t
h
a
t
u
s
i
n
g
t
h
e
r
i
g
h
t
ML
t
ech
n
i
q
u
e
s
al
o
n
g
w
i
t
h
feat
u
res
t
h
at
w
o
r
k
i
n
b
o
t
h
d
i
r
ect
i
o
n
s
ca
n
ma
k
e
an
i
n
t
r
u
s
i
o
n
d
e
t
ect
i
o
n
s
y
s
t
em
fo
r
I
o
T
n
et
w
o
r
k
s
b
eco
me
s
v
ery
acc
u
rat
e.
K
e
y
w
o
r
d
s
:
B
idi
r
e
c
ti
ona
l
C
o
r
r
e
l
a
t
i
o
n
-
b
a
s
e
d
f
e
a
t
u
r
e
s
e
l
e
c
t
i
o
n
D
a
t
a
t
y
p
e
-
b
a
s
e
d
f
e
a
t
u
r
e
s
e
l
e
c
t
i
o
n
P
a
c
ka
ge
f
e
a
tur
e
s
Unidir
e
c
ti
ona
l
Th
i
s
i
s
a
n
o
p
en
a
c
ces
s
a
r
t
i
c
l
e
u
n
d
e
r
t
h
e
CC
B
Y
-
SA
l
i
ce
n
s
e.
C
or
r
e
s
pon
din
g
A
u
th
or
:
De
r
is
S
ti
a
wa
n
De
pa
r
tm
e
nt
of
C
omput
e
r
E
nginee
r
ing,
F
a
c
ult
y
of
C
omput
e
r
S
c
ienc
e
,
S
r
iwij
a
ya
Unive
r
s
it
y
P
a
lemba
ng,
I
ndone
s
ia
E
mail:
de
r
is
@uns
r
i.
a
c
.
id
1.
I
NT
RODU
C
T
I
ON
T
he
gr
owing
us
e
of
int
e
r
ne
t
of
thi
ngs
(
I
o
T
)
de
vic
e
s
in
many
indus
tr
ies
ha
s
c
r
e
a
ted
a
n
ur
ge
nt
ne
e
d
f
or
e
f
f
icie
nt
s
e
c
ur
it
y
p
r
oc
e
s
s
e
s
[
1]
.
T
he
I
o
T
de
vice
s
a
r
e
int
e
r
ne
t
-
c
onne
c
ted
de
vic
e
s
c
omm
only
e
mpl
oye
d
in
diver
s
e
s
e
tt
ings
,
r
a
nging
f
r
om
c
onne
c
ted
hous
e
holds
to
indus
tr
ial
s
ys
tems
[
2
]
,
[
3
]
.
T
he
li
mi
ted
c
omput
ing
r
e
s
our
c
e
s
a
nd
ins
e
c
ur
e
c
omm
unica
ti
on
pr
otocols
o
f
thes
e
de
vice
s
make
them
s
us
c
e
pti
ble
to
c
ybe
r
-
a
tt
a
c
ks
[
4]
.
mes
s
a
ge
que
ue
tele
metr
y
t
r
a
ns
por
t
(
M
QT
T
)
is
a
c
omm
only
e
mpl
oye
d
pr
otocol
in
I
oT
ne
twor
ks
,
s
pe
c
if
ica
ll
y
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
S
N
:
2252
-
8938
I
nt
J
Ar
ti
f
I
ntell
,
Vol.
14,
No.
4,
Augus
t
2025
:
304
7
-
3062
3048
de
ve
loped
f
or
low
c
ompl
e
xit
y
c
om
muni
c
a
ti
ons
[
5]
.
T
he
pr
im
a
r
y
is
s
ue
in
th
is
domain
is
the
identif
ica
ti
on
a
nd
c
a
tegor
iza
ti
on
of
a
tt
a
c
ks
tar
ge
ti
ng
I
oT
de
vice
s
that
uti
li
z
ing
the
M
QT
T
pr
otocol
[
6]
.
C
ha
ll
e
nge
s
in
de
tec
ti
ng
c
ybe
r
-
a
tt
a
c
ks
on
I
o
T
de
vice
s
in
c
lude
c
ons
tr
a
ined
de
vice
pr
oc
e
s
s
ing
c
a
pa
bil
it
ies
,
int
r
ica
te
a
nd
diver
s
e
a
tt
a
c
k
types
,
a
nd
lar
ge
a
mount
s
of
da
ta
[
7]
.
Give
n
the
typi
c
a
ll
y
c
on
s
tr
a
ined
pr
oc
e
s
s
ing
a
nd
s
tor
a
ge
c
a
pa
c
it
y
of
I
o
T
de
vice
s
,
it
i
s
of
ten
unf
e
a
s
ibl
e
to
de
ploy
int
r
ica
te
s
e
c
ur
it
y
mea
s
ur
e
s
[
8]
.
M
or
e
ove
r
,
the
a
tt
a
c
ks
on
I
oT
de
vice
s
a
r
e
diver
s
e
,
r
a
nging
f
r
om
de
nial
o
f
s
e
r
vice
(
DoS)
a
tt
a
c
ks
to
malwa
r
e
e
ntr
y,
ne
c
e
s
s
it
a
ti
ng
a
da
ptable
,
a
nd
e
f
f
icie
nt
de
tec
ti
on
methods
[
9]
,
[
10]
.
E
mpl
oying
s
tatis
ti
c
a
l
tec
hniques
f
or
e
xtr
a
c
ti
ng
f
e
a
tur
e
s
f
r
om
pa
c
ke
t
he
a
de
r
f
l
ow
,
including
unidi
r
e
c
ti
ona
l
a
nd
bidi
r
e
c
ti
ona
l
c
ha
r
a
c
ter
is
ti
c
s
,
a
s
we
ll
a
s
ge
ne
r
a
l
pa
c
ke
t
f
e
a
tur
e
s
f
r
om
pr
o
tocols
s
uc
h
a
s
M
QT
T
,
t
r
a
ns
mi
s
s
ion
c
ontr
ol
pr
otocol
(
T
C
P
)
(
incl
uding
I
P
pa
c
ke
ts
a
nd
I
P
f
lows
)
,
a
nd
us
e
r
da
tagr
a
m
pr
otocol
(
UD
P
)
[
11]
–
[
15
]
,
is
a
viable
a
ppr
oa
c
h
t
o
a
dd
r
e
s
s
thi
s
is
s
ue
.
T
his
f
unc
ti
ona
li
ty
a
ll
ows
f
or
t
hor
ough
e
xa
mi
na
ti
on
of
ne
twor
k
t
r
a
f
f
ic
pa
tt
e
r
ns
li
nke
d
to
a
tt
a
c
ks
without
the
ne
e
d
f
o
r
e
xc
e
s
s
ive
da
ta
pr
oc
e
s
s
ing
[
13
]
.
B
y
e
xtr
a
c
ti
ng
pa
c
ke
t
f
e
a
tur
e
s
f
r
om
the
M
QT
T
-
I
o
T
-
I
DS2020
da
tas
e
t,
a
c
ompr
e
he
ns
ive
da
t
a
ba
s
e
is
obtaine
d
f
or
tr
a
ini
ng
a
tt
a
c
k
de
tec
ti
on
models
.
I
n
or
de
r
to
d
e
ve
lop
mor
e
pr
e
c
is
e
a
nd
c
ompr
e
he
ns
ive
de
tec
ti
on
models
,
thi
s
da
tas
e
t
e
nc
ompas
s
e
s
a
br
oa
d
s
pe
c
tr
um
of
typi
c
a
l
a
tt
a
c
k
types
a
ga
ins
t
the
M
QT
T
pr
otocol
.
Us
ing
unidi
r
e
c
ti
ona
l
a
nd
bidi
r
e
c
ti
ona
l
c
a
pa
bil
it
ies
,
the
s
ys
tem
c
a
n
a
s
s
e
s
s
ne
twor
k
tr
a
f
f
ic
f
r
om
e
it
he
r
a
one
-
wa
y
or
two
-
wa
y
s
tandpoint,
s
o
of
f
e
r
ing
a
mor
e
c
ompr
e
he
ns
ive
unde
r
s
tanding
of
ne
twor
k
a
c
ti
vit
y
[
14]
,
[
15]
.
A
unidi
r
e
c
ti
ona
l
f
e
a
tur
e
is
de
s
igned
to
a
na
lyze
da
ta
that
moves
in
a
s
ingl
e
di
r
e
c
ti
on,
s
uc
h
f
r
om
a
de
vice
to
a
s
e
r
ve
r
,
whe
r
e
a
s
a
bidi
r
e
c
ti
ona
l
f
e
a
tu
r
e
is
de
s
igned
to
a
na
lyze
da
ta
that
moves
in
both
di
r
e
c
ti
ons
be
twe
e
n
a
de
vice
a
nd
a
s
e
r
ve
r
.
E
xa
mi
ning
the
t
r
a
f
f
ic
o
f
the
T
C
P
a
nd
UD
P
p
r
otocols
f
u
r
ther
e
xpa
nds
upon
thi
s
methodology.
T
he
T
C
P
p
r
otocol's
e
xa
mi
na
ti
on
of
I
P
pa
c
ke
ts
a
nd
I
P
f
lows
e
na
bles
the
de
tec
ti
on
of
li
ke
ly
c
omm
unica
ti
on
pa
tt
e
r
ns
a
nd
ir
r
e
gular
it
ies
in
on
going
c
onne
c
ti
ons
,
while
the
c
ha
r
a
c
ter
is
ti
c
s
of
t
he
UD
P
pr
otocol
f
a
c
il
it
a
te
the
de
tec
ti
on
o
f
a
tt
a
c
k
pa
tt
e
r
ns
t
ha
t
a
r
is
e
in
c
onne
c
ti
onles
s
c
omm
unica
ti
ons
[
16]
,
[
17]
.
B
y
r
e
duc
ing
the
c
omput
a
ti
ona
l
bur
de
n
on
I
o
T
de
vice
s
,
thi
s
method
a
ll
ows
f
or
e
a
r
ly
de
tec
ti
on
a
nd
im
pr
ove
d
c
a
tegor
iza
ti
on
o
f
a
tt
a
c
ks
.
T
he
de
ve
lopm
e
nt
of
a
n
e
f
f
e
c
ti
ve
a
nd
e
f
f
icie
nt
s
e
c
ur
it
y
s
ys
tem
to
pr
otec
t
I
oT
de
vice
s
f
r
om
e
ve
r
-
e
volvi
n
g
c
ybe
r
thr
e
a
ts
r
e
li
e
s
on
the
us
e
of
s
tatis
ti
c
a
l
f
e
a
tur
e
e
xt
r
a
c
ti
on
tec
hni
que
s
a
nd
the
M
QT
T
-
I
oT
-
I
DS2020
da
tas
e
t.
T
his
s
tudy
e
nha
nc
e
s
the
a
dva
nc
e
ment
of
a
n
a
tt
a
c
k
de
tec
ti
on
a
nd
c
las
s
if
ica
ti
on
s
y
s
tem
f
or
I
oT
de
vice
s
by
e
mpl
oying
e
f
f
icie
nt
a
nd
e
f
f
e
c
ti
ve
metho
ds
f
or
e
xtr
a
c
ti
ng
m
e
a
ningf
ul
f
e
a
tur
e
s
.
T
he
f
oll
owing
a
r
e
f
e
w
s
igni
f
ica
nt
c
ontr
i
buti
ons
that
thi
s
r
e
s
e
a
r
c
h
ha
s
made
:
i)
s
tatis
ti
c
a
l
methods
uti
li
z
a
ti
on
f
or
e
xt
r
a
c
ti
ng
f
e
a
tur
e
s
that
de
pe
nd
o
n
the
c
ha
r
a
c
ter
is
ti
c
s
of
pa
c
ke
t
he
a
de
r
f
low,
pa
r
ti
c
ular
ly
unidi
r
e
c
ti
ona
l
a
nd
bid
ir
e
c
ti
ona
l
f
e
a
tur
e
s
,
in
or
de
r
to
de
tec
t
pos
s
ibl
e
a
tt
a
c
ks
;
ii
)
pa
c
ke
t
f
e
a
tur
e
e
xtr
a
c
ti
on
a
ppr
oa
c
h
de
r
ived
f
r
om
the
M
QT
T
,
T
C
P
,
a
nd
UD
P
pr
otocols
;
ii
i)
e
va
luation
a
nd
c
ompar
is
on
us
ing
the
M
QT
T
-
I
oT
-
I
DS2020
da
tas
e
t;
a
nd
iv
)
a
c
c
ur
a
c
y
e
nha
nc
e
ment
a
nd
c
ompr
e
he
ns
ivene
s
s
of
de
tec
ti
on
model,
e
nc
ompas
s
ing
a
r
a
nge
of
typi
c
a
l
a
tt
a
c
ks
tar
ge
ti
ng
t
he
M
QT
T
p
r
otocol.
2.
RE
L
AT
E
D
WORK
R
e
late
d
r
e
s
e
a
r
c
he
s
a
bout
int
r
us
ion
de
tec
ti
on
in
I
oT
ne
twor
ks
ha
ve
a
dopted
va
r
ious
tec
hniques
,
including
pr
e
pr
oc
e
s
s
ing,
f
e
a
tur
e
e
xtr
a
c
t
ion
,
a
nd
c
l
a
s
s
if
ica
ti
on.
Ala
s
mar
i
a
nd
Alhoga
il
[
18
]
us
e
d
a
ge
ne
r
a
li
z
e
d
li
ne
a
r
model
(
GL
M
)
with
r
a
ndom
ove
r
-
s
a
mpl
ing
a
nd
a
utom
a
ti
c
f
e
a
tur
e
e
nginee
r
ing
to
make
a
n
opti
mi
z
a
ti
on
model
that
wa
s
100%
a
c
c
ur
a
te
a
nd
ha
d
a
100%
F
1
-
s
c
or
e
.
Automatic
f
e
a
tur
e
e
nginee
r
ing
a
ls
o
im
pr
ove
d
pe
r
f
or
manc
e
by
38.
9%
a
nd
r
e
duc
e
d
de
tec
ti
on
ti
me
by
67.
7%
.
How
e
ve
r
,
thi
s
r
e
s
e
a
r
c
h
is
e
xc
lus
i
ve
to
the
M
QT
T
p
r
otocol
f
or
s
mar
t
home
e
nvir
onments
,
la
c
king
tes
ti
ng
on
othe
r
pr
otocols
o
r
br
oa
de
r
I
o
T
s
c
e
na
r
ios
.
Aliabdi
[
19]
s
ugge
s
ted
a
mi
xe
d
a
lgor
it
h
m
that
u
s
e
s
both
a
c
onvo
lut
ional
ne
ur
a
l
ne
twor
k
(
C
NN
)
a
nd
long
s
hor
t
-
ter
m
memor
y
(
L
S
T
M
)
.
On
the
ne
twor
k
s
e
c
ur
it
y
lab
-
knowle
dge
dis
c
ove
r
y
a
nd
da
ta
mi
ning
(
NS
L
-
KD
D
)
da
tas
e
t,
the
pr
opos
e
d
a
lgor
it
hm
a
c
hieve
d
99
%
a
c
c
ur
a
c
y,
a
nd
on
the
M
QT
T
p
r
otocol,
a
c
hieve
d
o
ve
r
97%
a
c
c
ur
a
c
y.
How
e
ve
r
,
the
c
ompl
e
xit
y
of
thi
s
a
lgo
r
it
hm
may
not
be
s
uit
a
ble
f
or
I
oT
de
vice
s
with
li
mi
ted
r
e
s
our
c
e
s
.
L
iu
e
t
al
.
[
20]
c
r
e
a
ted
a
mul
ti
-
node
,
mu
lt
i
-
c
las
s
c
las
s
if
ica
ti
on
e
ns
e
mbl
e
a
ppr
oa
c
h
to
f
ind
a
tt
a
c
ks
in
dis
tr
ibut
e
d
c
ybe
r
-
phys
ica
l
s
y
s
tems
.
I
n
s
it
ua
ti
ons
whe
r
e
mul
ti
ple
node
s
we
r
e
c
e
ns
or
ing
da
ta,
thi
s
a
ppr
oa
c
h
wor
k
e
d
be
tt
e
r
than
the
f
ull
-
da
ta
a
ppr
oa
c
h.
How
e
ve
r
,
the
c
ompl
e
xit
y
of
thi
s
a
ppr
oa
c
h
is
high
a
nd
li
mi
ted
to
s
pe
c
if
ic
da
ta
-
c
e
n
s
or
ing
s
c
e
na
r
ios
.
C
he
n
e
t
al
.
[
21
]
us
e
d
a
hybr
id
f
e
a
tur
e
s
e
lec
ti
on
a
nd
laye
r
e
d
c
las
s
if
ica
ti
on
model,
whic
h
outper
f
or
med
s
ix
mac
hine
lea
r
ning
(
M
L
)
/dec
is
ion
tr
e
e
(
D
T
)
a
lgo
r
it
hms
in
a
c
c
ur
a
c
y
a
nd
r
e
s
our
c
e
c
ons
umpt
ion
on
f
ou
r
publ
ic
da
tas
e
ts
.
How
e
ve
r
,
th
e
c
ompl
e
xit
y
o
f
thi
s
method
may
not
be
s
uit
a
ble
f
or
low
-
r
e
s
our
c
e
I
oT
de
vice
s
.
Gor
z
a
lcz
a
ny
a
nd
R
udz
ins
ki
[
22]
im
p
r
ove
d
a
f
uz
z
y
a
lgor
it
hm
-
ba
s
e
d
c
las
s
if
ica
ti
on
s
ys
tem
us
ing
a
mul
ti
-
objec
ti
ve
e
volut
iona
r
y
a
lgo
r
it
hm.
T
he
s
ys
tem
wor
ke
d
be
t
ter
in
ter
ms
of
a
c
c
ur
a
c
y
a
nd
s
im
pli
c
it
y,
with
e
a
s
e
of
unde
r
s
tanding
be
ing
the
main
f
oc
us
.
I
n
the
mea
nti
me,
C
ha
ga
nti
e
t
al
.
[
23]
de
ve
loped
a
bidi
r
e
c
ti
ona
l
ga
ted
r
e
c
ur
r
e
nt
unit
(
Bi
-
GR
U
)
-
C
NN
model
f
or
I
oT
malwa
r
e
de
tec
ti
on
a
nd
c
las
s
if
ica
ti
on,
Evaluation Warning : The document was created with Spire.PDF for Python.
I
nt
J
Ar
ti
f
I
ntell
I
S
S
N:
2252
-
8938
R
e
v
olut
ioni
z
ing
I
oT
int
r
us
ion
de
tec
ti
on
us
ing
mac
hine
lear
ning
w
it
h
…
(
Z
u
lhi
pni
R
e
no
Saputr
a
E
ls
i
)
3049
whic
h
a
c
hieve
d
100%
a
c
c
ur
a
c
y
f
or
I
oT
malwa
r
e
de
tec
ti
on
a
nd
98%
f
or
I
o
T
malwa
r
e
f
a
mi
ly
c
las
s
if
ica
ti
on.
How
e
ve
r
,
they
r
e
s
tr
icte
d
the
e
va
luation
to
f
e
a
tur
e
s
li
ke
byte
s
e
que
nc
e
s
.
Attot
a
e
t
al
[
24]
p
r
opos
e
d
a
f
e
de
r
a
ted
lea
r
ning
-
ba
s
e
d
int
r
us
ion
d
e
tec
ti
on
(
M
V
-
F
L
I
D)
method
us
ing
mul
ti
-
view
e
ns
e
mbl
e
lea
r
ning.
T
his
method
wa
s
mor
e
a
c
c
ur
a
te
than
c
e
ntr
a
li
z
e
d
non
-
f
e
de
r
a
ted
lea
r
ning
(
FL
)
methods
,
howe
ve
r
,
it
is
s
ti
ll
c
ha
ll
e
nging
to
im
p
l
e
ment
a
nd
ne
e
ds
a
lot
of
r
e
s
our
c
e
s
.
Als
o,
L
iu
e
t
al
.
[
25
]
c
r
e
a
ted
a
bidi
r
e
c
ti
ona
l
ga
ted
r
e
c
ur
r
e
nt
unit
a
tt
e
nti
o
n
(
B
GR
UA
)
de
e
p
lea
r
ning
model
f
or
c
las
s
if
ying
hype
r
text
tr
a
ns
f
e
r
pr
otocol
s
e
c
ur
e
(
H
T
T
P
S
)
tr
a
f
f
ic.
T
his
m
ode
l
doe
s
a
be
tt
e
r
job
of
c
las
s
if
ying
e
nc
r
ypted
t
r
a
f
f
ic
than
other
methods
in
te
r
ms
of
a
c
c
ur
a
c
y,
pr
e
c
is
ion,
r
e
c
a
ll
,
a
nd
F
1
-
s
c
or
e
,
but
it
a
ls
o
only
c
las
s
if
ies
HT
T
P
S
tr
a
f
f
ic.
S
a
my
e
t
al
.
[
26
]
a
ls
o
de
ve
loped
a
n
a
tt
a
c
k
d
e
tec
ti
on
f
r
a
mew
or
k
us
ing
de
e
p
lea
r
ning
a
nd
im
pleme
nted
i
t
on
f
og
node
s
.
R
e
s
e
a
r
c
he
r
s
only
tes
ted
it
on
f
og
node
s
,
a
c
hieving
a
de
tec
ti
on
r
a
te
o
f
99
.
97%
,
a
n
a
c
c
ur
a
c
y
of
99.
96
%
in
binar
y
c
las
s
c
las
s
if
ica
ti
on,
a
nd
a
n
a
c
c
ur
a
c
y
o
f
99.
65%
in
mul
ti
c
las
s
c
las
s
if
ica
t
ion.
Hua
ng
e
t
a
l
.
[
27]
a
ls
o
wor
ke
d
on
a
k
-
ne
a
r
e
s
t
ne
ighbor
(
K
NN)
-
ba
s
e
d
c
las
s
if
ica
ti
on
model
that
us
e
s
s
tatis
ti
c
a
l
f
e
a
tur
e
s
f
r
o
m
he
a
de
r
-
de
r
ived
f
low
a
nd
a
c
hieve
s
a
bout
90%
a
c
c
ur
a
c
y
while
tr
ying
to
us
e
a
s
li
t
tl
e
c
omput
ing
powe
r
a
s
pos
s
ibl
e
.
T
a
ble
1
s
umm
a
r
ize
s
the
othe
r
im
po
r
tant
r
e
late
d
wo
r
ks
.
T
a
ble
1.
S
umm
a
r
y
of
ML
tec
hniques
f
or
de
tec
ti
ng
I
oT
a
nomalies
a
nd
a
tt
a
c
ks
R
e
f
D
a
ta
s
e
t
A
tt
a
c
k t
ype
s
T
e
c
hni
que
s
P
e
r
f
or
ma
nc
e
me
tr
ic
s
D
r
a
w
ba
c
ks
/G
a
p
[
28]
M
Q
T
T
da
ta
s
e
t
M
Q
T
T
-
e
na
bl
e
d
I
oT
s
e
c
ur
it
y
H
ybr
id
f
e
a
tu
r
e
s
e
le
c
ti
on
(
X
G
B
oos
t,
M
a
xP
ool
in
gI
D
)
A
c
c
ur
a
c
y,
pr
e
c
is
io
n
,
r
e
c
a
ll
,
F1
-
s
c
or
e
L
im
it
e
d
to
M
Q
T
T
da
ta
s
e
t
s
;
ge
ne
r
a
li
z
a
ti
on
to
ot
he
r
unt
e
s
te
d pr
ot
oc
ol
s
[
29]
M
Q
T
T
-
I
oT
-
I
D
S
-
2020, NS
L
-
KDD
V
a
r
io
us
ne
twor
k
in
tr
us
io
ns
ML
-
ba
s
e
d (
nor
ma
li
z
a
ti
on,
ove
r
s
a
mpl
in
g,
unde
r
s
a
mpl
in
g)
A
c
c
ur
a
c
y,
ti
me
e
f
f
ic
ie
nc
y
C
ompl
e
x
pr
e
-
pr
oc
e
s
s
in
g
pi
pe
li
ne
;
pe
r
f
or
ma
nc
e
on
non
-
I
oT
da
ta
s
e
ts
ha
s
not
be
e
n f
ul
ly
e
xpl
or
e
d
[
30]
C
I
C
D
oS
2017
L
ow
-
r
a
te
de
ni
a
l
of
s
e
r
vi
c
e
(
L
R
D
oS
)
AI
-
ba
s
e
d a
noma
ly
de
te
c
ti
on (
F
F
C
N
N
)
A
c
c
ur
a
c
y,
pr
e
c
is
io
n
,
r
e
c
a
ll
,
F1
-
s
c
or
e
,
de
te
c
ti
on
ti
me
, R
O
C
F
oc
us
e
s
onl
y
on
L
R
D
oS
a
tt
a
c
ks
;
e
f
f
ic
ie
nc
y
on
ot
he
r
ty
pe
s
of
a
tt
a
c
ks
w
a
s
not
de
mons
tr
a
te
d
[
31]
T
O
N
-
I
oT
I
oT
ne
twor
k
in
tr
us
io
ns
F
e
a
tu
r
e
e
xt
r
a
c
ti
on vs
.
f
e
a
tu
r
e
s
e
le
c
ti
on
A
c
c
ur
a
c
y, F
1
-
s
c
or
e
,
r
unt
im
e
F
e
a
tu
r
e
s
e
le
c
ti
on
pr
ovi
de
s
f
a
s
te
r
r
e
s
ul
ts
but
pot
e
nt
ia
ll
y
r
e
duc
e
s
a
c
c
ur
a
c
y;
mor
e
r
oom f
or
i
nc
r
e
a
s
e
d a
c
c
ur
a
c
y
[
32]
C
I
C
I
D
S
2017
V
a
r
io
us
ne
twor
k
in
tr
us
io
ns
G
e
ne
r
a
l
in
tr
us
io
n de
te
c
ti
on
f
r
a
me
w
or
k (
a
ut
oe
nc
ode
r
,
c
la
s
s
if
ic
a
ti
on)
A
c
c
ur
a
c
y (
hi
gh f
or
bot
h bi
na
r
y a
nd
mul
ti
c
la
s
s
c
la
s
s
if
ic
a
ti
on)
C
ompl
e
x
f
r
a
me
w
or
ks
ma
y
be
ove
r
ki
ll
f
or
e
nvi
r
onme
nt
s
w
it
h f
e
w
e
r
r
e
s
our
c
e
s
[
32]
N
S
L
-
KDD
D
D
oS
, P
R
O
B
E
,
R
2L
, U
2R
T
r
e
e
-
ba
s
e
d
M
L
t
e
c
hni
que
s
(
DT
,
RF
, X
G
B
oos
t)
A
c
c
ur
a
c
y
O
nl
y
us
e
s
f
iv
e
f
e
a
tu
r
e
s
;
ma
y
not
c
a
pt
ur
e
th
e
f
ul
l
s
pe
c
tr
um
of
ne
twor
k be
ha
vi
or
[
33]
U
N
S
W
-
N
B
15
V
a
r
io
us
I
oT
in
tr
us
io
ns
F
e
a
tu
r
e
c
lu
s
te
r
s
(
f
lo
w
,
M
Q
T
T
, T
C
P
)
A
c
c
ur
a
c
y (
bi
na
r
y:
d
a
n mul
ti
-
c
la
s
s
)
E
s
pe
c
ia
ll
y
f
or
U
N
S
W
-
N
B
15;
ot
he
r
da
ta
s
e
ts
m
a
y
not
pr
ovi
de
s
im
il
a
r
r
e
s
ul
ts
[
34]
C
S
E
-
C
I
C
-
I
D
S
2018
D
D
oS
a
tt
a
c
ks
F
e
a
tu
r
e
-
e
ngi
ne
e
r
in
g a
nd
ML
-
ba
s
e
d de
te
c
ti
on (
R
F
,
S
V
M
,
K
N
N
, D
T
,
X
G
B
oos
t)
A
c
c
ur
a
c
y,
pr
e
c
is
io
n
,
r
e
c
a
ll
,
F1
-
s
c
or
e
F
oc
us
on
D
D
oS
;
it
s
a
ppl
ic
a
bi
li
ty
to
ot
he
r
ty
pe
s
of
a
tt
a
c
ks
ha
s
not
be
e
n
te
s
te
d
[
35]
N
S
L
-
K
D
D
,
U
N
S
W
-
N
B
15,
C
C
I
D
S
2017
V
a
r
io
us
I
oT
in
tr
us
io
ns
E
xt
r
e
me
gr
a
di
e
nt
e
ns
e
mbl
e
boos
ti
ng, f
e
a
tu
r
e
s
e
le
c
ti
on
A
c
c
ur
a
c
y
H
ig
h
c
omput
a
ti
ona
l
c
ompl
e
xi
ty
;
ma
y
not
be
s
ui
ta
bl
e
f
or
lo
w
-
r
e
s
our
c
e
I
oT
de
vi
c
e
s
[
36]
Bo
T
-
I
oT
D
D
oS
, D
oS
,
R
e
c
onna
is
s
a
nc
e
,
I
nf
or
ma
ti
on T
he
f
t
S
upe
r
vi
s
e
d M
L
(
K
N
N
, L
R
,
S
V
M
, M
L
P
, D
T
, R
F
)
A
c
c
ur
a
c
y,
pr
e
c
is
io
n
,
r
e
c
a
ll
,
F
1
-
s
c
or
e
, R
O
C
L
im
it
e
d
to
B
oT
-
I
oT
da
ta
s
e
t;
e
f
f
e
c
ti
ve
ne
s
s
on
ot
he
r
non
-
va
li
da
te
d da
ta
s
e
t
s
3.
M
E
T
HO
D
T
his
s
e
c
ti
on
outl
ines
the
s
teps
a
nd
de
c
is
ions
mad
e
dur
ing
the
p
r
oc
e
s
s
of
p
r
opos
ing
a
ne
w
I
DS
to
de
tec
t
a
tt
a
c
ks
in
I
oT
ne
twor
ks
.
I
t
p
r
e
s
e
nts
the
ML
a
r
c
hit
e
c
tur
e
de
s
igned
f
o
r
a
tt
a
c
k
de
tec
ti
on
a
nd
e
xpl
a
ins
the
f
e
a
tur
e
e
xtr
a
c
ti
on
tec
hniques
us
e
d.
F
ur
ther
mor
e
,
i
t
de
s
c
r
ibes
the
f
e
a
tur
e
s
e
lec
ti
on
pr
oc
e
s
s
,
the
c
las
s
if
ica
ti
on
a
lgor
it
hm
a
ppli
e
d,
a
nd
the
us
e
of
the
c
onf
us
ion
ma
tr
ix
f
o
r
e
va
luation
.
3.
1.
P
r
op
os
e
d
m
e
t
h
od
T
his
s
tudy
int
r
oduc
e
s
a
nove
l
int
e
gr
a
ti
on
of
unidi
r
e
c
ti
ona
l,
bid
ir
e
c
ti
ona
l,
a
nd
pa
c
ke
t
-
leve
l
f
e
a
tur
e
s
f
or
de
tec
ti
ng
I
oT
a
tt
a
c
ks
.
E
a
c
h
f
e
a
tur
e
type
o
f
f
e
r
s
a
unique
view
o
f
the
da
ta
s
uc
h
a
s
unidi
r
e
c
ti
o
na
l
a
nd
bidi
r
e
c
ti
ona
l
f
e
a
tur
e
s
pr
ovide
s
tatis
ti
c
a
l
f
low
c
ha
r
a
c
ter
is
ti
c
s
,
while
pa
c
ke
t
f
e
a
tur
e
s
r
e
f
lec
t
pr
o
to
c
ol
-
leve
l
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
S
N
:
2252
-
8938
I
nt
J
Ar
ti
f
I
ntell
,
Vol.
14,
No.
4,
Augus
t
2025
:
304
7
-
3062
3050
a
tt
r
ibut
e
s
.
T
he
i
r
c
ombi
na
ti
on
e
ns
ur
e
s
the
de
tec
ti
on
s
ys
tem
c
a
ptur
e
s
tr
a
f
f
ic
be
ha
vior
s
a
nd
p
r
otocol
a
bus
e
pa
tt
e
r
ns
,
ther
e
by
i
mpr
oving
a
c
c
ur
a
c
y
a
nd
r
obus
tnes
s
.
F
igur
e
1
il
lus
tr
a
tes
the
p
r
opos
e
d
method,
whic
h
is
divi
de
d
int
o
s
e
ve
r
a
l
pr
oc
e
s
s
e
s
.
T
he
f
ir
s
t
p
r
oc
e
s
s
is
f
e
a
tur
e
e
xtr
a
c
ti
on
with
th
r
e
e
f
e
a
tur
e
e
xt
r
a
c
ti
ons
,
na
mely
unidi
r
e
c
ti
ona
l
-
ba
s
e
d
f
e
a
tur
e
s
,
bidi
r
e
c
ti
o
na
l
-
ba
s
e
d
f
e
a
tur
e
s
a
nd
pa
c
ke
t
-
ba
s
e
d
f
e
a
tur
e
s
.
T
his
f
e
a
tur
e
e
xtr
a
c
ti
on
pr
oc
e
s
s
pr
oduc
e
s
3
ne
w
da
tas
e
ts
f
or
the
3
f
e
a
tur
e
e
xtr
a
c
ti
on
pr
oc
e
s
s
e
s
.
T
he
s
e
c
ond
pr
oc
e
s
s
is
f
e
a
tur
ing
s
e
lec
ti
on
by
e
l
im
inating
f
e
a
tur
e
s
us
ing
da
ta
typ
e
-
ba
s
e
d
f
e
a
tur
e
s
e
lec
ti
on
(
DT
B
F
S
)
,
e
li
mi
na
ti
ng
f
e
a
tu
r
e
s
that
ha
ve
da
ta
objec
t,
da
ta
types
a
nd
c
or
r
e
lati
on
-
ba
s
e
d
f
e
a
tur
e
s
e
lec
ti
on
(
C
B
F
S
)
with
thr
e
s
hold=0.
8
.
T
he
thi
r
d
s
tep
is
to
pe
r
f
o
r
m
c
las
s
if
ica
ti
on
tas
k
us
ing
the
5
s
e
le
c
ted
a
lgor
it
hms
,
i.
e
.
:
DT
,
r
a
ndom
f
o
r
e
s
t
(
RF
)
,
e
xtr
e
me
gr
a
dient
boos
ti
ng
c
las
s
if
ier
(
XG
B
C
)
,
A
da
B
oos
t
(
AB
)
,
li
ne
a
r
dis
c
r
im
inant
a
na
lys
is
(
L
DA
)
,
a
nd
f
inally
c
ompar
e
the
pe
r
f
o
r
manc
e
of
the
mat
r
ix
f
or
e
a
c
h
c
las
s
if
ica
ti
on,
the
pe
r
f
or
manc
e
c
ompar
e
d
is
a
c
c
ur
a
c
y,
pr
e
c
is
ion,
r
e
c
a
ll
,
F
1
-
s
c
or
e
,
a
nd
pe
r
f
o
r
manc
e
ti
me
.
F
igur
e
1.
ML
a
r
c
hit
e
c
tur
e
of
the
p
r
opos
e
d
method
F
i
ve
f
i
les
(
i
n
.
pc
a
p
f
o
r
mat
)
c
ons
is
t
o
f
r
a
w
da
ta
:
no
r
m
a
l
,
s
c
a
n
_a
,
s
c
a
n_s
u
,
s
pa
r
ta
,
a
nd
mqt
t_br
utef
or
c
e
.
W
e
p
r
e
-
pr
oc
e
s
s
e
a
c
h
f
i
le
us
i
ng
un
id
i
r
e
c
t
io
na
l
e
x
t
r
a
c
t
io
n
,
b
id
i
r
e
c
t
io
na
l
e
x
t
r
a
c
t
io
n
,
a
n
d
p
a
c
k
e
t
f
e
a
t
u
r
e
s
,
w
he
r
e
e
a
c
h
r
a
w
da
ta
w
il
l
b
e
3
ne
w
f
i
les
(
*
.
c
s
v
)
.
F
ig
u
r
e
2
il
lus
t
r
a
tes
t
he
p
r
oc
e
s
s
o
f
c
o
nve
r
ti
ng
1
f
il
e
i
nto
3
f
i
les
(
i
n
.
c
s
v
f
o
r
m
a
t
)
,
s
u
c
h
a
s
no
r
mal
r
a
w
da
ta
w
i
ll
be
c
om
e
3
f
i
les
,
na
me
ly
u
ni
f
lo
w_
No
r
ma
l
.
c
s
v
,
bi
f
lo
w_
Nor
m
a
l
.
c
s
v
,
a
nd
p
a
c
k
e
t
_N
o
r
m
a
l
.
c
s
v
t
he
n
d
a
t
a
s
e
ts
,
s
u
c
h
a
s
un
i
f
l
ow
:
un
i
f
low
_N
o
r
m
a
l
.
c
s
v
,
u
ni
f
lo
w_s
c
a
n_
A
.
c
s
v
,
u
n
if
l
ow_
s
c
a
n_s
U
.
c
s
v
,
un
i
f
l
ow
_s
p
a
r
ta
.
c
s
v
,
a
n
d
u
ni
f
l
o
w_
mq
tt
_b
r
ut
e
f
o
r
c
e
.
c
s
v
wi
ll
be
c
o
mb
in
e
d
in
to
1
n
e
w
.
c
s
v
f
i
le
w
it
h
5
c
las
s
e
s
.
F
i
na
ll
y
,
f
r
o
m
5
r
a
w
pc
a
p
d
a
ta
,
3
c
s
v
f
i
les
wi
l
l
b
e
ob
ta
ine
d
,
na
me
ly
C
o
m
bi
ne
d
u
n
id
i
r
e
c
ti
on
_
mu
lt
i_
c
l
a
s
s
.
c
s
v
,
b
ide
r
e
c
t
i
ona
l
_m
ul
ti
_c
l
a
s
s
.
c
s
v
,
a
nd
pa
c
ke
t_
f
e
a
t
u
r
e
_
m
ul
ti
_c
las
s
.
s
c
v
.
F
igur
e
2.
M
QT
T
-
I
oT
-
I
DS2020
pr
e
-
pr
oc
e
s
s
ing
3.
2.
M
QT
T
-
I
oT
-
I
DS2020
d
at
as
et
T
his
s
tudy
us
e
s
the
M
QT
T
-
I
oT
-
I
DS2020
[
37]
da
tas
e
t
due
to
it
s
f
oc
us
on
M
QT
T
-
ba
s
e
d
tr
a
f
f
ic,
whic
h
is
highl
y
r
e
leva
nt
in
r
e
a
l
-
wor
ld
s
mar
t
home
a
nd
li
ghtwe
ight
I
oT
ne
twor
k
de
ploym
e
nts
.
T
his
da
tas
e
t
include
s
moder
n
int
r
us
ion
a
tt
e
mpt
s
s
uc
h
a
s
s
c
a
nning,
b
r
ute
-
f
or
c
e
,
a
nd
s
e
s
s
ion
hij
a
c
king,
making
it
a
s
uit
a
ble
Evaluation Warning : The document was created with Spire.PDF for Python.
I
nt
J
Ar
ti
f
I
ntell
I
S
S
N:
2252
-
8938
R
e
v
olut
ioni
z
ing
I
oT
int
r
us
ion
de
tec
ti
on
us
ing
mac
hine
lear
ning
w
it
h
…
(
Z
u
lhi
pni
R
e
no
Saputr
a
E
ls
i
)
3051
be
nc
hmar
k
f
or
va
li
da
ti
ng
int
r
us
ion
de
tec
ti
on
mod
e
ls
.
T
he
ne
xt
pa
r
a
gr
a
ph
is
a
de
tailed
e
xplana
ti
on
of
e
a
c
h
da
ta
c
omponent
in
the
da
tas
e
t.
‒
Nor
mal
da
ta
:
the
nor
mal
da
ta
in
thi
s
da
tas
e
t
r
e
f
le
c
ts
the
da
il
y
a
c
ti
vit
ies
of
a
n
I
oT
ne
two
r
k
without
a
ny
a
tt
a
c
ks
.
T
his
da
ta
include
s
r
e
gular
c
omm
unica
ti
ons
be
twe
e
n
I
oT
de
vice
s
a
nd
M
QT
T
s
e
r
ve
r
s
.
T
his
nor
mal
a
c
ti
vit
y
is
im
por
tant
f
or
tr
a
ini
ng
a
nomaly
a
nd
a
tt
a
c
k
de
tec
ti
on
models
,
a
s
it
pr
ovides
a
ba
s
e
li
n
e
of
e
xpe
c
ted
ne
twor
k
be
ha
vior
.
‒
S
c
a
n_
A
da
ta:
s
c
a
n
_A
da
ta
de
s
c
r
i
be
s
a
ne
two
r
k
s
c
a
n
ni
ng
a
tt
a
c
k
c
a
r
r
ied
o
ut
b
y
a
n
a
t
ta
c
ke
r
t
o
id
e
nt
i
f
y
v
u
lne
r
a
b
le
de
vi
c
e
s
.
T
he
s
e
a
t
tac
ks
t
yp
ica
l
ly
i
nc
lu
de
p
o
r
t
s
c
a
n
ni
ng
a
nd
I
P
s
c
a
nn
in
g
t
o
f
in
d
we
a
k
po
in
ts
in
the
n
e
t
wo
r
k
tha
t
c
a
n
b
e
e
xp
lo
it
e
d
f
u
r
t
he
r
.
S
c
a
n
_s
U
da
ta
:
s
c
a
n
_s
U
da
ta
c
o
ve
r
s
m
or
e
s
pe
c
i
f
i
c
ty
pe
s
o
f
s
c
a
nn
i
ng
a
t
tac
ks
,
o
f
ten
i
nv
ol
vi
ng
mo
r
e
i
n
-
de
pt
h
a
nd
ta
r
g
e
t
e
d
s
c
a
ns
to
id
e
n
ti
f
y
s
e
r
v
ic
e
s
r
u
nn
in
g
o
n
a
p
a
r
t
ic
ul
a
r
de
v
ic
e
.
T
h
e
s
e
a
t
tac
ks
m
a
y
in
c
l
ud
e
UD
P
s
c
a
n
ni
ng
a
n
d
s
c
a
nni
n
g
o
f
s
pe
c
i
f
ic
s
e
r
v
ice
s
t
ha
t
us
e
th
e
M
Q
T
T
pr
o
toc
ol
.
‒
S
pa
r
tan
da
ta:
s
pa
r
ta's
da
ta
r
e
f
e
r
s
to
a
s
pe
c
if
ic
ty
pe
of
a
tt
a
c
k
that
us
e
s
a
tool
c
a
ll
e
d
S
pa
r
ta
to
pe
r
f
or
m
s
e
c
ur
it
y
s
c
a
ns
a
ga
ins
t
I
oT
ne
twor
ks
.
S
pa
r
ta
i
s
a
powe
r
f
ul
s
c
a
nning
tool
a
nd
us
e
d
to
ide
nti
f
y
vulner
a
bil
it
ies
in
va
r
ious
ne
twor
k
s
e
r
vice
s
.
T
his
da
ta
include
s
the
r
e
s
ult
s
of
a
n
a
tt
a
c
k
that
us
e
d
S
pa
r
tan
s
c
a
nning
tec
hniques
a
ga
ins
t
I
oT
de
vice
s
whic
h
c
omm
unica
te
via
M
QT
T
.
‒
M
QT
T
-
B
r
utef
or
c
e
da
ta:
M
QT
T
-
B
r
utef
or
c
e
da
ta
r
e
f
lec
ts
br
ute
f
or
c
e
a
tt
a
c
ks
a
ga
ins
t
M
QT
T
s
e
r
ve
r
s
.
I
n
thi
s
a
tt
a
c
k,
the
a
tt
a
c
ke
r
tr
ies
va
r
ious
us
e
r
na
me
a
nd
pa
s
s
wor
d
c
ombi
na
ti
ons
with
hope
c
a
n
il
lega
ll
y
a
c
c
e
s
s
ing
the
M
QT
T
s
e
r
ve
r
.
T
his
da
ta
include
s
logs
of
f
a
il
e
d
a
s
we
ll
a
s
s
uc
c
e
s
s
f
ul
logi
n
a
tt
e
mpt
s
,
pr
ovidi
ng
ins
ight
int
o
br
u
te
f
o
r
c
e
a
tt
a
c
k
pa
tt
e
r
ns
a
ga
ins
t
M
QT
T
s
e
r
ve
r
s
.
3.
3.
F
e
a
t
u
r
e
e
xt
r
ac
t
ion
T
he
da
ta
e
xtr
a
c
ti
on
pr
oc
e
s
s
wa
s
c
a
r
r
ied
out
us
ing
the
S
c
a
py
a
nd
dpkt
l
ibr
a
r
ies
to
r
e
a
d
P
C
AP
f
il
e
s
c
ontaining
ne
twor
k
tr
a
f
f
ic.
A
f
ter
the
da
ta
wa
s
s
uc
c
e
s
s
f
ull
y
e
xtr
a
c
ted,
the
P
a
nda
s
li
br
a
r
y
wa
s
us
e
d
to
mana
ge
an
d
manipulate
the
da
ta
in
the
f
o
r
m
o
f
a
da
taf
r
a
me,
f
a
c
il
it
a
ti
ng
f
ur
ther
a
na
lys
is
.
All
e
xtr
a
c
ti
on
r
e
s
ult
s
we
r
e
then
s
a
ve
d
in
C
S
V
f
o
r
mat
f
o
r
e
f
f
icie
nt
us
e
in
the
s
ubs
e
que
nt
model
pr
oc
e
s
s
ing
a
nd
tr
a
ini
ng
s
tage
s
.
3.
3.
1
.
Uni
d
ire
c
t
io
n
al
f
e
at
u
r
e
s
T
he
s
e
f
e
a
tur
e
s
r
e
p
r
e
s
e
nt
one
-
wa
y
tr
a
f
f
ic
s
tatis
ti
c
s
,
s
uc
h
a
s
f
r
om
c
li
e
nt
to
s
e
r
ve
r
.
E
xtr
a
c
ted
metr
ics
include
pa
c
ke
t
c
ount,
byte
c
ount,
int
e
r
-
a
r
r
ival
ti
m
e
s
tatis
ti
c
s
,
a
nd
a
ve
r
a
ge
pa
c
ke
t
s
ize
.
T
he
s
e
a
r
e
c
r
i
ti
c
a
l
f
or
de
tec
ti
ng
one
-
wa
y
a
nomalies
li
ke
f
loodi
ng
or
s
c
a
nning.
3.
3.
2
.
B
id
ire
c
t
ion
al
f
e
at
u
r
e
s
B
idi
r
e
c
ti
ona
l
f
e
a
tur
e
s
c
a
ptur
e
the
f
ull
s
e
s
s
ion
c
on
text
be
twe
e
n
c
omm
unica
ti
ng
hos
ts
.
T
he
y
include
f
or
wa
r
d
a
nd
ba
c
kwa
r
d
pa
c
ke
t
c
ounts
,
da
ta
volum
e
,
r
e
s
pons
e
de
lays
,
a
nd
f
lag
us
a
ge
.
T
he
s
e
f
e
a
tur
e
s
a
ll
ow
the
model
to
a
na
lyze
r
e
qu
e
s
t
-
r
e
s
pons
e
c
ons
i
s
tenc
y
a
nd
s
e
s
s
ion
s
ymm
e
tr
y.
3.
3.
3
.
P
ac
k
e
t
-
leve
l
f
e
at
u
r
e
s
T
he
s
e
f
e
a
tur
e
s
a
r
e
de
r
ived
d
ir
e
c
tl
y
f
r
om
the
M
QT
T
,
T
C
P
,
a
nd
UD
P
pa
c
ke
t
he
a
de
r
s
.
T
he
y
include
f
lags
(
e
.
g.
,
S
YN
,
AC
K,
a
nd
M
QT
T
QoS
)
,
s
tatus
c
ode
s
,
a
nd
meta
da
ta
s
uc
h
a
s
I
P
/M
AC
a
ddr
e
s
s
e
s
.
T
he
s
e
a
r
e
e
s
s
e
nti
a
l
f
or
identif
ying
pr
otocol
-
leve
l
mi
s
us
e
a
nd
malf
or
med
pa
c
ke
t
be
ha
vior
.
3.
4.
F
e
a
t
u
r
e
s
e
lec
t
ion
F
e
a
tur
e
s
e
lec
ti
on
is
a
c
r
uc
ial
p
r
oc
e
s
s
in
da
ta
model
ing
that
a
im
s
to
s
e
lec
t
the
mos
t
r
e
leva
nt
a
tt
r
ibu
tes
f
r
om
r
a
w
da
ta
to
im
p
r
ove
model
p
e
r
f
o
r
manc
e
a
nd
r
e
duc
e
c
omput
a
ti
ona
l
c
ompl
e
xit
y.
I
n
thi
s
r
e
s
e
a
r
c
h,
the
f
e
a
tur
e
s
e
lec
ti
on
pr
oc
e
s
s
is
c
onduc
ted
in
two
s
tage
s
.
T
he
two
s
tage
s
a
r
e
DT
B
F
S
a
nd
C
B
F
S
.
I
n
the
f
ir
s
t
s
tage
,
D
T
B
F
S
,
we
c
ons
ider
the
da
ta
t
ype
s
pr
e
s
e
nt
in
the
M
QT
T
-
I
oT
-
I
DS2020
da
tas
e
t,
wh
ich
include
s
int
e
ge
r
,
f
loat
,
a
nd
objec
t
types
.
W
e
f
oc
us
e
xc
lus
ively
on
int
e
ge
r
a
nd
f
loat
f
e
a
tur
e
s
,
a
s
thes
e
numer
ic
types
c
a
n
be
di
r
e
c
tl
y
uti
li
z
e
d
by
ML
a
lgor
it
hms
f
or
modeling
a
nd
a
tt
a
c
k
de
tec
ti
on.
F
e
a
tur
e
s
with
the
objec
t
da
ta
type
a
r
e
r
e
moved
e
xc
e
pt
f
or
thos
e
in
dica
ti
ng
the
c
las
s
or
type
o
f
a
tt
a
c
k
be
c
a
us
e
they
r
e
quir
e
a
ddit
ional
pr
oc
e
s
s
ing
s
uc
h
a
s
e
n
c
oding,
whic
h
c
a
n
int
r
oduc
e
c
ompl
e
xit
y
a
nd
incr
e
a
s
e
c
omput
a
ti
ona
l
ti
me.
W
hil
e
thi
s
s
tep
may
r
is
k
e
xc
ludi
ng
c
e
r
tain
c
a
tegor
ica
l
meta
da
ta,
r
e
dunda
nt
pr
otocol
i
de
nti
f
ier
s
a
nd
c
a
tegor
ica
l
inf
or
mation
a
r
e
of
ten
r
e
p
r
e
s
e
nted
numer
ica
ll
y
in
other
r
e
taine
d
f
e
a
tur
e
s
,
e
ns
ur
ing
mi
nim
a
l
inf
or
mation
los
s
.
B
y
f
il
ter
ing
the
da
tas
e
t
in
thi
s
wa
y,
we
s
tr
e
a
ml
ine
the
da
ta
to
c
ontain
only
numer
ic
va
lues
,
making
it
r
e
a
dy
f
or
e
f
f
icie
nt
a
na
lys
is
a
nd
model
t
r
a
ini
ng.
I
n
the
s
e
c
ond
s
tage
,
C
B
F
S
is
a
ppli
e
d
us
ing
the
P
e
a
r
s
on
c
or
r
e
lation
method.
T
his
a
ppr
oa
c
h
is
us
e
d
to
mea
s
ur
e
the
li
ne
a
r
r
e
lations
hip
be
twe
e
n
f
e
a
tur
e
s
a
nd
identif
y
thos
e
with
a
s
igni
f
ica
nt
inf
luenc
e
on
t
he
tar
ge
t
va
r
iable
.
A
c
omm
only
us
e
d
c
or
r
e
lation
th
r
e
s
hold
of
0
.
8,
a
s
c
it
e
d
in
the
f
e
a
tur
e
s
e
lec
ti
on
li
ter
a
tur
e
[
38]
,
is
e
mpl
oye
d
to
identif
y
a
nd
e
li
m
inate
mul
ti
c
oll
inea
r
it
y
a
mong
f
e
a
tur
e
s
.
F
e
a
tur
e
s
with
high
c
or
r
e
lati
on
to
the
tar
ge
t
va
r
iable
but
low
c
or
r
e
lation
with
e
a
c
h
othe
r
a
r
e
r
e
taine
d
to
e
ns
ur
e
uniquene
s
s
a
nd
r
e
leva
nc
e
i
s
s
hown
in
Algor
it
hm
1
.
T
his
s
tep
r
e
duc
e
s
da
ta
r
e
dun
da
nc
y
a
nd
s
im
pli
f
ies
the
model,
ult
im
a
tely
i
mpr
oving
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
S
N
:
2252
-
8938
I
nt
J
Ar
ti
f
I
ntell
,
Vol.
14,
No.
4,
Augus
t
2025
:
304
7
-
3062
3052
int
e
r
pr
e
tabili
ty
while
mi
nim
izing
the
r
is
k
of
ove
r
f
i
tt
ing.
T
h
r
ough
thi
s
two
-
s
tage
f
e
a
tur
e
s
e
lec
ti
on
pr
o
c
e
s
s
,
we
e
nha
nc
e
the
ove
r
a
ll
pe
r
f
o
r
manc
e
,
e
f
f
icie
nc
y,
a
nd
a
c
c
ur
a
c
y
of
the
I
oT
ne
twor
k
in
tr
us
ion
de
tec
ti
on
mo
de
l.
Al
gor
it
hm
1
.
F
e
a
tur
e
s
e
lec
ti
on
a
lgor
it
hm
(
DT
B
F
S
+
C
B
F
S
)
1:
Input: Dataset D with multiple features including numeric and object types.
2:
Initialize:
3:
label_column=column that contains class/attack label
4:
numeric_features=empty list
5:
Step 1:
Drop object
-
type features (DTBFS)
6:
For each feature f in dataset D:
7:
If f is of object type and f≠label_column:
8:
Drop f from dataset D
9:
Else if f is numeric (integer or float):
10:
Add f to numeric_features
11:
Step 2:
Calculate pearson correlation (CBFS)
12:
Compute correlation matrix C for all features in numeric_features
13:
Step 3: Remove highly correlated features
14:
For each pair of features (f1, f2) in C:
15:
If |C[f1][f2]| > 0.8:
16:
Drop
one
of
the
features
(e.g.,
f2)
based on
lower
correlation
with
target
or
domain relevance
17:
Output: Reduced dataset D_reduced with selected features.
3.
5.
Clas
s
if
icat
ion
I
n
t
h
e
p
r
o
c
e
s
s
o
f
de
t
e
c
t
i
n
g
a
t
t
a
c
ks
o
n
I
o
T
n
e
tw
o
r
ks
,
s
e
le
c
t
in
g
t
he
r
i
g
h
t
c
las
s
i
f
ic
a
ti
o
n
a
lg
o
r
i
t
hm
i
s
c
r
uc
ia
l
f
o
r
a
c
h
i
e
vi
n
g
o
p
t
i
ma
l
a
c
c
u
r
a
c
y
a
n
d
e
f
f
ic
i
e
n
c
y
.
I
n
t
h
i
s
s
t
ud
y
,
w
e
u
t
i
l
iz
e
s
e
v
e
r
a
l
p
o
p
u
la
r
a
n
d
p
r
o
ve
n
c
l
a
s
s
i
f
i
c
a
t
io
n
a
l
g
o
r
i
th
m
s
wi
d
e
ly
u
s
e
d
i
n
va
r
i
o
u
s
ML
a
p
p
l
ic
a
t
io
ns
.
T
h
e
s
e
i
n
c
lu
d
e
D
T
,
R
F
,
XG
B
C
,
A
B
,
a
nd
L
D
A
D
T
is
a
n
a
l
go
r
it
h
m
t
ha
t
bu
i
lds
a
p
r
e
d
ic
t
io
n
m
od
e
l
us
i
ng
a
DT
s
t
r
uc
tu
r
e
.
E
a
c
h
no
de
in
the
t
r
e
e
r
e
p
r
e
s
e
nts
a
f
e
a
t
u
r
e
;
e
a
c
h
b
r
a
n
c
h
r
e
p
r
e
s
e
nts
a
de
c
is
io
n;
a
n
d
e
a
c
h
le
a
f
r
e
p
r
e
s
e
nt
s
a
n
o
ut
c
o
me
.
T
h
e
ma
in
a
dv
a
n
ta
ge
o
f
D
T
is
i
ts
h
ig
h
in
te
r
p
r
e
t
a
b
il
i
ty
,
w
hi
c
h
ma
ke
s
i
t
e
a
s
y
t
o
u
nde
r
s
ta
nd
a
nd
vis
ua
li
z
e
.
R
F
is
a
d
e
v
e
l
op
me
nt
o
f
D
T
t
ha
t
c
o
mb
ine
s
a
nu
m
be
r
o
f
DT
t
o
i
nc
r
e
a
s
e
a
c
c
ur
a
c
y
a
nd
r
e
d
uc
e
o
ve
r
f
i
tt
i
ng
.
Us
i
ng
b
a
gg
in
g
t
e
c
hn
iq
ue
s
,
R
F
bu
il
ds
m
a
n
y
DT
f
r
o
m
d
i
f
f
e
r
e
nt
s
u
bs
e
ts
o
f
da
ta
a
nd
c
o
mb
in
e
s
t
he
r
e
s
ul
ts
.
X
GB
C
is
a
b
oos
ti
ng
a
lg
o
r
i
th
m
t
ha
t
c
o
mb
ines
man
y
we
a
k
de
c
is
io
ns
t
r
e
e
mo
de
ls
to
f
o
r
m
a
s
t
r
o
ng
m
o
de
l
.
XG
B
C
is
r
e
now
ne
d
f
o
r
i
ts
h
i
gh
s
p
e
e
d
a
nd
pe
r
f
o
r
ma
nc
e
,
a
s
we
ll
a
s
i
ts
a
b
i
li
ty
to
ha
nd
le
lar
g
e
a
n
d
i
m
ba
lan
c
e
d
da
tas
e
ts
.
T
h
is
a
lg
o
r
i
t
hm
it
e
r
a
t
iv
e
l
y
c
o
r
r
e
c
ts
p
r
e
v
io
us
m
od
e
l
e
r
r
or
s
,
f
oc
us
i
ng
e
a
c
h
ne
w
t
r
e
e
on
the
m
is
ta
ke
s
ma
de
b
y
th
e
p
r
e
v
i
ous
t
r
e
e
.
M
e
a
n
wh
il
e
,
AB
is
a
no
th
e
r
b
oos
t
in
g
a
l
go
r
it
hm
t
ha
t
c
o
mb
in
e
s
a
nu
m
be
r
of
w
e
a
k
DT
m
od
e
ls
t
o
f
or
m
a
s
t
r
o
ng
m
ode
l
.
Ho
we
ve
r
,
u
n
l
ike
X
GB
C
,
AB
a
d
jus
ts
th
e
we
i
gh
t
o
f
e
a
c
h
da
t
a
i
ns
ta
nc
e
b
a
s
e
d
on
t
he
e
r
r
o
r
o
f
t
he
p
r
e
v
io
us
mo
de
l
,
s
o
t
ha
t
da
ta
t
ha
t
is
d
i
f
f
ic
u
lt
t
o
c
l
a
s
s
i
f
y
ge
ts
m
or
e
a
t
te
nt
io
n
i
n
t
he
ne
xt
i
t
e
r
a
t
io
n
.
T
h
is
a
lg
o
r
i
t
hm
is
e
f
f
e
c
t
ive
i
n
i
nc
r
e
a
s
i
ng
mo
de
l
a
c
c
u
r
a
c
y
on
da
ta
tha
t
is
n
ot
to
o
la
r
g
e
a
n
d
c
om
pl
e
x
.
One
of
the
objec
ti
ve
s
of
the
s
tatis
ti
c
a
l
tec
hnique
known
a
s
L
DA
is
to
identif
y
li
ne
a
r
f
e
a
tur
e
c
ombi
na
ti
ons
that
c
a
n
be
us
e
d
to
di
f
f
e
r
e
nti
a
te
be
twe
e
n
two
o
r
mor
e
c
las
s
e
s
in
the
da
ta.
T
his
tec
h
nique
is
f
r
e
que
ntl
y
uti
li
z
e
d
in
the
pr
oc
e
s
s
e
s
of
pa
tt
e
r
n
r
e
c
ognit
ion,
c
las
s
if
ica
ti
on,
a
nd
dim
e
ns
ionalit
y
r
e
duc
ti
on.
L
DA
is
a
tec
hnique
that
e
nde
a
vor
s
to
p
r
ojec
t
da
ta
int
o
a
s
pa
c
e
with
f
e
we
r
dim
e
ns
ions
while
s
uc
c
e
s
s
f
ull
y
pr
e
s
e
r
ving
the
va
r
ious
c
las
s
e
s
.
3.
6.
Conf
u
s
ion
m
a
t
r
ix
C
onf
us
ion
matr
ix
is
a
ve
r
y
us
e
f
ul
tool
in
e
va
luati
ng
the
pe
r
f
or
manc
e
of
c
las
s
if
ica
ti
on
models
.
T
his
matr
ix
p
r
ovides
a
c
lea
r
p
ictur
e
o
f
how
the
c
las
s
if
i
c
a
ti
on
model
make
s
pr
e
dictions
on
tes
t
da
ta
by
c
o
mpar
ing
the
model
pr
e
dictions
with
the
a
c
tual
labe
ls
.
T
he
c
onf
us
ion
matr
ix
c
ons
is
ts
o
f
f
our
main
c
ompone
nts
:
tr
ue
pos
it
ives
(
T
P
)
,
tr
ue
ne
ga
ti
ve
s
(
T
N)
,
f
a
ls
e
pos
it
ives
(
F
P
)
,
a
nd
f
a
ls
e
ne
ga
ti
ve
s
(
F
N)
.
T
P
:
number
of
c
a
s
e
s
whe
r
e
the
model
c
or
r
e
c
tl
y
pr
e
dicte
d
the
pos
it
ive
c
las
s
.
T
N:
number
of
c
a
s
e
s
whe
r
e
the
model
c
or
r
e
c
tl
y
pr
e
dicte
d
the
ne
ga
ti
ve
c
las
s
,
F
P
:
number
of
c
a
s
e
s
whe
r
e
the
mo
de
l
incor
r
e
c
tl
y
pr
e
dicte
d
the
pos
it
ive
c
las
s
whe
n
it
s
hould
ha
ve
be
e
n
ne
ga
ti
ve
.
F
N:
numbe
r
of
c
a
s
e
s
whe
r
e
the
model
inco
r
r
e
c
tl
y
pr
e
dicte
d
a
ne
ga
ti
ve
c
las
s
whe
n
it
s
hould
ha
ve
be
e
n
pos
it
ive.
Us
ing
the
c
onf
us
ion
matr
ix,
we
c
a
n
c
a
lcula
te
s
e
ve
r
a
l
other
im
por
tant
e
va
luation
metr
ics
s
uc
h
a
s
a
c
c
ur
a
c
y,
pr
e
c
is
ion,
r
e
c
a
ll
,
a
nd
F
1
-
s
c
or
e
,
a
ll
of
whic
h
pr
ovide
de
e
pe
r
ins
ight
a
bout
model
pe
r
f
or
manc
e
a
s
s
hown
in
a
c
c
ur
a
c
y
(
1)
:
the
pr
opor
ti
on
of
c
or
r
e
c
t
pr
e
dictions
out
of
a
ll
pr
e
dic
ti
ons
,
is
a
ge
ne
r
a
l
ide
a
of
how
of
ten
the
model
make
s
c
or
r
e
c
t
pr
e
dictions
.
P
r
e
c
is
i
on
(
2)
:
the
pr
opo
r
ti
on
of
c
or
r
e
c
t
pos
it
ive
p
r
e
dictions
.
R
e
c
a
ll
(
3)
:
the
pr
opo
r
ti
on
o
f
to
tal
pos
it
ives
that
we
r
e
c
or
r
e
c
tl
y
de
tec
ted.
F
1
-
s
c
or
e
(
4
)
:
F
1
-
s
c
or
e
pr
ovides
a
ba
lanc
e
be
twe
e
n
pr
e
c
is
ion
a
nd
r
e
c
a
ll
a
nd
is
ve
r
y
us
e
f
ul
wh
e
n
the
c
las
s
dis
tr
ibut
ion
is
unba
lanc
e
d.
=
(
+
)
+
+
+
(
1)
Evaluation Warning : The document was created with Spire.PDF for Python.
I
nt
J
Ar
ti
f
I
ntell
I
S
S
N:
2252
-
8938
R
e
v
olut
ioni
z
ing
I
oT
int
r
us
ion
de
tec
ti
on
us
ing
mac
hine
lear
ning
w
it
h
…
(
Z
u
lhi
pni
R
e
no
Saputr
a
E
ls
i
)
3053
=
(
+
)
(
2)
=
(
+
)
(
3)
1
−
=
2
(
∗
)
+
(
4)
4.
RE
S
UL
T
S
AN
D
DI
S
CU
S
S
I
ON
I
n
thi
s
s
e
c
ti
on,
we
d
is
c
us
s
the
r
e
s
ult
s
of
a
pplyi
n
g
unidi
r
e
c
ti
ona
l,
bidi
r
e
c
ti
ona
l
,
a
nd
pa
c
ke
t
f
e
a
tur
e
e
xtr
a
c
ti
on
methods
c
ombi
ne
d
with
DT
B
F
S
a
nd
C
B
F
S
f
e
a
tur
e
s
e
lec
ti
on
f
or
de
tec
ti
ng
a
tt
a
c
ks
on
I
o
T
ne
twor
ks
.
T
he
c
las
s
if
ica
ti
on
r
e
s
ult
s
ba
s
e
d
on
thes
e
e
xtr
a
c
ti
on
a
nd
s
e
lec
ti
on
methods
will
be
a
na
lyze
d,
inclu
ding
the
c
onf
us
ion
matr
ix
,
a
c
c
ur
a
c
y,
a
nd
pr
oc
e
s
s
ing
ti
me
.
F
ur
ther
mor
e
,
we
c
ompar
e
thes
e
r
e
s
ult
s
with
other
s
tudi
e
s
that
ha
ve
us
e
d
the
s
a
me
da
tas
e
t.
T
he
li
s
t
of
the
f
e
a
tur
e
s
de
r
ived
f
r
om
di
f
f
e
r
e
nt
r
a
w
da
ta
e
xt
r
a
c
ti
on
methods
a
r
e
a
s
f
oll
ows
.
F
o
r
unidi
r
e
c
ti
ona
l_m
ult
i_cla
s
s
.
C
S
V
pr
oduc
e
s
19
f
e
a
tur
e
s
,
while
bidi
r
e
c
ti
ona
l_m
u
lt
i_cla
s
s
.
c
s
v
pr
oduc
e
s
36
f
e
a
tu
r
e
s
,
a
nd
pa
c
ke
t_f
e
a
tur
e
_m
ult
i_cla
s
s
.
C
S
V
pr
oduc
e
s
53
f
e
a
tu
r
e
s
.
E
a
c
h
da
tas
e
t
(
*
.
c
s
v)
c
ons
is
ts
of
objec
t,
f
loat64
,
a
nd
int
64
da
ta
types
.
T
a
ble
2
pr
e
s
e
nts
the
na
mes
of
the
f
e
a
tur
e
s
of
e
a
c
h
da
tas
e
t.
I
n
unidi
r
e
c
ti
ona
l
e
xtr
a
c
ti
on
de
s
c
r
ibes
one
-
wa
y
tr
a
f
f
ic
be
twe
e
n
two
point
s
(
e
.
g
.
f
r
om
s
ou
r
c
e
to
de
s
ti
na
ti
on)
,
s
uc
h
a
s
ip_s
r
c
f
e
a
tur
e
,
ip_ds
t
f
e
a
tur
e
a
s
s
our
c
e
a
nd
de
s
ti
na
ti
on
I
P
a
ddr
e
s
s
e
s
,
pr
t_s
r
c
f
e
a
tu
r
e
,
pr
t_ds
t
f
e
a
tur
e
a
s
s
our
c
e
a
nd
de
s
ti
na
ti
on
por
ts
us
e
d
in
c
omm
unica
ti
on,
p
r
oto
f
e
a
tur
e
a
s
p
r
otocol
us
e
d
in
c
omm
unica
ti
on
(
s
uc
h
a
s
T
C
P
,
UD
P
)
.
F
e
a
tur
e
s
li
ke
num_pkt
s
f
e
a
tur
e
,
num_by
tes
f
e
a
tur
e
is
the
num
be
r
of
pa
c
ke
ts
a
nd
bytes
s
e
nt
in
a
one
-
wa
y
da
ta
s
tr
e
a
m;
mea
n_iat
f
e
a
tur
e
,
s
td_i
a
t
f
e
a
tur
e
,
mi
n_iat
f
e
a
tur
e
,
max_ia
t
f
e
a
tur
e
to
mea
s
ur
e
the
ti
me
be
twe
e
n
pa
c
ke
t
a
r
r
ivals
(
int
e
r
a
r
r
ival
ti
me
)
,
thi
s
c
a
n
be
us
e
d
to
de
tec
t
a
bnor
mal
tr
a
f
f
ic
pa
tt
e
r
ns
;
a
nd
s
td_pkt
_len
f
e
a
tur
e
,
mi
n_pkt_l
e
n
f
e
a
tur
e
,
max_pkt_len
f
e
a
tur
e
a
r
e
s
tatis
ti
c
s
of
pa
c
ke
t
length
s
e
nt
in
one
dir
e
c
ti
on
.
T
a
ble
2.
Unidir
e
c
ti
ona
l,
bidi
r
e
c
ti
ona
l
,
a
nd
pa
c
ka
ge
f
e
a
tur
e
e
xtr
a
c
ti
on
f
e
a
tur
e
s
in
M
QT
T
-
I
oT
-
I
DS202
0
U
ni
di
r
e
c
ti
ona
l
B
id
ir
e
c
ti
ona
l
P
a
c
ka
ge
f
e
a
tu
r
e
ip
_s
r
c
ip
_s
r
c
f
w
d_s
td
_pkt
_l
e
n
S
ta
mqt
t_
f
la
g_pa
s
s
w
d
tc
p_f
la
g_c
w
r
ip
_ds
t
ip
_ds
t
bw
d_s
td
_pkt
_l
e
n
dpor
t
mqt
t_
f
la
g_qos
tc
p_f
la
g_e
c
n
pr
t_
s
r
c
pr
t_
s
r
c
f
w
d_mi
n_pkt_l
e
n
ds
t_
ip
mqt
t_
f
la
g_r
e
s
e
r
ve
d
tc
p_f
la
g_f
in
pr
t_
ds
t
pr
t_
ds
t
bw
d_mi
n_pkt_l
e
n
ds
t_
ma
c
mqt
t_
f
la
g_r
e
ta
in
tc
p_f
la
g_ns
pr
ot
o
pr
ot
o
f
w
d_ma
x_pkt_l
e
n
ds
t_
por
t
mqt
t_
f
la
g_una
me
tc
p_f
la
g_pus
h
num_pkt
s
f
w
d_num_pkt
s
bw
d_ma
x_pkt_l
e
n
f
4b_a
mqt
t_
f
la
g_w
il
lf
la
g
tc
p_f
la
g_r
e
s
me
a
n_i
a
t
bw
d_num_pkt
s
f
w
d_num_byt
e
s
f
4b_b
mqt
t_
me
s
s
a
ge
le
ngt
h
tc
p_f
la
g_r
e
s
e
t
s
td
_i
a
t
f
w
d_me
a
n_i
a
t
bw
d_num_byt
e
s
f
la
gs
mqt
t_
me
s
s
a
ge
ty
pe
tc
p_f
la
g_s
yn
mi
n_i
a
t
bw
d_me
a
n_i
a
t
f
w
d_num_ps
h_f
la
gs
id
opt
io
ns
tc
p_f
la
g_ur
g
ma
x_i
a
t
f
w
d_s
td
_i
a
t
bw
d_num_ps
h_f
la
gs
ip
_a
por
t_
a
ti
me
s
ta
mp
me
a
n_of
f
s
e
t
bw
d_s
td
_i
a
t
f
w
d_num_r
s
t_
f
la
gs
ip
_b
por
t_
b
tr
a
n_pr
ot
me
a
n_pkt_l
e
n
f
w
d_mi
n_i
a
t
bw
d_num_r
s
t_
f
la
gs
ip
_f
la
g_df
pr
ot
tr
a
ns
por
t
num_byt
e
s
bw
d_mi
n_i
a
t
f
w
d_num_ur
g_f
la
gs
ip
_f
la
g_mf
s
f
p_a
ts
_e
nd
num_ps
h_f
la
gs
f
w
d_ma
x_i
a
t
bw
d_num_ur
g_f
la
gs
ip
_f
la
g_r
b
s
f
p_b
ts
_s
ta
r
t
num_r
s
t_
f
la
gs
bw
d_ma
x_i
a
t
s
e
c
_i
p_s
r
c
ip
_l
e
n
s
por
t
ttl
num_ur
g_f
la
gs
f
w
d_me
a
n_of
f
s
e
t
num_s
r
c
_f
lo
w
s
le
ngt
h
s
r
c
_i
p
s
td
_pkt
_l
e
n
bw
d_me
a
n_of
f
s
e
t
s
r
c
_i
p_ds
t_
pr
t_
de
lt
a
ma
c
_a
s
r
c
_ma
c
mi
n_pkt_l
e
n
f
w
d_me
a
n_pkt_l
e
n
ma
c
_b
s
r
c
_por
t
ma
x_pkt_l
e
n
bw
d_me
a
n_pkt_l
e
n
mqt
t_
f
la
g_c
le
a
n
tc
p_f
la
g_a
c
k
B
idi
r
e
c
ti
ona
l
e
xtr
a
c
ti
on
de
s
c
r
ibes
including
two
-
wa
y
tr
a
f
f
ic
da
ta
be
twe
e
n
s
our
c
e
a
nd
de
s
ti
na
ti
on,
s
uc
h
a
s
f
wd_s
td_pkt
_len
f
e
a
tur
e
,
bwd_s
td_pkt
_len
f
e
a
tur
e
is
the
a
ve
r
a
ge
length
of
the
pa
c
ke
t
in
the
f
o
r
wa
r
d
a
nd
ba
c
kwa
r
d
di
r
e
c
ti
ons
;
f
wd_m
in_pkt
_len
f
e
a
tur
e
,
bwd_min_pkt
_
len
f
e
a
tur
e
is
the
mi
nim
um
lengt
h
of
the
pa
c
ke
t
in
the
f
o
r
wa
r
d
a
nd
ba
c
kwa
r
d
dir
e
c
ti
ons
;
f
wd_ma
x_pkt_l
e
n
f
e
a
tur
e
,
bwd_ma
x_pkt_l
e
n
f
e
a
tu
r
e
is
the
maximum
length
of
the
pa
c
ke
t
s
e
nt
in
the
f
o
r
wa
r
d
a
nd
ba
c
kwa
r
d
dir
e
c
ti
ons
;
f
wd_num_pkts
f
e
a
tur
e
,
bwd_
num_pkt
s
f
e
a
tur
e
is
the
number
of
pa
c
ke
ts
s
e
nt
in
f
or
wa
r
d
a
nd
ba
c
kwa
r
d
di
r
e
c
ti
ons
;
f
wd_num_ps
h_f
lags
f
e
a
tur
e
,
bwd_num_ps
h_f
lags
f
e
a
tur
e
is
the
number
of
pus
h
f
lags
in
pa
c
ke
ts
in
e
a
c
h
dir
e
c
ti
on;
a
nd
s
e
c
_ip_s
r
c
f
e
a
tur
e
is
the
s
e
c
ond
I
P
a
ddr
e
s
s
s
our
c
e
us
e
d
in
bidi
r
e
c
ti
ona
l
c
omm
u
nica
ti
on.
F
e
a
tur
e
pa
c
ke
t
e
xtr
a
c
ti
on
de
s
c
r
ibes
f
e
a
tur
e
s
with
s
pe
c
if
ic
pr
otocols
a
nd
pa
c
ke
t
c
ha
r
a
c
ter
is
ti
c
s
,
s
uc
h
a
s
S
ta
f
e
a
tur
e
,
f
lags
f
e
a
tu
r
e
,
opti
ons
f
e
a
tur
e
a
bout
meta
da
ta
a
bout
s
tatus
a
nd
f
lags
in
pa
c
ke
ts
;
mqt
t_f
lag_pa
s
s
wd
f
e
a
tur
e
,
m
qtt
_
f
lag_qos
f
e
a
tur
e
,
mqt
t_f
lag_una
me
f
e
a
tur
e
r
e
f
e
r
s
to
M
QT
T
f
lag,
whic
h
is
im
por
tant
in
I
o
T
c
omm
unica
ti
on,
be
c
a
us
e
M
QT
T
is
a
c
omm
only
us
e
d
pr
otocol
in
I
oT
ne
twor
ks
;
tcp_f
lag_c
wr
f
e
a
tur
e
,
tcp_f
lag_e
c
n
f
e
a
tur
e
,
tcp_f
lag_s
yn
f
e
a
tur
e
,
e
tc.
a
r
e
r
e
late
d
to
f
lag
s
in
T
C
P
pr
otocol
.
T
he
s
e
f
lags
ind
ica
te
the
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
S
N
:
2252
-
8938
I
nt
J
Ar
ti
f
I
ntell
,
Vol.
14,
No.
4,
Augus
t
2025
:
304
7
-
3062
3054
T
C
P
s
e
s
s
ion
s
tatus
(
s
uc
h
a
s
S
YN
f
or
c
onne
c
ti
on
i
nit
iation
o
r
F
I
N
f
o
r
c
onne
c
ti
on
te
r
mi
na
ti
on)
;
f
e
a
tur
e
ip_a
,
f
e
a
tur
e
ip_b,
f
e
a
tur
e
mac
_a
,
f
e
a
tu
r
e
mac
_b
a
r
e
the
I
P
a
nd
M
AC
a
ddr
e
s
s
e
s
us
e
d
in
the
pa
c
ke
t.
F
igur
e
s
3
(
a
)
to
3
(
t)
il
lus
tr
a
tes
the
c
onf
us
ion
m
a
tr
ix
with
the
u
nidi
r
e
c
ti
ona
l
e
xtr
a
c
ti
on
da
tas
e
t
s
howing
the
tr
a
ini
ng
a
nd
tes
ti
ng
r
e
s
ult
s
of
va
r
ious
ML
a
lgor
it
hms
(
DT
,
R
F
,
XG
B
oos
t,
AB
,
a
nd
L
DA
)
on
two
f
e
a
tur
e
s
e
lec
ti
on
tec
hniques
,
na
mely
DT
B
F
S
a
nd
C
B
F
S
.
T
hus
,
pr
ovidi
n
g
a
c
ompr
e
he
ns
ive
pictur
e
of
how
f
e
a
tur
e
s
e
lec
ti
on
a
f
f
e
c
ts
the
pr
e
dictive
a
bil
it
y
o
f
e
a
c
h
a
lgor
it
hm
,
whi
le
F
igur
e
s
4
(
a
)
to
4
(
t)
i
ll
us
tr
a
tes
the
c
onf
us
ion
matr
ix
with
the
bidi
r
e
c
ti
ona
l
e
xtr
a
c
ti
on
da
tas
e
t,
F
igur
e
s
5
(
a
)
to
5(
t
)
il
lus
tr
a
tes
the
c
onf
us
io
n
matr
i
x
with
the
pa
c
ke
t
f
e
a
tur
e
e
xtr
a
c
ti
on
da
tas
e
t.
F
igur
e
s
3
to
5
c
ontain
the
va
lues
of
T
P
,
T
N,
F
P
a
nd
F
N
th
a
t
c
a
n
be
us
e
d
to
mea
s
ur
e
the
va
lues
of
p
r
e
c
is
ion
,
r
e
c
a
ll
,
a
nd
F
1
-
s
c
or
e
.
T
a
ble
3
s
hows
the
pr
e
c
is
ion
va
lue
o
f
the
a
ppli
e
d
c
las
s
if
ica
ti
on
models
;
T
a
ble
4
s
hows
the
r
e
c
a
ll
va
lue
of
the
a
ppli
e
d
c
las
s
if
ica
ti
on
models
while
T
a
ble
5
s
hows
the
F
1
-
s
c
or
e
va
lues
,
whic
h
a
r
e
the
h
a
r
moni
c
mea
n
be
twe
e
n
pr
e
c
is
ion
a
nd
r
e
c
a
ll
.
All
c
las
s
if
ica
ti
on
models
a
r
e
a
ppli
e
d
to
da
ta
with
a
divi
ding
r
a
ti
o
of
75%
f
or
tr
a
ini
ng
a
nd
25%
f
or
tes
ti
ng.
E
a
c
h
table
s
hows
how
the
model
r
e
s
ponds
to
da
ta
with
dif
f
e
r
e
nt
c
ha
r
a
c
ter
is
ti
c
s
(
unidi
r
e
c
ti
ona
l,
bidi
r
e
c
ti
ona
l
,
a
nd
pa
c
ke
t
f
e
a
tur
e
s
)
a
nd
how
the
model
pe
r
f
or
manc
e
c
a
n
be
im
pr
ove
d
with
a
n
a
ppr
opr
iate
f
e
a
tur
e
s
e
lec
ti
on
met
hod
(
DT
B
F
S
or
C
B
F
S
)
.
D
T
,
R
F
,
a
n
d
X
GB
C
ha
v
e
a
v
a
l
ue
o
f
1
0
0
i
n
p
r
e
c
is
i
on
,
r
e
c
a
l
l
,
a
nd
F
1
s
c
o
r
e
o
n
bo
t
h
t
y
pe
s
o
f
D
T
B
S
a
nd
C
B
F
S
f
e
a
t
u
r
e
s
e
l
e
c
t
i
on
f
o
r
a
l
l
ty
p
e
s
o
f
un
i
d
i
r
e
c
t
i
on
a
l
,
b
i
d
i
r
e
c
t
io
n
a
l
,
a
n
d
pa
r
c
e
l
f
e
a
tu
r
e
s
i
n
f
e
a
t
u
r
e
e
xt
r
a
c
t
i
on
.
M
e
a
n
w
hi
l
e
,
AB
ha
s
a
m
o
r
e
b
a
la
nc
e
d
p
e
r
f
o
r
m
a
n
c
e
,
a
l
t
h
o
ug
h
AB
's
p
r
e
c
is
i
o
n
,
r
e
c
a
l
l
,
a
n
d
F
1
s
c
o
r
e
a
r
e
l
ow
e
r
t
ha
n
o
t
h
e
r
m
o
de
ls
,
i
t
s
p
e
r
f
o
r
m
a
nc
e
is
q
u
i
te
c
o
ns
is
t
e
n
t
a
nd
m
o
r
e
r
e
a
l
is
t
ic
,
e
s
p
e
c
i
a
l
ly
i
n
t
h
e
pa
c
ka
ge
f
e
a
t
u
r
e
s
c
e
na
r
i
o
.
W
h
i
l
e
L
D
A
pe
r
f
o
r
m
s
we
l
l
o
n
p
a
c
k
a
g
e
f
e
a
tu
r
e
s
,
t
h
e
u
s
e
o
f
t
h
e
C
B
F
S
m
e
th
o
d
g
e
n
e
r
a
l
l
y
i
m
p
r
o
ve
s
t
h
e
p
e
r
f
o
r
m
a
n
c
e
o
f
L
DA
c
o
m
pa
r
e
d
to
D
T
B
F
S
,
m
a
ki
n
g
it
m
o
r
e
s
u
i
t
a
b
l
e
f
o
r
c
o
m
p
le
x
d
a
ta
s
e
ts
,
w
i
t
h
d
a
ta
p
r
e
c
is
i
on
v
a
l
u
e
s
r
a
n
g
i
ng
f
r
o
m
7
5
.
2
2
9
t
o
9
2
.
33
0
,
r
e
c
a
l
l
r
a
n
gi
n
g
f
r
o
m
6
4
.
20
7
t
o
9
0
.
5
8
4
w
h
i
le
F
1
s
c
o
r
e
r
a
n
g
i
ng
f
r
o
m
6
3
.
1
6
6
t
o
85
.
4
01
.
T
a
ble
3.
P
r
e
c
is
ion
va
lue
C
la
s
s
if
ic
a
ti
on
S
pl
it
d
a
ta
(
75%
:2
5%
)
U
ni
di
r
e
c
ti
ona
l
B
id
ir
e
c
ti
ona
l
P
a
c
ke
t
f
e
a
tu
r
e
D
T
B
F
S
C
B
F
S
D
T
B
F
S
C
B
F
S
D
T
B
F
S
C
B
F
S
DT
T
r
a
in
in
g da
ta
100.000
100.000
100.000
100.000
100.000
100.000
T
e
s
ti
ng da
ta
100.000
100.000
100.000
100.000
100.000
100.000
RF
T
r
a
in
in
g da
ta
100.000
100.000
100.000
100.000
100.000
100.000
T
e
s
ti
ng da
ta
100.000
100.000
100.000
100.000
100.000
100.000
X
G
B
C
T
r
a
in
in
g da
ta
100.000
100.000
100.000
100.000
100.000
100.000
T
e
s
ti
ng da
ta
100.000
100.000
100.000
100.000
100.000
100.000
AB
T
r
a
in
in
g da
ta
52.270
52.270
51.361
51.361
73.841
73.841
T
e
s
ti
ng da
ta
52.278
52.278
51.375
51.375
73.818
73.818
L
D
A
T
r
a
in
in
g da
ta
75.229
82.072
78.010
78.434
92.330
90.584
T
e
s
ti
ng da
ta
75.248
81.986
77.837
78.319
92.242
90.581
T
a
ble
4.
R
e
c
a
ll
va
lue
C
la
s
s
if
ic
a
ti
on
S
pl
it
d
a
ta
(
75%
:2
5%
)
U
ni
di
r
e
c
ti
ona
l
B
id
ir
e
c
ti
ona
l
P
a
c
ke
t
f
e
a
tu
r
e
D
T
B
F
S
C
B
F
S
D
T
B
F
S
C
B
F
S
D
T
B
F
S
C
B
F
S
DT
T
r
a
in
in
g da
ta
100.000
100.000
100.000
100.000
100.000
100.000
T
e
s
ti
ng da
ta
100.000
100.000
100.000
100.000
100.000
100.000
RF
T
r
a
in
in
g da
ta
100.000
100.000
100.000
100.000
100.000
100.000
T
e
s
ti
ng da
ta
100.000
100.000
100.000
100.000
100.000
100.000
X
G
B
C
T
r
a
in
in
g da
ta
100.000
100.000
100.000
100.000
100.000
100.000
T
e
s
ti
ng da
ta
100.000
100.000
100.000
100.000
100.000
100.000
AB
T
r
a
in
in
g da
ta
60.000
60.000
60.000
60.000
80.000
80.000
T
e
s
ti
ng da
ta
60.000
60.000
60.000
60.000
80.000
80.000
L
D
A
T
r
a
in
in
g da
ta
64.207
63.158
69.235
69.565
84.701
83.030
T
e
s
ti
ng da
ta
64.258
63.175
69.060
69.458
84.725
83.064
T
a
ble
5.
F
1
-
s
c
or
e
va
lue
C
la
s
s
if
ic
a
ti
on
S
pl
it
d
a
ta
(
75%
:2
5%
)
U
ni
di
r
e
c
ti
ona
l
B
id
ir
e
c
ti
ona
l
P
a
c
ke
t
f
e
a
tu
r
e
D
T
B
F
S
C
B
F
S
D
T
B
F
S
C
B
F
S
D
T
B
F
S
C
B
F
S
DT
T
r
a
in
in
g da
ta
100.000
100.000
100.000
100.000
100.000
100.000
T
e
s
ti
ng da
ta
100.000
100.000
100.000
100.000
100.000
100.000
RF
T
r
a
in
in
g da
ta
100.000
100.000
100.000
100.000
100.000
100.000
T
e
s
ti
ng da
ta
100.000
100.000
100.000
100.000
100.000
100.000
X
G
B
C
T
r
a
in
in
g da
ta
100.000
100.000
100.000
100.000
100.000
100.000
T
e
s
ti
ng da
ta
100.000
100.000
100.000
100.000
100.000
100.000
AB
T
r
a
in
in
g da
ta
55.210
55.210
54.490
54.490
76.360
76.360
T
e
s
ti
ng da
ta
55.215
55.215
54.502
54.502
76.344
76.344
L
D
A
T
r
a
in
in
g da
ta
67.196
63.166
72.606
72.988
85.401
83.032
T
e
s
ti
ng da
ta
67.231
63.143
72.396
72.847
85.427
83.088
Evaluation Warning : The document was created with Spire.PDF for Python.
I
nt
J
Ar
ti
f
I
ntell
I
S
S
N:
2252
-
8938
R
e
v
olut
ioni
z
ing
I
oT
int
r
us
ion
de
tec
ti
on
us
ing
mac
hine
lear
ning
w
it
h
…
(
Z
u
lhi
pni
R
e
no
Saputr
a
E
ls
i
)
3055
(
a
)
(
b)
(
c
)
(
d)
(
e
)
(f)
(
g)
(
h)
(
i)
(
j)
(
k)
(
l)
(
m)
(
n)
(
o)
(
p)
(
q)
(r
)
(
s
)
(
t)
F
i
gu
r
e
3
.
U
ni
d
ir
e
c
ti
on
a
l
ma
t
r
i
x
c
o
n
f
us
io
n
:
(
a
)
D
T
-
DT
B
F
S
t
r
a
in
in
g
,
D
T
-
D
T
B
F
S
tes
ti
ng
,
(
c
)
D
T
-
C
B
F
S
t
r
a
in
i
ng
,
(
d
)
D
T
-
C
B
F
S
tes
ti
ng
,
(
e
)
R
F
-
D
T
B
F
S
t
r
a
i
ni
ng
,
(
f
)
R
F
-
D
T
B
F
S
tes
t
in
g
,
(
g
)
t
r
a
i
ni
ng
R
F
-
C
B
F
S
,
(
h
)
t
e
s
t
i
ng
R
F
-
C
B
F
S
,
(
i
)
tr
a
i
ni
ng
XG
B
C
-
D
T
B
F
S
,
(
j
)
t
e
s
t
in
g
X
GB
C
-
D
T
B
F
S
,
(
k
)
t
r
a
i
n
in
g
XG
B
C
-
C
B
F
S
,
(
l
)
tes
t
in
g
XG
B
C
-
C
B
F
S
,
(
m
)
tr
a
i
ni
ng
AB
-
D
T
B
F
S
,
(
n
)
tes
ti
ng
AB
-
D
T
B
F
S
,
(
o
)
t
r
a
i
ni
ng
AB
-
C
B
F
S
,
(
p
)
tes
t
in
g
AB
-
C
B
F
S
,
(
q
)
t
r
a
in
in
g
L
DA
-
D
T
B
F
S
,
(
r
)
t
e
s
t
in
g
L
D
A
-
D
T
B
F
S
,
(
s
)
t
r
a
i
ni
ng
L
DA
-
C
B
F
S
,
a
n
d
(
t
)
tes
ti
ng
L
DA
-
C
B
F
S
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
S
N
:
2252
-
8938
I
nt
J
Ar
ti
f
I
ntell
,
Vol.
14,
No.
4,
Augus
t
2025
:
304
7
-
3062
3056
(
a
)
(
b)
(
c
)
(
d)
(
e
)
(f)
(
g)
(
h)
(
i)
(
j)
(
k)
(
l)
(
m)
(
n)
(
o)
(
p)
(
q)
(r)
(
s
)
(
t)
F
i
gu
r
e
4
.
B
id
i
r
e
c
t
io
na
l
ma
t
r
i
x
c
on
f
us
i
on
:
(
a
)
t
r
a
i
ni
ng
D
T
-
D
T
B
F
S
,
(
b
)
t
e
s
t
in
g
D
T
-
D
T
B
F
S
,
(
c
)
t
r
a
i
n
in
g
D
T
-
C
B
F
S
,
(
d
)
t
e
s
t
i
ng
D
T
-
C
B
F
S
,
(
e
)
tr
a
i
ni
ng
R
F
-
DT
B
F
S
,
(
f
)
tes
ti
ng
R
F
-
DT
B
F
S
,
(
g
)
t
r
a
in
in
g
R
F
-
C
B
F
S
,
(
h
)
t
e
s
ti
ng
RF
-
C
B
F
S
,
(
i
)
t
r
a
i
ni
ng
XG
B
C
-
DT
B
F
S
,
(
j
)
tes
ti
ng
X
G
B
C
-
D
T
B
F
S
,
(
k
)
t
r
a
i
ni
ng
XG
B
C
-
C
B
F
S
,
(
l
)
tes
ti
ng
X
GB
C
-
C
B
F
S
,
(
m
)
tr
a
i
ni
ng
AB
-
D
T
B
F
S
,
(
n
)
tes
ti
ng
AB
-
D
T
B
F
S
,
(
o
)
t
r
a
i
ni
ng
AB
-
C
B
F
S
,
(
p
)
tes
t
in
g
AB
-
C
B
F
S
,
(
q
)
t
r
a
in
in
g
L
DA
-
D
T
B
F
S
,
(
r
)
t
e
s
t
in
g
L
D
A
-
D
T
B
F
S
,
(
s
)
t
r
a
i
ni
ng
L
DA
-
C
B
F
S
,
a
n
d
(
t
)
tes
ti
ng
L
DA
-
C
B
F
S
Evaluation Warning : The document was created with Spire.PDF for Python.