1

29 issues found in this text

Score: 82 of 100

Report generated on Tue, May 13 2014 11:22 AM

SpellingCorrection

12issues

Spelling (9)

Accidentally confused words (1)

Unknown words (2)

Grammar 4issues

Passive voice use (4)

Grammar 10issues

Use of articles (7)

Subject and verb agreement (3)

SentenceStructure

2issues

Sentence fragment (1)

Faulty parallelism (1)

EnhancementSuggestion

7issues

Vocabulary use (7)

Style Check 1issue

Usage of colloquial speech (1)

decision 1 ( Decision ) based on a 2 ( the ) part of the features that recognize the packet attackor not. This approach make 3 ( makes ) the classification confused that classify clean packets asattacks . Therefore , there are a tradeoff between the detection rate with time taken and the Fig. 3.5Detection rate for 5, 10, 21 and 41 features [17] Fig. 3.6 Training time for 5, 10, 21 and 41 features[17] false 4 ( False ) alarm [18].

Writing issues in this paragraph:1 Capitalization at the beginning of a sentence

2 Indefinite instead of definite article

3 Incorrect verb form with singular subject

4 Capitalization at the beginning of a sentence

No . Feature Name Feature 's order Dependency Ratio [12] Attack type Attack class 1 source bytes5 0.9708 Back DOS 2 land 7 0.9999 Land

source bytes 5 0.9328 Neptune 3 wrong fragment 8 0.9853 Pod

source bytes 5 0.7731 Smurf

2

wrong fragment 8 0.9913 teardrop 4 count 23 0.6183 Smurf 5 Duration 1 0.5682 guess_passwd1 R2L 6 failed login 11 0.9622 guess_passwd 2 7 service 3 0.9980 Imap 8 destination bytes 60.9976 Phf

Writing issues in this paragraph:1 Unknown word: guess_passwd

2 Unknown word: guess_passwd

count 23 0.7898 multihop

destination bytes 6 0.7500 warezmaster 1 ( webmaster )

Writing issues in this paragraph:1 Misspelled word: warezmaster

service 3 0.6658 ware client 9 dst 1 ( dust, dit, ds, dot, dost ) host srv 2 ( sr, Srv, SUV, Sr, SRO ) serror 3 ( error, errors, terror, senor, serer ) rate 39 0.9997 Spy

Writing issues in this paragraph:1 Misspelled word: dst

2 Misspelled word: srv

3 Misspelled word: serror

service 3 0.6965 buffer overflow U2R 10 dst 1 ( dust, dit, ds, dot, dost ) host same srcport 2

( support, sport ) rate 36 0.6279 Load module 11 root shell 14 0.9994 Perl 12 srv 3 ( Srv, SUV, Sr,SRO ) count 24 0.7269 rootkit Table 3.2 the selected features based on the dependency ratio forthe attack types

Writing issues in this paragraph:1 Misspelled word: dst

2 Misspelled word: srcport

3 Misspelled word: srv

According to the previous studies that mentioned up, 12 features are chosen to be the target forthe proposed IDS designing 1 ( creating ) in this research . The chosen features include the mosteffect features on the detection of DOS, U2R and R2L attacks that suggested in the table (3.1) [12],[14]. Table (3.2) shows the selected features and the order number of each feature in the originalNSL-KDD dataset. The selection was based on the dependency rate that the attacks detectiondepend on which feature . The selected features related with DOS, R2L and U2R attacks only , thePROBE attack not included . 3.4 The Proposed Method for IDS Designing: Block Matching blockis the proposed method 2 ( design ) for the designing 3 ( creating ) . In this method 4 ( process,design ) , we 5 focused on two features of the Block Matching, the ability to estimate the motionbetween two images or two video frames and the ability to give the mean square errors betweentwo images or two video frames . Estimation , that mean the ability to generalize from incompletedata. Mean square error that mean the ability to classify the data as normal or abnormal( attack ). 6 There are two ways to apply the IDS on the IBM as shown in Fig. (3.7). OR PatchingData 1st Method 2nd Method Testing Data Sub-Matrix IMAGE BLOCK MATCHING Emb. MAT .Fun . Video from Testing and Patching Data Attack or not

3

Writing issues in this paragraph:1 Overused word: designing

2 Overused word: method

3 Overused word: designing

4 Overused word: method

5 Informal pronouns

6 Incorrect use of sentence fragment

Fig. 3.7 IDS by using IBM [1]

The first is by forming the testing data as two dimensions matrix and pass it to 1 ( a , the ) sub-matrix block according to the size of the testing records . After that , it pass 2 ( passes ) to the IBMas image under test with another image formed from 3 ( the , a ) matrix that taken from trainingdata. The matching result will appear as 4 ( a , the ) matrix of mean square error , this errors is 5 ( are ) passed to the Embedded Matlab Function to give the decision if it attack case or not.The second method is by generating a video file from the testing data and the patch data thatis tacked 6 ( tracked ) from the training records then it passed to the IBM and the other steps isthe same of the first method 7 ( process ) . This method 8 ( process ) is more complicated fromthe first method 9 ( design ) , but it faster than the first because of the reducing in the blocks ; itbecame unstable as the testing records increases , for that it not recommended . 3.4.1 Image BlockMatching (IBM): Block Matching is one of the most powerful tools of Video and Image ProcessingBlock-set in SIMULINK program Fig. (3.8-a). It is used to match between tow images or to videoframes . There are two modes of matching in the IBM technique , tow images and the current framewith the Nth frame back . The mode of matching can be chosen from the block parameters windowFig (3.8-b). (a) (b)

Writing issues in this paragraph:1 Missing article

2 Incorrect verb form with personal pronoun

3 Missing article

4 Missing article

5 Incorrect verb form with plural subject

6 Possibly confused word: tacked

7 Overused word: method

8 Overused word: method

9 Overused word: method

Fig. 3.8 Image Block Matching (IBM): (a) Block Matching, (b) Parameter Setting [(...)

The work of this tool is based on subdividing the image or the 1 ( a ) frame to a number of sub-blocks of pixels that entered in Block Size [ height , width] and overlap [ height , width] parametersFig. (3.9). So , by moving the block of pixel in the frame k over a search region in the 2 ( a ) blockof pixel in the frame k+1 which is limited by Maximum displacement [ height , width] parameter, themismatching can be computed as a 3 ( the ) mean square error . Fig. 3.9 The work Technique ofthe IBM [ ]

Writing issues in this paragraph:1 Definite instead of indefinite article

2 Definite instead of indefinite article

4

3 Indefinite instead of definite article

There are other tools similar to the Block Matching block and built based on its rules . 1 Thistool also able to match matrices and images . Pattern Matching and Template Matching blocks willbe discussed below .

Writing issues in this paragraph:1 Inconsistent verb forms