Towards the Development of a Cloud Computing Intrusion Detection Framework Using an Ensemble Hybrid Feature Selection Approach

Table 9

Intrusion packet identification: performance metrics.

Classifier/feature set	TP	FP	TN	FN	CA	ER	PR	RC	FPR	FNR	FAR (FPR + FNR)/2
	In number of packets				In percentage
C1-All	14,165	77	15,383	79	99.47	0.53	99.46	99.45	0.5	0.55	0.53
C1-Ens	14,152	100	15,360	92	99.35	0.65	99.3	99.35	0.65	0.65	0.65
C2-All	14,170	53	15,407	74	99.57	0.43	99.63	99.48	0.34	0.52	0.43
C2-Ens	14,163	60	15,400	81	99.53	0.47	99.58	99.43	0.39	0.57	0.48
C3-All	13,739	337	15,123	505	97.17	2.83	97.61	96.45	2.18	3.55	2.86
C3-Ens	13,521	520	14,940	723	95.82	4.18	96.3	94.92	3.36	5.08	4.22
C4-All	274	208	15,252	13,970	52.27	47.73	56.85	1.92	1.35	98.08	49.71
C4-Ens	274	206	15,254	13,970	52.28	47.72	57.08	1.92	1.33	98.08	49.7
C5-All	8,145	14,796	664	6,099	29.66	70.34	35.5	57.18	95.71	42.82	69.26
C5-Ens	8,915	14,693	767	5,329	32.59	67.41	37.76	62.59	95.04	37.41	66.23
C6-All	1	47	15,413	14,243	51.89	48.11	2.08	0.01	0.3	99.99	50.15
C6-Ens	14,244	15,460	0	0	47.95	52.05	47.95	100	100	0	50
C7-All	14,114	144	15,316	130	99.08	0.92	98.99	99.09	0.93	0.91	0.92
C7-Ens	14,067	137	15,323	177	98.94	1.06	99.04	98.76	0.89	1.24	1.06
C8-Al	12,903	737	14,723	1,341	93	7	94.6	90.59	4.77	9.41	7.09
C8-Ens	10,991	279	15,181	3,253	88.11	11.89	97.52	77.16	1.8	22.84	12.32
C9-All	11,868	2,511	12,949	2,376	83.55	16.45	82.54	83.32	16.24	16.68	16.46
C9-Ens	97,51	3,000	12,460	4,493	74.77	25.23	76.47	68.46	19.4	31.54	25.47
C10-All	12,400	3,407	12,053	1,844	82.32	17.68	78.45	87.05	22.04	12.95	17.49
C10-Ens	9,507	1,943	13,517	4,737	77.51	22.49	83.03	66.74	12.57	33.26	22.91
C11-All	14,126	39	15,421	118	99.47	0.53	99.72	99.17	0.25	0.83	0.54
C11-Ens	14,178	68	15,392	66	99.55	0.45	99.52	99.54	0.44	0.46	0.45

All: all features; Ens: features selected by the HEFSM ensemble. C11 is the proposed binary detection engine.