Martin Andreoni Lopez
email: martin@gta.ufrj.br

Diogo M F Mattos

Otto Carlos

M B Duarte

Guy Pujolle
email: guy.pujolle@lip6.fr

A Fast Unsupervised Preprocessing Method for Network Monitoring

Identifying a network misuse takes days or even weeks, and network administrators usually neglect zero-day threats until a large number of malicious users exploit them. Besides, security applications, such as anomaly detection and attack mitigation systems, must apply real-time monitoring to reduce the impacts of security incidents. Thus, information processing time should be as small as possible to enable an effective defense against attacks. In this paper, we present a fast preprocessing method for network traffic classification based on feature correlation and feature normalization. Our proposed method couples a normalization and a feature selection algorithms. We evaluate the proposed algorithms against three different datasets for eight different machine learning classification algorithms. Our proposed normalization algorithm reduces the classification error rate when compared with traditional methods. Our Feature Selection algorithm chooses an optimized subset of features improving accuracy by more than 11% within a 100-fold reduction in processing time when compared to traditional feature selection and feature reduction algorithms. The preprocessing method is performed in batch and streaming data, being able to detect concept-drift.

I. INTRODUCTION

Maintaining the stability, reliability, and security of computer networks implies understanding type, volume and intrinsic features of flows comprising carried traffic. Efficient network monitoring allows the administrator to achieve a better understanding of the network [START_REF] Hu | Dynamic defense strategy against advanced persistent threat with insiders[END_REF]. Nevertheless, the process of network monitoring varies in complexity levels, from a simple collection of link utilization statistics, up to complex upperlayer protocol analysis to achieve network intrusion detection, network performance tuning and protocol debugging. Current network analyzing tools, such as tcpdump, NetFlow, SNMP, Bro IDS [START_REF] Paxson | Bro: a System for Detecting Network Intruders in Real-Time[END_REF], Snort [START_REF] Roesch | Snort-Lightweight Intrusion Detection for Networks[END_REF], among others, are mainly executed in one server, and the systems are not able to cope with evergrowing traffic throughput [START_REF] Vallentin | The NIDS Cluster: Scalable, Stateful Network Intrusion Detection on Commodity Hardware[END_REF]. Bro IDS, for example, evolved to be used in a cluster to reach up to 10 Gb/s. Another example is the Suricata IDS, which was proposed as an improvement of the Snort IDS, using Graphical Processing Units (GPUs) to parallelize packet inspection.

In traffic analyzing and network monitoring applications, data arrives in real time from different heterogeneous sources [START_REF] Bar | Largescale network traffic monitoring with DBStream, a system for rolling big data analysis[END_REF], such as packets captured over the network, or multiple kinds of logging from systems and applications. An infinite sequence of events characterizes real-time stream applications, representing a continuously arriving sequence of tuples [START_REF] Stonebraker | The 8 requirements of real-time stream processing[END_REF]. This kind of applications generates a significant volume of data. Even moderate speed networks generate huge amounts of data, for instance, monitoring a single gigabit Ethernet link, running at 50% of utilization, generates a terabyte of data in a couple of hours.

One way to attain data processing optimization is to employ Machine Learning (ML) methods. ML methods are well suited for big data since with more samples to train methods tend to have higher effectiveness [START_REF] Mayhew | Use of machine learning in big data analytics for insider threat detection[END_REF]. Nevertheless, with high dimensional data machine learning methods tend to perform with high latency, due to computational resources consumption. For example, the K-Nearest Neighbours (K-NN) algorithm uses Euclidean distance to calculate the similarity between points. Nonetheless, Euclidean distance is unrepresentative in high dimensions. Thus, it is necessary to apply other similarity metrics, such as cosine distance, which have a higher computational cost, introducing more latency to the preprocessing. The high latency is a drawback for machine learning methods, as they must analyze data as fast as possible to reach near realtime responses. Feature Selection is a process to overcome the drawback, reducing the number of dimensions or features to a smaller subset than the set of original ones [START_REF] Mladenić | Feature Selection for Dimensionality Reduction[END_REF]. Whereas traditional Machine learning methods, also known as batch processing, deal with non-continuous data, in-stream processing Machine Learning methods, data continuously arrive, one sample at a time. Stream processing methods must process data under strict constraints of time and resources [START_REF] Bifet | Big data stream learning with samoa[END_REF]. When data continuously arrive, changes in the distribution of the data as well as the relationship between input and output variables are observed over the time. This behavior, known as conceptdrift [START_REF] Khamassi | Discussion and review on evolving data streams and concept drift adapting[END_REF], deteriorates the accuracy and the performance of machine learning models. As a consequence, in case of occurrence of concept-drift, we must train a new model must.

Streaming data arrives continuously form different heterogeneous source and frequently contain duplicated or missing information producing incorrect or misleading statistics [START_REF] Rahm | Data cleaning: Problems and current approaches[END_REF]. Data preprocessing deals with detecting and removing errors and inconsistencies from data to improve the quality of data. The purpose of data preprocessing is to prepare the data set that will be used to fit the model. In general, the preprocessing step consumes 60% to 80% of the time of the entire machine learning process and provides essential information that will guide the analysis and adjustment of the models [START_REF] García | Data preprocessing in data mining[END_REF].

The number of input variables is often reduced before apply machine learning methods to minimize the use of computational resource and to improve Machine learning metrics. The variable reduction can be made in two different ways, by feature selection or by dimensionality reduction. On the one hand, feature selection only keeps the most relevant variables from the original dataset, creating a new subset of features from the originals. On the other hand, dimensionality reduction exploits the redundancy of the input data by finding a smaller set of new synthetic variables, each being a linear, or nonlinear combination of the input variables.

In this paper, we present a preprocessing data method for network traffic monitoring. First, we propose a fast and efficient feature-selection algorithm. Our algorithm performs feature selection in an unsupervised manner, i.e., with no a priori knowledge of the output classes of each flow. We compare the presented algorithm with three traditional methods: Reli-efF [START_REF] Robnik-Šikonja | Theoretical and Empirical Analysis of ReliefF and RReliefF[END_REF], Sequential Feature Selection (SFS), and the Principal Component Analysis (PCA) [START_REF] Schölkopf | Kernel principal component analysis[END_REF]. Our algorithm shows better accuracy fulfillment with the used Machine Learning methods, as well as a reduction in the total processing time. Second, we propose a normalization algorithm for streaming data, which can detect and to adapt to concept-drift.

The remainder of the paper is organized as follows. In Section II, we introduce the concept of data preprocessing. We present our preprocessing method in Section III. In Section IV, we validate our proposal and show the results. Section V presents the related work. Finally, Section VI concludes the work.

II. DATA PREPROCESSING

Data preprocessing is the most time-consuming task in machine learning [START_REF] García | Tutorial on practical tips of the most influential data preprocessing algorithms in data mining[END_REF]. As shown in Figure 1 Data preprocessing is composed of four main steps [START_REF] Zhang | Data preparation for data mining[END_REF]. The first step, Data Consolidation, several sources generate data; the system collects the data, and specialists interpret the data for better understanding. The second step, Data Cleaning, the system analyzes all samples and verifies if there are values that are empty or missing and is an anomaly in the dataset, also this step check if there are some inconsistencies. In the third step, Data Transformation, different functions are applied to data to improve the machine learning process. Data Normalization, this step converts variables from categorical into numerical values. In the last step, Data Reduction, techniques such as feature selection are applied to reduce data to improve and fast machine learning process. As the entire process finishes, data is ready for input in any Machine Learning algorithm. In this work, we focus on the last two steps Data Transformation and Data Reduction which are the most time-consuming steps.

Furthermore, all Feature Selection algorithms assume that data arrive preprocessed. Normalization, also known as feature scaling, is an essential method for proper use of classification algorithms because normalization bounds the domain of each feature to a known interval. If the dataset features have different scales, they may impact in different ways on the performance of the classification algorithm. Ensuring normalized feature values, usually in [-1, 1]; implicitly weights all features equally in their representation. Classifier algorithms that calculate the distance between two points, e.g., K-NN and K-Means, suffer from the weighted feature effect [START_REF] Tan | Neighbor-weighted k-nearest neighbor for unbalanced text corpus[END_REF]. If one of the features has a broader range of values, this feature will profoundly influence the distance calculation. Therefore, the range of all features should be normalized, and each feature contributes approximately proportionately to the final distance.

Besides, many preprocessing algorithms consider that data is statically available before the beginning of the learning process [START_REF] Ramírez-Gallego | A survey on data preprocessing for data stream mining: Current status and future directions[END_REF]. Although dealing with high dimensional data is computationally possible, the more the number of dimensions increases, the more the computational costs are challenging, and the more machine learning techniques are ineffective. Most machine learning techniques are ineffective in handling high dimensional data because they incur in overfitting while classifying data. As a consequence, if the number of input variables1 is reduced before running a machine learning algorithm, the algorithm can achieve better accuracy. We achieve the desired variable number reduction in two different ways, dimensionality reduction, and feature selection. Dimensionality reduction exploits the redundancy of the input data by computing a smaller set of new synthetic features, each being a linear or non-linear combination of the data features. Hence, in this case, the set of input variables is a subset of synthetic features that better describe the data than the original set of features. On the other hand, feature selection only keeps the most relevant variables from the original dataset, creating a new subset of features from the original one. Thus, the set of variables is a subset of the set of features.

Dimensionality reduction is the process of deriving a set of degrees of freedom to reproduce most of a data set variability [START_REF] Van Der Maaten | Dimensionality reduction: a comparative[END_REF]. Ideally, the reduced representation should have a dimensionality that corresponds to the data intrinsic dimensionality. The data intrinsic dimensionality is the minimum number of parameters to account for the observed properties of the data. Mathematically, in dimensionality reduction, given the p-dimensional random variable x = (x 1 , x 2 , . . . , x p ), we calculate a lower dimensional representation of it, s = (s 1 , s 2 , . . . , s k ) with k ≤ p.

Algorithms with different approaches have been developed to reduce dimensionality, classified into two linear, or nonlinear. The linear reduction of dimensionality is a linear projection, in which the p-dimensional data are reduced in k-dimensional data using k linear combinations of p original features. Two important examples of linear dimension reduction algorithms are principal component analysis (PCA) and independent component analysis (ICA). The goal of the PCA is to find an orthogonal linear transformation that maximizes the feature variance. The first PCA base vector, the main direction, best describes the variability of the data. The second vector is the second-best description and must be orthogonal to the first and so on in order of importance. On the other hand, the goal of ICA is to find a linear transformation, in which the base vectors are statistically independent and not Gaussian, i.e., the mutual information between two features in the new vector space is equal to zero. Unlike PCA, the base vectors in ICA are neither orthogonal nor ranked in order. All vectors are equally important. PCA is usually applied to reduce the representation of the data. On the other hand, the ICA is usually used to obtain feature extraction, identifying and selecting the features that best suit the application.

Dimensionality reduction techniques lack expressiveness since the generated features are combinations of other original features. Hence, the meaning of the new synthetic feature is lost. When there is a need for an interpretation of the model, for example, when creating rules in a firewall, it is necessary to use other methods. The feature selection produces a subset of the original features, which are the best representatives of the data. Thus, there is no loss of meaning. There are three types of feature selection techniques [START_REF] Mladenić | Feature Selection for Dimensionality Reduction[END_REF], wrapper, filtering and embedded.

Wrapper methods, also called closed loop, uses different classifiers, such as Support Vector Machine (SVM), Decision tree, among others, to measure the quality of a feature subset without incorporating knowledge about the specific structure of the classification function. Thus, the method will evaluate subsets based on the accuracy of the classifier. These methods consider the feature selection as a search problem, creating a NP-hard problem. An exhaustive search in the full dataset must be done to evaluate the relevance of the feature. Wrapper methods tend to be more accurate than the filtering methods, but they present a higher computational cost [START_REF] Ang | Supervised, Unsupervised, and Semi-Supervised Feature Selection: A Review on Gene Selection[END_REF]. One popular Wrapper Method is the Sequential Forward Selection (SFS) for its simplicity. The algorithm begins with an empty set S and the full set of all features X. The SFS algorithm does a bottom-up search and gradually adds features, selected by an evaluation function, to S, minimizing the mean square error (MSE). Each iteration, the algorithm selects the feature to be included in S from the remaining available features of X. The main disadvantage of SFS is adding a feature to the set S prevents the method to remove the feature if it has the smallest error after adding others.

Filtering methods are computationally lighter than wrapper methods and avoid overfitting. Filtering methods also called open-loop methods, use heuristics to evaluate the relevance of the feature in the dataset [START_REF] Chandrashekar | A survey on feature selection methods[END_REF]. As its name implies, the algorithm filters feature that does fill the heuristic criterion. One of the most popular filtering algorithms is the Relief. The Relief algorithm associates each feature with a score, which is calculated as the difference between the distance from the nearest example of the same class and the nearest example of the other class. The main drawback of this method is the obligation of labeling data records in advance. Relief is limited to problems with just two classes, but ReliefF [START_REF] Robnik-Šikonja | Theoretical and Empirical Analysis of ReliefF and RReliefF[END_REF] is an improvement of the Relief method that deals with multiples classes using the technique of the k-nearest neighbors. Embedded methods have a behavior similar to wrapper methods, using a classifier accuracy to evaluate the feature relevance. However, embedded methods make the feature selection during the learning process and use its properties to guide feature evaluation. Therefore, this modification reduces the computational time of wrapper methods. Support Vector Machine Recursive Feature Elimination (SVM-RFE) firstly appears in gene selection for cancer classification [START_REF] Guyon | Gene selection for cancer classification using support vector machines[END_REF]. The algorithm ranks features according to a classification problem based on the training of a Support Vector Machine (SVM) with a linear kernel. The feature with the smallest ranking is removed, according to a criterion w, in sequential backward elimination manner. The criterion w is the value of the decision hyperplane on the SVM.

All the previous feature selection algorithms are supervised methods, in which the label of the class is presented before the preprocessing step. In applications such as network monitoring and threat detection, network streams reach classifiers without a known label. Therefore, unsupervised algorithms must be applied.

III. THE PROPOSED PREPROCESSING METHOD

Our preprocessing method comprises two algorithms. First, a normalization algorithm enforces data to a normal distribution re-scaling the values in a range between -1 and 1 interval. Indeed, the largest value for each attribute is 1 and the smallest value is -1. Normalization and standardization methods such as Max-Min or Z-score output values in a known range, usually [-1, 1] or [0, 1]. Our normalization method is parametricless. Then, we propose a feature selection algorithm based on the correlation between pairwise features. The Correlation Features Selection (CFS) [START_REF] Hall | Correlation-based Feature Selection for Machine Learning[END_REF] inspires the proposed algorithm. CFS scores the features through the correlation between the feature and the target class. The CFS algorithm calculates the correlation between pairwise features and the target class to get the importance of each feature. Thus, the CFS depends on target class information a priori, so it is a supervised algorithm. The proposed algorithm performs an unsupervised feature selection. The correlation and variance between the features measure the amount of information that each feature represents compared to others. Thus, the presented algorithm demands less computational time independently of class labeling a priori.

A. The proposed Normalization Algorithm

Normalization should be applied when the data distribution is unknown. Determine the distribution of streaming data is computationally expensive [START_REF] Kumar | Data streaming algorithms for efficient and accurate estimation of flow size distribution[END_REF]. In our normalization algorithm 1, a histogram of a feature f i is represented as a vector b 1 , b 2 , . . . , b n , such that b k represents the number of samples that falls in the bin k.

In practice, it is not possible to know in advance the min and max for any feature. As a consequence, we use a sliding window approach, where the dataset X are the s last seen samples. For every sliding window, we obtain the min and max values for each feature. Then, data values join in a set b of intervals called bins. The idea is to divide the feature f i Each bin consists of thresholds k, for example the feature

f i is grouped in b 1 = [min i , k 1 ), b 2 = [k 1 , k 2 ), . . . , b m = [k m -1, max i ].
The step between threshold k is called pivot and it is determined as (max i -min i )/m, as it is shown in Algorithm 2. If the min or max values of the previous sliding window are smaller or bigger than min or max of the current window, that is, min i-1 < min i or max i-1 > max i , new bins are created until the new values of min or max are reached. With the creation of new bins, the proposal is able to detect changes in the concept-drift. The rate between the number of observed samples in a bin and the total number of samples in the entire histogram produces the frequency of each bin. Comparing the sample x i against the thresholds k of the bins, line 4 Algorithm 3, we define in which bin we have to increment the number of observed samples. If the value of the sample x i is in-between the thresholds of the bin j , then the hit number of observed samples f q j of the bin j is increased by one. Moreover, we calculate the relative frequency of each bin as the relation between the bin hit number and the total number of samples, f r j = f q j /N . Finally, the relative frequency values f r are mapped into a normal distribution by: (

) 1
with Equation 1 is it possible to see that all values are now mapped into a normal probability distribution with µ = 0 and σ = 1, line 8 in algorithm 3. As a consequence, all samples are normalized between -1 ≤ x i ≤ 1. If we consider the process that generates the stream is nonstationary, it implies a possible concept-drift. Haim and Tov affirm that histogram must be dynamic when dealing with streaming data [START_REF] Ben-Haim | A streaming parallel decision tree algorithm[END_REF]. As a consequence, intervals do not have a fixed value, and the bins adapt to concept-drift. However, if the bins remain static, it reflects the evolution of the change during time [START_REF] Webb | Contrary to popular belief incremental discretization can be sound, computationally efficient and extremely useful for streaming data[END_REF]. In our application, feature normalization for network monitoring, we follow the former approach. Maintaining fixed intervals allow us to see how a feature evolves. Also, as our histogram algorithm creates new bins when a value does not enter in any of the current intervals, it enables to detect outliers dynamically. In streaming data, it is not possible to maintain all the samples x i , because it is computationally inefficient and, in case of unlimited data, it does not fit in memory. Our algorithm only efficiently keeps the frequency of each bin.

The most complicated function in the normalization process is to update the bins. If the max and min reference values of the window change, the bins update functions takes the complexity O(n) on time. The creation of the histogram is only done in the first window and takes constant time. The histogram update uses a binary search to fill the bin value in O(log n) time.

B. The proposed Correlation-Based Feature Selection

We propose the Correlation-Based Feature Selection, a simple unsupervised filter method for feature selection. Our method uses the correlation between features. The Pearson correlation of two variables is a measure of their linear dependence. The key idea of the method is to weight each feature based on the correlation of the feature against all other features that describe the dataset. We adopt the Pearson's coefficient as the correlation metric. Pearson's coefficient value is between -1 ≤ ρ ≤ 1, where 1 means that the two variables are directly correlated, linear relationship, and -1 in the case of an inverse linear relationship, also called anticorrelation.

The Pearson Coefficient ρ, can be calculated in terms of mean µ and standard deviation σ,

ρ(A, B) = 1 N -1 N i=1 A i -µ A σ A B i -µ B σ B , (2)
or in terms the of covariance

ρ(A, B) = cov(A, B) σ A σ B , (3)
then we calculate the weight vector,

w i = σ 2 i j=N j=0 |ρ ij | . ( 4
)
Firstly, we need to obtain the correlation matrix, calculated by Equation 3, line 1 algorithm 4. The correlation matrix is the pairwise covariance calculations between features. Then, applying the Equation 4, we establish a weight w that is a measure of the importance of the feature. To calculate w, we sum the absolute values of the correlation features, lines 5-6 algorithm 4. This absolute value sum is due to Pearson's coefficient, ρ may assume negative values. Then we calculate the variance V of each feature that privileges the feature that has greater variance and lower covariance, line 8 algorithm 4. The idea is to establish which feature represent the most information, giving the correlation between two features. Furthermore, the weights give us an indication of the amount of information the feature has independently from the others. The weight w has values between 0 ≤ N , where N is the number of features and 0 means that the features are independent of the other. The higher the w value is, the higher is the variance of the feature and lesser correlation with other features. Thus, more information is the aggregated by this feature.

Algorithm 4: Correlation Based Feature Selection Input : X: Matrix of Features and Data Output: r: Vector of Ranked Features, w: Vector of weights

1 ρ = Corr(X) / * Correlation Matrix * / 2 for 0 ≤ i < len (ρ) do 3 W i = 0 4 for 0 ≤ j < len (ρ i ) do 5 k i = abs(ρ ij ) / *

IV. EVALUATION

To evaluate the proposed algorithm, we perform traffic classification to detect threats. We chose the traffic classification application because it is time sensitive and our algorithm can significantly reduce the processing time, enabling prompt defense mechanisms. We implemented traffic classification using machine learning algorithms against three different datasets. The NSL-KDD is a modification of the original KDD-99 dataset and has the same 41 features and the same five classes, Denial of Service (DoS), Probe, Root2Local (R2L), User2Root (U2R) and normal, as the KDD 99 [START_REF] Tavallaee | A detailed analysis of the kdd cup 99 data set[END_REF]. The improvements of the NSL-KDD over KDD 99 are the elimination of redundant and duplicate samples, to avoid a biased classification and overfitting, and a better cross-class balancing to avoid random selection. GTA/UFRJ dataset2 [START_REF] Lobato | An adaptive Real-Time architecture for Zero-Day threat detection[END_REF] combines real network traffic captured from a laboratory and network threats produced in a controlled environment. Network traffic is abstracted in 26 features and contains three classes, DoS, probe and normal traffic. The NetOp 2 is a real data set from a Brazilian operator [START_REF] Lopez | Collecting and characterizing a real broadband access network traffic dataset[END_REF]. The dataset has anonymous access traffic of 373 broadband users of the South Zone of the city of Rio de Janeiro. We collected data during 1 week of uninterrupted data collection, from February 24 to March 4, 2017. We summarized packets in a dataset of 46 flow features, associated with an IDS alarm class or the legitimate traffic class. All datasets are summarized in Table I.

We count on Intel Xeon processors with a clock frequency of 2.6 GHz and 256 GB of RAM for conducting the measurements. In the first experiment, we use one day from NetOp dataset to evaluate our normalization method. Shapiro-Wilk test was used to verify that our proposal enforces a normal distribution for the normalized features. Table II shows Shapiro-Wilk test, we considered α = 0.05. We evaluate the hypothesis that our proposal normalization method follows a normal distribution. According to the results, the proposed method has a p-value of 0.24 > 0.05, and W is closer to one, W = 0.93, then we assume that samples are not significantly different from a normal population. In the case of Max-Min normalization [START_REF] Hu | Smart preprocessing improves data stream mining[END_REF], p-value is very smaller than the α, and W indicates that it is far from 1. As a consequence, we refuse the hypothesis assuming than sampling data are significantly different from a normal population. Figure 3 shows a graphical interpretation of the Shapiro-Wilk test, it represents a sample after being normalized. As our proposal follows the normal distribution, the blue points follow the dashed line, while the max-min approach follows a right-skewed distribution. In the following experiments, we verify our preprocessing method in a use case of traffic classification. Thus, we implement the Decision Tree (DT), with the C4.5 algorithm, Artificial Neural Networks (ANN), and Support Vector Machine (SVM) as classification algorithms to evaluate the proposed feature selection algorithm. We selected these algorithms because they are the most used ones for network security [START_REF] Buczak | A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection[END_REF]. In all methods, we perform the training in a 70% partition of the dataset and the test run over the remaining 30%. During the training phase, we perform tenfold cross-validation to avoid overfitting. In cross-validation, parts of the dataset are divided and not used in model parameters estimation. They are further used to check whether the model is general enough to adapt to new data, avoiding overfitting to training data.

The Decision Tree Algorithm: In a decision tree, leaves represent the final class and branches represent conditions based on the value of one of the input variables. During the training part, the C4.5 algorithm determines a tree-like classification structure. The real-time implementation of the decision tree consists of if-then-else rules that generate the tree-like structure previously calculated. The results are presented in the Section IV-A, along with the ones from the other algorithms.

The Artificial Neural Network Algorithm: The artificial neural networks are inspired on the human brain, in which each neuron performs a small part of the processing and transfers the result to the next neuron. In artificial neural networks, the output represents a degree of membership for each class, and the highest degree is selected. The weight vectors Θ are calculated during the training. These vectors determine the weight of each neuron connection. In training, there are input and output sample spaces and the errors, caused by each parameter. The back-propagation algorithm minimizes the errors.

In order to determine to which class a sample belongs each neural network layer computes the following equations:

z (i+1) = Θ (i) a (i) (5)
a (i+1) = g(z (i+1) ) (6)
g(z) = 1 1 + e -z (7) where a is the vector that determines the output of layer i, Θ (i) is the weight vector that leads layer i to layer i + 1, and a (i+1) is the output of layer i + 1. The function g(z) is the activation function, represented by Sigmoid function, which plays an important role in the classification. For high values of z, g(z) returns one and for low values g(z) returns zero. Therefore, the output layer gives the degree of membership in each class, between zero and one, classifying the sample as the highest one. The activation function enables and disables the contribution of a certain neuron to the final result.

The Support Vector Machine Algorithm: The Support Vector Machine (SVM) is a binary classifier, based on the concept of a decision plane that defines the decision thresholds. SVM algorithm classifies through the construction of a hyperplane in a multidimensional space that split different classes. An iterative algorithm minimizes an error function, finding the best hyperplane separation. A kernel function defines this hyperplane. In this way, SVM finds the hyperplane with a maximum margin, that is, the hyperplane with the most significant distance possible between both classes.

The real-time detection is performed by the classification to each class pairs: normal and non-normal; DoS and non-DoS; and probe and non-probe. Once SVM calculates the output, the chosen class is the one with the highest score. The classifier score of a sample x is the distance from x to the decision boundaries, that goes from -∞ to +∞. The classifier score is given by:

f (x) = n j=1 α j y j G(x j , x) + b, (8)
where (α 1 , . . . , α n .b) are the estimated parameters of SVM, and G(x j , x) is the used kernel. In this work, the kernel is linear, that is, G(x j , x) = x j x, which presents a good performance with the minimum quantity of input parameters.

A. Classification Results

This experiment shows the efficiency of our feature selection algorithm when compared to literature methods. We try a linear Principal Component Analysis (PCA), The ReliefF algorithm, the Sequential Forward Selection (SFS), and the Support Vector Machine Recursive Feature Elimination (SVM-RFE). For all methods, we analyze their version with four and six output features in the GTA/UFRJ dataset. For the sake of fairness, we tested all the algorithms with the classification methods presented before. We use a decision tree with the with a minimum of 4096 leaves, a binary support vector machine (SVM) with linear kernel, and finally a neural network with one hidden layer with 10 neurons. We use ten-fold crossvalidation for our experiments.

Figure 4 presents information gain (IG) sum of the selected feature for each evaluated algorithm. Information gain measures the amount of information, in bits, that a feature adds compared to the class prediction. Thus, information gain calculation computes the difference of target class entropy and the conditional entropy of the target class given the feature value as known. When employing six features, the results show our algorithm has information retention capability between SFS and ReliefF, and higher than SVM-RFE. The information retention capability of PCA, is higher than feature selection methods, as each feature is a linear combination of the original features and is computed to retain most of the dataset variance.

Figure 5 shows the accuracy of the three classification methods, Decision Tree, Neural Network and Support Vector Machine (SVM), when different dimensionality reduction methods choose the input variables. In the first group, our proposal with six features reaches 97.4% accuracy, which is the best results for the decision tree classifier. The following result is PCA with four and six features in 96% and 97.2%. The Sequential Forward Selection (SFS) presents the same result with four and six features with 95.5%. The ReliefF algorithm has the same results in both four and six features is 91.2%. Finally, the lowest result is shown by the SVM-RFE algorithm with four and six features. As the decision tree algorithm creates the decision nodes based on the variables with higher entropy, the proposed feature selection algorithm better performs because it keeps most of the variance of the dataset.

The second classifier, the neural network, the best result is shown by the PCA with six features in 97.6% of accuracy. However, the PCA with four features presents a lower performance with 85.5%. ReliefF presents the same results for both features in 90.2%. Our proposal shows a result with 83.9% and 85.0% for four and six features. On the other hand, the SFS presents the worst results of all classifiers, 78.4% with four features and 79.2% with six features. One impressive result is the SVM-RFE, with four features presents a deficient result of 73.6% that is one of the worst for all classifiers, however, with six features present almost the same best second result with 90.1%.

In the Support Vector Machine (SVM) classifier, the PCA presents a similar behavior compared with the neural networks. For six features presents the highest accuracy of all classifiers with 98.3%, but just 87.8% for four features. ReliefF again presents the same result for both cases in 91.4%. Our proposal has 84% for four features and 85% for six features. SFS present the same result for both features in 79.5%. The lowest accuracy of this classifier is the SVM-RFE with 73.6% for both cases. As our proposal maximizes the variance on the resulting features, the resulting reduced dataset spreads into the new space. For a linear classifier, such as SVM, it is hard to define a classification surface for a spread data. Thus, the resulting accuracy is not among the highest. However, as the selected set of features still being significant for defining the data, the resulting accuracy is not the worst one.

The Sensitivity metric shows the rate of correctly classified samples. It is a good a metric to evaluate the success of a classifier when using a dataset in which a class has much more samples than others. In our problem, we use sensitivity as a metric to evaluate our detection success. For this, we consider the detection problem as a binary classification, i.e., we consider two classes: normal and abnormal traffic. In this way, the Denial of Service (DoS) and Port Scanning threat classes compose a common attack class. Similar to Accuracy representation in Figure 5, Figure 6 represents the sensitivity of the classifiers applying the different methods of feature selection. In the first group, the classification with Decision Three, PCA shows the best sensitivity with 99% of correct classification, our algorithm achieves a performance of almost 95% of sensitivity, with four and six features. Neural Networks, represented in the second group, has the best We highlight that our algorithm performs nearly equal to PCA. PCA creates artificial features that are a composition of all real features, while our algorithm selects some features from the complete set of features. In this way, our algorithm was the best feature-selection method among the evaluated ones, and it also introduces less computing overload when compared with PCA.

When analyzed the features each method chooses, it is possible to see none of the methods selects the set of same features. Nevertheless, ReliefF and SFS select as the secondbest amount of IP packets. One surprising result from the SFS is the election of Amount of ECE Flags and Amount of CWR Flags. In a correlation test, these two features show that there is no information inclusion because they are empty variables. However, we realized that one of the main features is Average Packet Size. In this dataset, the average packet size is fundamental to classify attacks. One possible reason is that, during the creation of the dataset, an automated tool performed the Denial of Services (DoS) and Probe attacks. Mainly this automated tool produces attacks without altering the length of the packet.

Figure 7 shows a comparison of the processing time of all implemented feature selection and dimensionality reduction methods. All measures are in relative value. We can see that SFS presents the worst performance. The SFS algorithm performs multiple iterations to minimize the mean square error (MSE). Consequently, all these iterations increase the processing time. Our proposal shows the best processing time together with PCA because both implementations perform matrix multiplication. Matrix multiplication is a simple computation function.

The next experiment is to evaluate our proposal in different datasets. We use the NSL-KDD dataset and the NetOp dataset. Besides linear SVM, Neural Network and Decision Tree, we also evaluate K-Nearest Neighbors (K-NN), Random Forest, two kernels, linear and Radial Basis Function (RBF) kernel in Support Vector Machine (SVM), Gaussian Naive Bayes, and Stochastic Gradient Descendant. Adding these algorithms, we cover the full range of the most important algorithms for supervised machine learning.

The Random Forests (RF) algorithm avoids overfitting when compared to the simple decision tree because it constructs several decision trees, trained in different parts of the same dataset. This procedure decreases the variance of classification and improves the performance regarding the classification of a single tree. The prediction of the class in the RF classifier consists of applying the sample as input to all the trees, obtaining the classification of each one of them and, then, a voting system decides the resulting class. The construction of each tree must follow the rules: (i) for each node d, select k input variables of total m input variables, such that k m; to calculate the best binary division of the k input variables for the node d, using an objective function; repeat the previous steps until each tree reaches l number of nodes or until its maximum extension.

The simple Bayesian classifier (Naive Bayes -NB) takes the strong premise of independence between the input variables to simplify the classification prediction, that is, given the value of each input variable, it does not influence the value of the others input variables. From this, the method calculates the probabilities a priori of each input variable, or a set of them, to set up a given class. As a new sample arrives, the algorithm calculates for each input variables the probability of being a sample of each class. The output of all probabilities of each input variable results in a posterior probability of this sample belonging to each class. The algorithm, then, returns the classification that contains the highest estimated probability.

In the K-Nearest Neighbors (K-NN) the class definition The neighborhood definition uses a measure of similarity between samples in the feature space. Threat detection literature often use Euclidean distance, although other distances have good results and the best choice for a similarity measure will depend on the type of the used dataset [START_REF] Prasath | Distance and Similarity Measures Effect on the Performance of K-Nearest Neighbor Classifier -{A} Review[END_REF]. The Euclidean distance of two samples p and q in the space of n features is given by

d(p, q) = n i (p i -q i ) 2 . ( 9
)
Stochastic Gradient Descent with Momentum: This scheme relies on the Stochastic Gradient Descent (SGD) [START_REF] Zhang | Solving large scale linear prediction problems using stochastic gradient descent algorithms[END_REF] algorithm, is a stochastic approximation of Gradient Descent, in which a single sample approximates the gradient. In our application, we consider two classes, normal and threat. Therefore, we use the Sigmoid Function, expressed by

h θ (x) = 1 1 + e -θ x , (10)
to perform logistic regression. In the Sigmoid function, low values of the parameters θ times the sample feature vector x return zero, whereas high values return one. When a new sample x (i) arrives, the SGD evaluates the Sigmoid function and returns one for h θ (x (i) ) greater than 0.5 and zero otherwise. This decision presents an associated cost, based on the real class of the sample y (i) . The cost function is defined in Equation 11. This function is convex, and the goal of SGD algorithm is to find its minimum, expressed by

J (i) (θ) = y (i) log(h θ (x (i) ))+(1-y (i) )log(1-h θ (x (i) )). (11)
On each new sample, the algorithm takes a step toward the cost function minimum based on the gradient of the cost function.

Validation in NSL-KDD and NetOp Datasets: The first experiment evaluates the performance of the feature selection in both datasets. In this experiment, we vary the number of selected features to evaluate the impact on the accuracy. We analyze the performance with no feature selection (No FS), and then we reduce features from 10% to 90% of the original set of features. All the experiments were performed using a K-fold cross-validation. The K-fold cross-validation performs K training iterations in the partitions of the data and, at each iteration, in the remaining K -1 partition, the Kfold cross-validation performs the test in a mutually exclusive manner. We use K = 10, which is the commonly used value. Figure 8 shows the effect of feature selection. No Feature Selection performs well for almost all algorithms. Reducing the number of features in 10%, however, improve accuracy in all algorithms, except for Random Forest. In contrast, a bigger reduction of feature deteriorates the accuracy for all classifiers. We also measure others metrics, such as Precision, Sensitivity, F1-Score, training and classification time. We compare the effect of 10% reduction in all these metrics. Figure 910 show accuracy, precision, sensitivity and F1 -score for dataset with no feature selection Figure 9 and with 10% of reduction Figure 10. For K-NN, SVM with Radial Basis Function (RBF) kernel, and Gaussian Naive Bayes metrics remain the same. For the Neural Network, MLP and SVM with a linear kernel, an improvement between 2-3% in all metrics is reached with 10% of features reduction. Random Forest present the worst performance when features are reduced; all metrics worsen their values between 8-9%. Stochastic Gradient Descendant (SGD) also suffer a small reduction of 1% in their metrics. The decision tree is the most benefited improving between 3-4% their metrics, which shows the capability of reducing overfitting when applying feature selection. Figure 11 shows training and classification time with no features selection, while Figure 12 shows results with 10% of reduced features. The K-NN algorithm training time augmented considerably, passing from 0.63 seconds to 5.03, while classification time also suffers an increase passing from We performed the same experiment in the NetOp Dataset. Figure 13 shows the accuracy of different classifiers while reducing from 10% to 90% of the features. Using the NetOp dataset, applying feature selection keeps unaffected classifier accuracy unaffected. In the case of K-NN, the accuracy variation is less than 0.02%. A similar case occurs with Neural Networks, SVN with linear and with RBF kernels, Stochastic Gradient Descendant, and Decision Tree. In Random Forest, the best accuracy is found with a reduction of 30% of the original set of features of the dataset. The best result is reached in Gaussian Naive Bayes, in which 90% of the reduction in the selected features increases the accuracy from 57% to 78%, using only five features. Reducing 90% of selected features, we analyze other metrics, such as Precision, Sensitivity, and F1-Score, for all classifiers. We compare the results with no feature selection, Figure 14, and with only five features, Figure 15. All metrics remains almost equal. We achieve a slight positive variation in Gaussian Naive Bayes and Random Forest. We conclude that, for this dataset, our Feature Selection method maintains the metrics unaltered or increase classifier performance, because our proposal keeps the most of independent features in the dataset. In this experiment, we show the most important group of features. Thus, we group features into eight groups in the NetOp dataset. We remove the flow tuple information features because our algorithm works on numerical features and tuple information features are categorical. Table III describes the groups. We established the window size at 1000 samples. Figure 18 shows the accuracy for all seven algorithms for classification. In Decision Tree, all groups show similar behavior and present high accuracy. Gaussian Naive Bayes and SVM with the linear kernel for group 3, Time Between Packets, and for group 5, subflow information, present the lowest accuracy. For the rest of the groups, these classifiers also reach high accuracy. K-Nearest Neighbors (K-NN) shows a special case, besides group 2, which is the highest accuracy, all the other groups show different behaviors. In Neural Networks, groups 2 and 3, Packet Statistics and Time between Packets, show the highest accuracy, while the reminding groups maintain in 50%. Random Forest shows a similar behavior than Decision Tree, with high accuracy in all their groups. Nevertheless, the group 5, subflow information, present the lowest accuracy. Stochastic Descendant Gradient shows the highest accuracy in group 2,6 and 7. We conclude that group 2, Packet Statistics, is the most important for the accuracy calculation for all the classifiers. Bytes in headers + ToS 3

Finally, this experiment shows how our preprocessing method when executing with machine learning classifiers in stream data, can detect concept-drift. This experiment also demonstrates that the proposed preprocess method can run under batch and stream data. We use the flow diagram of the Figure 19. We force traditional learning methods to become adaptive learners to detect the concept-drift. Adaptive learners dynamically adapt to new training data when the learned concept is contradicted. Once a concept-drift is detected, a new model is created.

We validate the proposal with the NetOp dataset. The dataset presents labeled samples in threats and normal traffic, a binary classification problem. We divide the dataset in training set and test set, in a relation of 70% for training and 30% for the test. We consider the training set as static with T consecutive sample windows. We have used the Synthetic Minority class Oversampling TEchnique (SMOTE) [START_REF] Chawla | SMOTE: synthetic minority over-sampling technique[END_REF] approach to oversampling the minority class, only in the training set, initial window. When the number of samples in a class is predominant in the dataset, it is called class imbalance. Class imbalance is typical in our kind of threat detection application when attacks are rare events when compared to normal traffic. The test set is streaming data arriving at the same frequency. We group data in sliding windows of N samples.

Figure 20 shows the accuracy when we analyze one day from NetOp dataset. In the experiment, we measure the impact of the concept-drift on the final accuracy. Determining the concept-drift helps to improve the performance of the system, since the model will not be recalculated. We train different static algorithm with 30% of the dataset. We use 1000 samples as window size. The trained static algorithms are the Support Vector Machine (SMV) with linear kernel, and with Radial Basis Function (RBF) kernel, Gaussian Naive Bayes, Decision Tree, and Stochastic Gradient Descent (SGD). The decision tree has the worst accuracy when compared with the other algorithms. Decision tree shows a low accuracy in the second window. This behavior means that the created model during the training step does not adequately represent the model of the entire dataset. Stochastic Gradient Descendant shows a similar behavior of decision tree, having a concept-drift in the second window. The SVM with linear kernel presents a conceptdrift in the seventh window. SVM with RBF shows a lower accuracy during all experiment and a concept-drift at the last window. Finally, due to the implementation of the Gaussian Naive Bayes, it follows the same probability distribution as our normalization method, as a consequence does not present any concept-drift.

V. RELATED WORK

State-of-art proposals focus on algorithms for online feature selection. Perkins and Theiler Grafting algorithm based on a stage-wise gradient descent approach. Gradient Feature Testing (grafting) [START_REF] Perkins | Online feature selection using grafting[END_REF] treats feature selection in the core of the learning process. The objective function is a binomial negative log-likelihood loss. The Grafting method uses an incremental and iterative gradient descent. For each step, a heuristic is used to identify which feature improves the existent model. If the feature optimizes the model, the selected feature and the model are returned. The Grafting algorithm is able to operate with streaming features. A value of the regularization parameter λ must be determined in advance to establish which feature is most likely to improve the model at each iteration. To determine the value of λ is required information about the global feature set. As a consequence, Grafting method is ineffective with streaming data with unknown feature size.

The Alpha-investing method [START_REF] Zhou | Streamwise feature selection[END_REF] considers that new features arrive in a streaming manner generated sequentially for a predictive model. The main advantage of Alpha-investing is the possibility to run in a feature set of unknown or even infinite sizes. Every time a feature arrives, alpha-investing uses linear regression to reduce the threshold of error dynamically. As a drawback, alpha-investing only considers the addition of new features without evaluating the redundancy after the feature inclusion.

Wu et al. presented the OSFS (Online Streaming Feature Selection) algorithm and its faster version, the Fast-OSFS algorithm, to avoid the redundancy of added features [START_REF] Wu | Online feature selection with streaming features[END_REF]. The OSFS algorithm uses a Markov blanket of a feature to determine the relevance of the feature in relation with their neighbors. The Markov blanket of a node A, M B(A), is its set of neighboring nodes. The computational cost to calculate the Markov blanket of a feature is prohibitive when dealing with high dimensional data. Smart Preprocessing for Streaming Data (SPSD) is an approach that uses min-max normalization of numerical features [START_REF] Hu | Smart preprocessing improves data stream mining[END_REF]. The authors use two metrics to avoid unnecessary renormalization. SPSD only renormalizes when a threshold exceeds some threshold value of the metrics. Streaming data joins equal size chunk where all operations originate. The first data chunk is used to take the references min-max values and to send the normalized data for the training model. The metric 1 represents the amount of sample falling outside the minmax reference values; the metric 2 is the relation between new sample values in each dimension and the referenced minmax value for that dimension. Similar to our proposal, the algorithm works with numerical data.

Incremental Discretization Algorithm (IDA) uses a quantile approach to discretize data stream [START_REF] Webb | Contrary to popular belief incremental discretization can be sound, computationally efficient and extremely useful for streaming data[END_REF]. The algorithm discretizes data stream in m equal frequency bins. A sliding window version of the algorithm is proposed to follow the evolution of the data stream. The algorithm maintains the data into bins with fixed quantiles of the distribution, rather than fixed absolute values, to follow the distribution drift.

In our proposal, we propose an unsupervised preprocessing method. Our method includes normalization, and feature selection altogether. The proposal is parametric-less. Our algorithm follows an active approach for concept-drift detection. The active approach monitors the concept, the label, to determine when drift occurs before taking any action. A passive approach, in contrast, updates the model every time new data arrives, wasting resources. We modified our proposed Feature Selection algorithm to calculate the correlation between features in a sliding window. Also, a normalization algorithm is proposed to handle data stream.

VI. CONCLUSION

Achieving good classification metrics for streaming data is a challenge because neither the number of samples nor the domain of each sample feature is bounded. Therefore, it is mandatory to apply preprocessing methods to streaming data to bound the domain of each feature and to select only the most representative features for the classification model. In this paper, we presented a method for data preprocessing for classification of network traffic. The method is composed of two algorithms. First, we propose a normalization algorithm that enforces data to a normal distribution within values between -1 and 1, which produces a more accurate classification model and reduces the classification error. Then, a feature selection algorithm calculates the correlation of all pairs of features and selects the best features in an unsupervised way.

We select the features with the highest absolute correlation. When compared with traditional feature selection algorithms, our proposal selects an optimized subset of features improving the accuracy by more than 11% within a 100-fold reduction in processing time. Moreover, we modified our preprocessing method to work both on batch and on streaming data. When applied over streaming data, our preprocessing method was able to detect concept-drift due to the sensibility for detecting changes on the accuracy over a threshold.

Figure 1 .

 1 Figure 1. Preprocessing steps composed of Data Consolidation, Data Cleaning, Data Transformation and Data Reduction. Data Transformation and Data Reduction are the most time-consuming steps.

  in a histogram composed by bins b 1 , b 2 , . . . , b m , where m = √ n + 1, being n the number of features, as shown in line 3 in Algorithm 1.

Algorithm 1 : 4 H=CreateHistogram 7 for sample s in f do 8 [

 1478 Stream Normalization Algorithm Input : X: Sliding window of Features, w: Window Number Output: H: Normalized Features, f r : relative frequency 1 if w == 1 then 2 for f eature f in X do 3 b n = √ n + 1;/ * n: number of features * / H, f r ]=UpdateHistogram(X,b); 9 end

Algorithm 2 : 3 : 2 for b in bin do 3 if s in b then 4 b+

 23234 CreateHistogram() Function Input : X: Sliding window of Features, b n : number of bins Output: H: Histogram 1 [max, min]=CalculateMaxMin; 2 k=(max -min)/(b n ); / * k: threshold * / 3 for bin b in b n do 4 b=[min i , k); UpdateHistogram() Function Input : X: Sliding window of Features, b n : number of bins Output: H: Histogram, f r : relative frequency 1 for sample s in X do

Figure 2 .

 2 Figure 2. Representation of the feature divided in histogram. Each feature is divided in bins that represent the relative frequency of the samples comprised between the thresholds k. The second step of the algorithm approximate the histogram to a normal distribution.

Figure 3 .

 3 Figure 3. Representation of the feature divided in histogram. Each feature is divided in bins that represent the relative frequency of the samples comprised between the thresholds k.

Figure 4 .

 4 Figure 4. Information gain sum for feature selection algorithms. The selected features by our algorithm keeps an information retention capability between SFS and ReliefF in the GTA/UFRJ dataset.

5 SFS=4Figure 6 .Figure 7 .

 567 Figure 6. Sensitivity of detection in decision tree, SVM, and neural network algorithms for feature selection methods in the GTA/UFRJ dataset.

Figure 8 .

 8 Figure 8. Evaluation of Feature Selection varying the selected features in NSL-KDD dataset.

Figure 9 .Figure 10 .

 910 Figure 9. Accuracy, precision, sensitivity and F1-Score for NSL-KDD. Metrics with no future selection.

Figure 13 .

 13 Figure 13. Evaluation of Feature Selection varying the selected features in NetOp dataset.

Figure 14 .

 14 Figure 14. Accuracy, precision, sensitivity and F1-Score for NetOp dataset. Metrics with no future selection.

Figure 16 showsFigure 15 .

 1615 Figure 16 shows the training and classification times with no feature selection, while Figure 16 shows the training and classification times for the dataset with 90% of feature reduction. All the classifiers reduced their times. K-NN training time is reduced by 71%, while classification time is reduced by 84%. For Neural Networks reduced the training time by 25% and classification time is reduced in 0.02 seconds. Random Forest reduced their training time by 38% while their classification time remains the same. SVM with RBF kernel training time is reduced by 78% and training time is reduced by 54%. SVM with linear kernel received the biggest improvement. Training time was reduced by 88% while classification time was reduced by 81%. Gaussian Naive Bayes reduced their

Figure 16 .Figure 17 .

 1617 Figure 16. Classification and training time in NetOp Dataset with no feature Selection

Figure 18 .

 18 Figure 18. Evaluation of group features with different machine learning algorithms.

Figure 19 .Figure 20 .

 1920 Figure 19. Flow diagram used for proposal evaluation

Table I SUMMARY

 I OF DATASETS USED FOR EVALUATION (FE: FEATURES; FL: FLOWS).

	Dataset	Format	Size	Attacks	Type
	NSL-KDD	41 Fe	150k Fl 80.5 % Synthetic
	GTA/UFRJ	26 Fe	95 GB	30 %	Synthetic
	NetOp	46 Fe	5M Fl	-	Real

  Figure 5. Accuracy comparison of features selection methods. Our Proposal, Linear PCA, ReliefF, SFS and SVM-RFE compared in decision tree, SVM, and neural network algorithms in the GTA/UFRJ dataset. sensitivity with PCA using six features with 97.7%, then our results show good performance with both four and six features in 89%. In this group, the worst sensitivity of all classifiers is reached by the SVM-RFE with four and six features in 69.3%. Finally, the last group shows the Sensitivity for Support Vector Machine (SVM) classifier. Again, showing a similar behavior to the previous group PCA with six features shows the best sensitivity with 97.8%. Then, the second-best result is reached by our algorithm, as well as with ReliefF, with 89% sensitivity with both features. It is worthy to note that our algorithm presents a stable behavior in Accuracy as well as in Sensitivity.

	Accuracy [%]	80 100	Proposal=4 94.3 93.4	Proposal=6 96.0 96.2 91.2 91.2 SVM-RFE=4 95.5 95.5	SVM-RFE=6 91.4 91.4 PCA=6 PCA=4 85.5	97.6	78.4 79.2 ReliefF=6 ReliefF=4 90.2 90.2	91.4	91.4	87.8	79.5 79.5 SFS=6 SFS=4 99.1 91.4 91.4
		60
				Desicion Tree	Neural Network		Support Vector Machine

  1.89 seconds to 2.88. Neural Network reduced 9% of the training time, from 22.99 seconds to 20.92, classification time got 0.01 second increased. Random Forest training time increased 0.02

		10 5
				Training Time	890.36	654.03
	Time (s)	10 0	0.63 1.89	22.99 0.07	0.77 0.02	79.75	0.004 1.05 2.09 0.004 Classification Time 0.04 0.11 54.86
				K N N N e u r a l N e t . M L P R a n d . F o r e s t S V M -R B F S V M -L i n e a r G N B a y e s S t o c h a s t i c G D	T r e e
	Figure 11. Classification and training time in NSL-KDD Dataset with no
	feature Selection
			10 5
				Training Time	785.08	349.05
	Time (s)	10 0	5.03 2.88 20.92 0.08	0.79 0.02	66.29	32.88 0.10 0.03 Classification Time 0.68 1.50
								0.003	0.003
				K N N N e u r a l N e t . M L P R a n d . F o r e s t S V M -R B F S V M -L i n e a r G N B a y e s S t o c h a s t i c G D	T r e e
	Figure 12. Classification and training time in NSL-KDD Dataset with only
	10% of the initial features
	second, and classification time remained the same, which is
	negligible because of the intrinsic error of the cross-validation.
	SVM with Radial Basis Function (RBF) and SVM with linear
	kernel are the most benefited from features selection. SVM-
	RBF training time reduced 11% while the classification time,
	16%. SVM-Linear classification time reduced 46%, from 654
	seconds to 349 seconds, and training time, 40%, from 54.86
	to 32.88 seconds. Feature selection in Gaussian Naive Bayes,
	Stochastic Gradient Descendant, and Decision Tree strongly
	impact in training time with an approximate reduction of 30%,
	while the classification time was reduced of a one-time unit
	in three algorithms.

Features refer to the original set of attributes that describe the data. Variables refer to the input of the machine learning algorithms applied over the data. If no preprocessing method handles the original data, the set of variables and the set of features are the same.

Anonymized data can be asked by sending an email contact to the authors

ACKNOWLEDGMENT

The authors would like to thank Antonio Lobato, Igor Alvarenga and Igor Sanz for their significant contributions to obtain the results. This research is supported by CNPq, CAPES, FAPERJ, and FAPESP (2015/24514-9, 2015/24485-9, and 2014/50937-1).


Diying Huang

Yanzhe Fu

André Nel
email: andre.nel@mnhn.fr

A possible true Mesozoic Gomphidae s. str. from the mid-Cretaceous Burmese amber (Odonata: Anisoptera)

Keywords: Insecta, Odonata, Gomphidae, Burmese amber, gen. et sp. nov

Gunterbechlya pumilio gen. et sp. nov., first putative Mesozoic Gomphidae sensu stricto, is described from the mid-Cretaceous Burmese amber. It is remarkable in its reduced venation with quadrangular discoidal triangles, only found in the extant gomphid genera Lestinogomphus and Archaeogomphus, the 'libelluloid' Cordulephyidae and the Libellulidae: 'Tetrathemistinae'. All these taxa are small dragonflies with reduced venation. Possibly the particular quadrangular discoidal triangles of these insects are related to their small sizes. The positions of some Mesozoic taxa currently attributed to the Gomphidae are discussed and none can be considered as genuine representatives of this family.

Introduction

Burmese amber Gomphides Bechly et al., 1998 are rather diverse compared to the other Anisoptera, with four described species, viz. Burmalindenia imperfecta Schädel and Bechly, 2016 (Lindeniidae), Paraburmagomphides zhaoi Zheng et al., 2018 (Paraburmagomphidae), Burmagomphides electronica Zheng et al., 2018 (Burmagomphidae), and Araripegomphus shai Zheng et al., 2018 (Araripegomphidae). Here we describe a new Gomphides that strongly differs from all the other Burmese amber representatives of this clade in its reduced wing venation and very particular quadrangular shapes of the discoidal triangles. Similar associations of quadrangular discoidal triangles and reduced venation can be found in few extant Gomphidae and in some Cavilabiata (Neophyinae, Cordulephyinae, and the Libellulidae 'Tetrathemistinae').

All the Mesozoic Gomphides currently described belong to gomphides families more inclusive than the Gomphidae (see below for the attributions of the taxa currently included in the Gomphidae). The new fossil is the first accurate Mesozoic Gomphidae.

Material and methods

The amber containing the dragonfly was collected in the Hukawng Valley (26° 29' N, 96'° 35' E) of Kachin Province, Myanmar (locality in Kania et al., 2015: fig. 1). The re-deposition age of Burmese amber was considered to be 98.79 ± 0.62 Ma [START_REF] Shi | Age constraint on Burmese amber based on U-Pb dating of zircons[END_REF], but palynology and an ammonite from the amber-bearing layers suggest a late Albian age [START_REF] Cruickshank | Geology of an amber locality in the Hukawng Valley, northern Myanmar[END_REF] which we adopt herein. The amber containing the dragonfly is yellow and transparent.

The individual shows fragments of a forewing (basal and apical sections missing) and fragments of a hind wing. Photographs were taken using a Zeiss Discovery V20 microscope system. The specimen is housed in the Nanjing Institute of Geology and Palaeontology, Chinese Academy of Sciences, China. All taxonomic acts established in the present work have been registered in Zoo-Bank (see below), together with the electronic publication LSID: urn:lsid:zoobank.org:pub:14D41825-4E33-4D12-BEBD-313A43DC693A.

We follow the wing venation nomenclature of [START_REF] Riek | A new interpretation of dragonfly wing venation based upon Early Carboniferous fossils from Argentina (Insecta: Odonatoidea) and basic characters states in pterygote wings[END_REF], amended by [START_REF] Nel | Les 'Anisozygoptera' fossiles. Phylogénie et classification (Odonata)[END_REF] and [START_REF] Bechly | Morphologische Untersuchungen am Flügelgeäder der rezenten Libellen und deren Stammgruppenvertreter (Insecta; Pterygota; Odonata), unter besonderer Berücksichtigung der Phylogenetischen Systematik und des Grundplanes der Odonata[END_REF]. The higher classification of fossil and extant Gomphides, as well as familial and generic characters followed in the present work are based on the phylogenetic system proposed by [START_REF] Bechly | Morphologische Untersuchungen am Flügelgeäder der rezenten Libellen und deren Stammgruppenvertreter (Insecta; Pterygota; Odonata), unter besonderer Berücksichtigung der Phylogenetischen Systematik und des Grundplanes der Odonata[END_REF][START_REF] Bechly | Phylogenetic systematics of Odonata. -homepage on Internet site[END_REF], which mainly follows the work of [START_REF] Carle | The classification, phylogeny and biogeography of the Gomphidae (Anisoptera). I. Classification[END_REF]. No extensive phylogeny of the extant (and fossil) Gomphides has been proposed since these works, except the molecular analysis devoted to the Nearctic Gomphidae by [START_REF] Ware | Phylogenetic relationships of North American Gomphidae and their close relatives[END_REF]. Abbreviations for wing venation are as follow: a.l. = anal loop; CuA = cubitus anterior; PsA = pseudo-anal vein; IR = intercalary radial vein; MA = media anterior; MP = media posterior; N = nodus; Cr = nodal crossing; PsA = pseudo-anal vein; Pt = pterostigma; RP = radius posterior; ScP = subcostal posterior; Sn = subnodus; t = discoidal triangle.

Systematic Palaeontology

Order Odonata Fabricius, 1793 Clade Gomphides Bechly et al., 1998Family Gomphidae Rambur, 1842(sensu Bechly, 2016) Subfamily undetermined Genus Gunterbechlya gen. nov.

(urn:lsid:zoobank.org:act:C11E2A35-9C69-4968-B474-F7BFB853FCFA) Type species: Gunterbechlya pumilio sp. nov.

Etymology. Named after our friend and colleague Günter Bechly, for his contribution in Odonatology.

Diagnosis. Wing venation characters only. No Rspl; no Mspl; no trigonal planate; MAb straight; a very strong pterostigmal brace; unicellular anal loop; no 'libelluloid gap'; pseudo-anal vein PsA long sigmoidal; subdiscoidal triangle of hindwings pentagonal with an angular AA; free hypertriangles with a distinctly curved anterior margin; costal margin and RA thickened along pterostigmata; a 'cordulegastrid gap' in forewing but not in hind wing; free short discoidal triangles quadrangular, with veinlet between it and hypertriangle ending in MA before its fork into MAa and MAb; IR2 and MA without any secondary branch; only two antefurcal crossveins between sectors of arculus in forewing, and none in hind wing; no large elongated cell beneath submedian area of forewings; CuAa distinctly shortened, with a course distally converging with the wing margin; branching of RP at midfork symmetrical; lestine oblique vein one cell distal of subnodus in all wings.

Gunterbechlya pumilio sp. nov.

(urn:lsid:zoobank.org:act:9FB77E53-F936-4EA2-9E7C-2D208B03F775) (Fig. 1) Etymology. Named pumilio after its very small dimensions. subdiscoidal triangle unicellular, well defined, pentagonal with an angular AA; a well-defined PsA; anal loop unicellular and posteriorly close; CuAa without defined posterior branches and two rows of cells in cubito-anal area; one row of cells in area between CuAa and MP; a distinct anal angle (male specimen).

Discussion

This fossil cannot be related to the Libellulidae: 'Tetrathemistinae' because of the complete absence of Rspl, presence of a hind wing subdiscoidal space, presence of a male anal angle, and very strong pterostigmal brace. Also it differs from Cordulephya Selys, 1870 in the strong pterostigmal brace. It differs from Neophya Selys, 1881 (Eocene and extant) in the unicellular anal loop, the absence of 'libelluloid gap' and the pattern of cells in area between IR2 and RP2 [START_REF] Nel | Dragonflies and damselflies (Insecta: Odonata) from the Late Eocene of the Isle of Wight[END_REF]. It differs from the Cretaceous Palaeophya [START_REF] Petrulevičius | First Cordulephyidae dragonfly in America: a new genus and species from the Paleogene of Argentina[END_REF] in the absence of a Mspl and the reduced anal loop [START_REF] Petrulevičius | First Cordulephyidae dragonfly in America: a new genus and species from the Paleogene of Argentina[END_REF]). An attribution to the Gomphides Bechly et al., 1998 is supported by few synapomorphies: pseudo-anal vein PsA and subdiscoidal triangle of hindwings well defined, pentagonal with an angular AA (unlike in the Tetrathemistinae and Cordulephyidae, [START_REF] Tillyard | On the genus Cordulephya[END_REF][START_REF] Fraser | The Odonata of the Ivory Coast based on the mission of Dr. R. Paulian and P. Lepesme[END_REF]; hypertriangles with a distinctly curved anterior margin; costal margin and RA thickened along pterostigmata. Unfortunately the structure of the arculus, an important character of this clade, is not preserved. It would share with the Araripegomphidae Bechly, 1996 the discoidal triangles unicellular (convergent to Proterogomphidae and Gomphida); and presence of a distinct 'cordulegastrid gap' (lack of crossveins in the distal antesubnodal space), but unlike in this family, this 'gap' is only present in the forewing of Gunterbechlya gen. nov., not in the hind wing. Also the anal loop of Gunterbechlya is not obsolete, not reduced and posteriorly open as in this family. The Progomphidae [START_REF] Carle | The classification, phylogeny and biogeography of the Gomphidae (Anisoptera). I. Classification[END_REF] Gunterbechlya fits in the Gomphida Bechly, 1996 because the discoidal triangles are unicellular in both pairs of wings; and the anal loop is reduced to one cell (putative synapomorphies, but also present in Araripegomphidae and Proterogomphidae, excluded above). The Epigomphidae Fraser, 1934 are excluded because the pterostigmal brace of Gunterbechlya is not reduced.

Gunterbechlya falls well in the Gomphidae Rambur, 1842 because the branching of RP at midfork is symmetrical (but convergent to Hagenioidea, excluded above); lestine oblique vein is one cell distal of the subnodus in all wings (but convergent to Proterogomphidae, excluded above); in forewings only two antefurcal (= postmedian) crossveins retained between the sectors of arculus, and none in hind wings (but convergent to Proterogomphidae: Cordulagomphinae, excluded above). Of course, because the lack of information on some characters (viz. structure of pseudo-IR1, number of cells beneath the pterostigmata), and because the wing venation characters can be homoplastic in dragonflies, this attribution to Gomphidae sensu stricto is tentative. The discovery of new specimens with complete wings and body structures will help to precise its affinities.

Within the Gomphidae, Austrogomphini [START_REF] Carle | The classification, phylogeny and biogeography of the Gomphidae (Anisoptera). I. Classification[END_REF], Cyanogomphini Carle, 1986, and Phyllogomphinae Carle, 1986 have well-defined branches of CuA in forewing and much more intercalary rows of cells between main veins than in Gunterbechlya. The Onychogomphinae Chao, 1984, Octogomphinae Carle and Cook, 1984, and Gomphinae Rambur, 1842 have also much more intercalary rows of cells between main veins than in Gunterbechlya.

The Lestinogomphini Carle, 1986 and the Archaeogomphini Carle, 1986 remain the sole extant Gomphidae that share with Gunterbechlya this drastic reduction of the number of intercalary rows of cells and supplementary longitudinal veins. Lestinogomphus differs from Gunterbechlya in the shape of hind wing discoidal triangle and the more numerous antefurcals (three in forewing instead of two in Gunterbechlya). Archaeogomphus shares with Gunterbechlya very similar discoidal triangles and hypertriangles, anal loop, CuAa and MP, one row of cells in postdiscoidal areas, but they differ in crucial structures, viz. Gunterbechlya has much less antenodal crossveins than Archaeogomphus, the fork between RP1/2 and RP3/4 is more symmetrical in Gunterbechlya than in Archaeogomphus, Gunterbechlya has only two forewing antefurcals, instead of 3-4 in Archaeogomphus, the pterostigmal brace of Gunterbechlya is much more oblique than in Archaeogomphus, Gunterbechlya has a distinct 'cordulegastrid gap' in forewing, unlike Archaeogomphus (in fact Gunterbechlya has only four antesubnodal crossveins instead of seven in Archaeogomphus).

Remarks on the Mesozoic taxa currently attributed to the Gomphidae.

The internet Gateway to the Paleobiology Database Fossilworks (site http://fossilworks.org) gives a list of the fossil dragonflies currently included in the family Gomphidae. The lower Cretaceous Spanish genus Ilerdaegomphus Martinez-Delclos, 1989 is currently in the family Gomphidae sensu lato [START_REF] Martínez-Delclòs | Los Gomphidae del Cretácico Inferior de España[END_REF]. Its discoidal triangles unicellular are also present in the Araripegomphidae, the Proterogomphidae and the Gomphida. Affinities with the Araripegomphidae are excluded because its sectors of arculus are well-separated at bases. Affinities with the Cretaceous Proterogomphidae are also excluded because its forewings is without a large elongated cell beneath the submedian area. But it does not fall in the Gomphida because its anal loop is four-celled instead of being max. two-celled, and its CuAa have welldefined 4-5 posterior branches. It does not fall in the Gomphidae themselves because its branchings of RP at midfork are asymmetrical. Thus this taxon does not fall in any of the defined families of Gomphides. A restudy of the type material would be necessary at the light of the recent progresses in the 'gomphid' systematics. The Lower Cretaceous nymphs Dissurus quinquanensis [START_REF] Hong | Jiuquan pendi kunchong huashi [Mesozoic fossil insects of Jiuquan Basin in Gansu Province[END_REF], Yixiangomphus labius (Lin, 1976), and the abdomen Cercus clavus [START_REF] Hong | Jiuquan pendi kunchong huashi [Mesozoic fossil insects of Jiuquan Basin in Gansu Province[END_REF] are Anisoptera incertae sedis [START_REF] Nel | Les Gomphidae fossiles. Un inventaire critique (Odonata, Gomphidae)[END_REF]. The nymph Pseudosamarura largina Lin, 1976 is not an Anisoptera. The nymph Neimeugogomphus dougwugaieusis Hong, 1985 is a Gomphides. [START_REF] Nel | Les Gomphidae fossiles. Un inventaire critique (Odonata, Gomphidae)[END_REF] indicated that the original description of Huaxiagomphus taushanensis [START_REF] Hong | Jiuquan pendi kunchong huashi [Mesozoic fossil insects of Jiuquan Basin in Gansu Province[END_REF] is not very precise.

Nevertheless, the lestine oblique vein drawn very far from the subnodus would exclude any affinities with the Gomphidae, and the large posteriorly opened anal loop excludes affinities with the Gomphida [START_REF] Hong | Jiuquan pendi kunchong huashi [Mesozoic fossil insects of Jiuquan Basin in Gansu Province[END_REF](Hong, : text-fig. 23, 1984)), if this taxon can be attributed to the Gomphides. Jibeigomphus xinboensis Hong, 1984 is even more poorly described, nevertheless its forewing discoidal triangle divided into three cells excludes affinities with the Gomphidae, if it is a Gomphides [START_REF] Hong | Tracheata, Insecta[END_REF]. The Lower Jurassic Pheugothemis westwoodi [START_REF] Phillips | Oxford fossils. 2[END_REF] is certainly not a Gomphidae, and probably not a Gomphides [START_REF] Phillips | Oxford fossils. 2[END_REF]. None of these taxa can be accurately attributed to the Gomphidae, or even the Gomphida. [START_REF] Kohli | How to date a dragonfly: fossil calibrations for odonates[END_REF] considered the Jurassic Proteromphidae as oldest 'crown Gomphidae', together with some Lower Cretaceous Hageniidae, but these taxa are not representatives of the Gomphidae sensu [START_REF] Bechly | Phylogenetic systematics of Odonata. -homepage on Internet site[END_REF].

Conclusion

If the clade Gomphides was very diverse during the Mesozoic, and especially the Cretaceous, the fossil record of the extant family Gomphidae sensu stricto is reduced to Cenozoic taxa. Here we describe the first putative Cretaceous representative of this family, of interest for future calibrations in phylogenetic analyses of the Gomphides. Its wing venation is reduced with highly specialized quadrangular discoidal triangles. Unfortunately, its exact affinities within the Gomphidae remain obscure because of the lack of the body characters.

Holotype.

  One amber piece contents a forewing (NIGP168872) and a hind wing (NIGP168873), Nanjing Institute of Geology and Paleontology, Chinese Academy of Sciences, China. Diagnosis. Wings very short, hyaline; fore wing with six postnodals and four postsubnodals, both approximately equidistant. Locality and Horizon. Hukawng Valley, Kachin Province, Myanmar; late Albian, late Lower Cretaceous. Description. Wings hyaline; forewing with base and apex missing, fragment 11.5 mm long, wing 3.8 mm wide; distance from arculus to nodus 4.8 mm, from nodus to pterostigma 5.4 mm; pterostigma 0.5 mm wide, elongate, covering one crossvein, with costal and posterior margins widened; pterostigmal brace distinctly oblique and strong, with RP1 making a distinct angle; six postnodals, not aligned with the four postsubnodals; base of RP2 slightly distal of subnodus; RP2 smoothly curved, one row of large cells between RP1 and RP2 basal of pterostigma; two rows distally; oblique vein 'O' one cell distal of subnodus; one row of cells between RP2 and IR2; two Bq-crossveins; fork of RP into RP1/2 and RP3/4 symmetrical; base of IR2 rather distant from that of RP3/4; five visible secondary antenodal crossveins of first row not aligned with those of second row (less numerous); three antesubnodal crossveins, a 'cordulegastrid' gap; two antefurcal crossveins (= postmedian) between sectors of arculus; hypertriangle free with MA strongly curved; free discoidal triangle quadrangular with veinlet between it and hypertriangle ending in MA before its fork into MAa and MAb; postdiscoidal area with one row of cells and two rows very distally; subdiscoidal triangle unicellular, well defined, triangular; a well-defined elongate PsA; area between RP3/4 and MAa with one row of cells; no Mspl, no Rspl but a rudimentary zigzagged longitudinal vein apparently emerging from IR2 and two main rows of cells in distal part of area between IR2 and RP3/4; one row of cells between MP and CuAa; one row of cells in cubito-anal area; CuAa without posterior branches, reaching level of nodus. Hind wing incomplete with base and distal third missing; fragment 10.8 mm long; wing 4.3 mm wide; pterostigma not preserved; five postnodal crossveins and four postsubnodals visible, no 'libelluloid' gap; base of RP2 slightly distal of subnodus; area between RP1 and RP2 rather broad but with one row of cells; oblique vein 'O' two cells distal of subnodus; only one Bqcrossvein; three antesubnodal crossveins, two of them being distal of base of RP3/4; two secondary antenodal crossveins of first row distal of Ax2 and only one of second row; Ax2 opposite apex of hypertriangle; fork of RP into RP1/2 and RP3/4 symmetrical; base of IR2 rather distant from that of RP3/4; no antefurcal (= postmedian) crossvein retained between sectors of arculus; hypertriangle free, with anterior side (MA) strongly curved; free discoidal triangle quadrangular with veinlet between it and hypertriangle ending in MA before its fork into MAa and MAb; postdiscoidal area with one row of cells and two rows very distally;

  are excluded for the anal loop not obsolete and the hind wing discoidal triangle unicellular. The Lindeniidae Jacobson and Bianchi, 1905 are excluded for the free hypertriangle, not elongate discoidal triangles, and IR2 and MA without any secondary branch. It falls in the Oligophlebiata Bechly, 2003 because of the presence of only two antefurcal crossveins between the sectors of arculus in forewing. The complete absence of a trigonal planate and MAb straight exclude affinities with the Mesozoic Proterogomphidae Bechly et al., 1998 and with the Hageniidae. The absence of a large elongated cell beneath the submedian area of forewings also excludes affinities with the Proterogomphidae. In the Hageniidae, the discoidal triangles are distinctly longitudinally elongate in both pairs of wings, and the distal sides (MAb) of triangles are strongly sigmoidal.Gunterbechlya can be attributed to the Brevicubitalia Bechly, 2003 because of the CuAa distinctly shortened, with a course distally converging with the wing margin, instead of running parallel to it, and with a reduced pectinate branching. The Zonophoridae Belle, 1983 are excluded because the hindwing discoidal triangle of Gunterbechlya is not elongate.

Fig. 1 .

 1 Fig. 1. Gunterbechlya pumilio gen. et sp. nov. from the mid-Cretaceous Burmese amber. A. Fore wing (NIGP168872), with general view; B. Hind wing (NIGP168873), with general view immerged in mineral oil. Scale bars represent 2 mm.

Acknowledgements

We sincerely thank two anonymous referees for their helpful remarks and suggestions on the first version of the paper. This project was supported by the Strategic Priority Research Program of Chinese Academy of Sciences, Grant No. XDB26000000 and XDB18000000, and National Natural Science Foundation of China (41688103).