Table 4 shows the number of examples in 10% training and testing data of KDD99 dataset. 

| Attack Types      | Training Examples   | Testing Examples   |
|-------------------|---------------------|--------------------|
| Normal            | 97277               | 60592              |
| Denial of Service | 391458              | 237594             |
| Remote to User    | 1126                | 8606               |
| User to Root      | 52                  | 70                 |
| Probing           | 4107                | 4166               |
| Total Examples    | 494020              | 311028             |

Table 4. Number of training and testing examples in KDD99 Dataset. 

## 5.2. Experimental Analysis

In order to evaluate the performance of proposed algorithm for network intrusion detection, we performed 5-class classification using KDD99 intrusion detection benchmark dataset. All experiments were performed using an Intel Core 2 Duo Processor 2.0 GHz processor (2 MB 
Cache, 800 MHz FSB) with 1 GB of RAM. The results of the comparison of proposed algorithm with ID3 and with naive Bayesian classifier are in Table 5 and Table 6. 

Method Normal Probe DOS U2R R2L 

Proposed Algorithm (DR %) 99.72 99.25 99.75 99.20 **99.26**

Proposed Algorithm (FP %) **0.06 0.39 0.04 0.11 6.81** 

Naïve Bayesian (DR %) 99.27 99.11 99.69 64.00 99.11

Naïve Bayesian (FP %) 0.08 0.45 0.04 0.14 **8.02**

ID3 (DR %) 99.63 97.85 99.51 49.21 92.75 

ID3 (FP %) 0.10 0.55 0.04 0.14 **10.03**

Table 5. Comparison of the results using 41 attributes. 

Method Normal Probe DOS U2R R2L

Proposed Algorithm (DR %) **99.84 99.75 99.76 99.47 99.35** 

Proposed Algorithm (FP %) 0.05 0.28 0.03 0.10 **6.22**

Naïve Bayesian (DR %) 99.65 99.35 99.71 64.84 99.15

Naïve Bayesian (FP %) 0.05 0.32 0.04 0.12 6.87 

ID3 (DR %) 99.71 98.22 99.63 86.11 97.79 

ID3 (FP %) 0.06 0.51 0.04 0.12 7.34 

Table 6. Comparison of the results using 19 attributes. 

We tested the performance of proposed algorithm using the reduced dataset of 12 attributes and 17 attributes in KDD99 dataset, which increase the detection rate for intrusion classes that are summarized in Table 7. 

Table 7. Performance of proposed algorithm using reduced dataset. 

| Class Value   | 12 Attributes   | 17 Attributes   |
|---------------|-----------------|-----------------|
| Normal        | 99.98           | 99.95           |
| Probe         | 99.92           | 99.93           |
| DoS           | 99.99           | 99.97           |
| U2R           | 99,38           | 99.46           |
| R2L           | 99.55           | 99.69           |
