Feature Analysis of the Attacker Perspective

ISSN: 1985-3157 Vol. 2 No. 2 July-December 2008 Industrial Automation and Robotics 49 packet sent by windows environment which may effect the result of detection Amol et al, 2006. AC, A, B W F, AG L,G,H Y,A,B Z,K,N V,Q, AD E, X,AF, C D AO SVM M PB CART RS Figure 5: Probe Comparison. Figure 5 illustrates the features that are useful to detect the probe activities. Features E, X, AF and C are important features as it had constantly been selected by all four approaches. Feature W can also be considered useful since it had been selected by 3 different approaches. As a conclusion, in our research we only select features C, X, AF, A and W for detecting the fast attack. All of the features selected for use is useful in our victims perspectives.

5.2 Feature Analysis of the Attacker Perspective

For src_count and srv_count, we asses the contribution of the feature using likelihood Ratio Test in equation 1 inside logistic regression. The likelihood ratio test is used by comparing the model with and without a particular predictor. If the value of the likelihood ratio model without the predictor decrease when the predictor is included inside the model, it means that adding the predictor give a signiicant contribution to the model in predicting the outcome. Besides the likelihood ratio statistic test, Cox and Snell’s R²cs in equation 2 ISSN: 1985-3157 Vol. 2 No. 2 July-December 2008 Journal of Advanced Manufacturing Technology 50 Cox and Snell, 1989 and Nagelkerke’s R²N in equation 3 can also be used to indicate whether the feature gives a good prediction on the result or outcome variable. Nagelkerke’s is the amendment of the Cox and Snell because the lack of Cox and Snell to reach its theoretical maximum of 1. Now we will discuss the result based on the statistical value from likelihood ratio, Cox and Snell and Nigelkerke’s. This discussion will concentrate on src_count and srv_count respectively. i Assessing the Inluence of the Src_count Feature This feature is used for detecting fast attack launched by single host to multiple hosts. By selecting this feature, it may help to detect the attacker at the initial stages because host scanning is one of the tools that can be used to launch reconnaissance and scanning activity. Furthermore, there is a question on how the feature can inluence the result of the detection of the attacker. This can be validated using statistical value from likelihood ratio test, Cox and Snell and Nigelkerke’s respectively. Table 3 shows the value of the likelihood ratio statistic after the feature include inside the model. Meanwhile, Table 4 show the chi-square x² value of the new model. Therefore by referring to 1, the value of the baseline model without the predictor can be computed. When only the constant was included, -2LL = 509.721. but when src_count had been included this value has been reduced to 85.211. This reduction means that the features has a signiicant inluence at predicting the outcomeattack. Table 3 : Model Summary -2 Log likelihood Cox Snell R Square Nagelkerke R Square 85.211 .328 .869 Table 3 also show the Nigelkerke’s value for the new model which is 0.869. If the value is close to one, it indicated that the predictor gives good inluence to the model in predicting the outcome Andy Field, 2005. From the result, it shows that the value is close to one which means that the feature selected in this research gives a good inluence to the model in predicting the outcome. ISSN: 1985-3157 Vol. 2 No. 2 July-December 2008 Industrial Automation and Robotics 51 Table 4: Model Coeficient Chi-square df Sig. 424.510 1 .000 Beside the likelihood ratio test and Nigelkerke’s test, chi-square test also can be used to verify whether the feature give a signiicant contribution to the model or not. This can be done by generating hypothesis which are Ho, feature does not effect the model prediction and H1, feature effect the model prediction. Table 4 show the chi-square value is 424.510 and the value is signiicant at a 0.05 and 0.01 level. Therefore the H1 hypothesis has been accepted. As a conclusion, the src_count gives a effect to the model in predicting the outcome. ii Assessing the Inluence of Srv_count Feature Srv_count had also been selected as one of the features in this research. This feature also gives a signiicant inluence to the research and the validation is made using the same test with the previous feature. Table 5 shows the value of the likelihood ratio statistic after the features were included inside the model. Meanwhile, Table 6 show the chi-square x² value of the new model. When only the constant was included, the value of the baseline model is ,-2LL = , 528.700 but when src_count was included inside the model and this value has been reduce to 133.213. This reduction means that the feature has a signiicant inluence at predicting the outcome attack. Table 5 : Model Summary -2 Log likelihood Cox Snell R Square Nagelkerke R Square 133.213 .298 .791 Table 5 also shows the Nigelkerke’s value for the new model which is 0.791. The Nigelkerke’s value is very close to one which means that the feature selected in this research gives good inluence to the model in predicting the outcome. Table 6: Model Coeficient Chi-square df Sig. 395.487 1 .000 For srv_count feature, Chi-square test can also be used to verify whether the feature gives a signiicant contribution to the model or not. This can be done by generating hypothesis which are Ho, feature does not effect the model prediction and H1, feature effect the model prediction. Table 6 shows that the ISSN: 1985-3157 Vol. 2 No. 2 July-December 2008 Journal of Advanced Manufacturing Technology 52 chi-square value is 395.487 and the value is signiicant at a 0.05 and 0.01 level. Therefore the H1 hypothesis has been accepted. As a conclusion, the srv_count gives an effect to the model in predicting the outcome.

6.0 Result