133 issues found in this textScore: 71 of 100Report generated on Tue, May 13 2014 11:28 AM

SpellingCorrection

8issues

Spelling (4) Accidentally confused words (4)

Grammar 2issues

Passive voice use (2)

Grammar 21issues

Use of articles (4) Use of adjectives and adverbs (5) Use of nouns (3) Incorrect use of prepositions (1) Subject and verb agreement (6) Verb form use (2)

SentenceStructure

2issues

Sentence fragment (2)

EnhancementSuggestion

4issues

Vocabulary use (4)

3.5.2 Forming of Rules matrices : After the preprocessing is finished , the rule matrices can beformed easily . The first step , splitting the features according to their related attack class Dos, R2Land U2R. From Table (3.2), there are four features for Dos and others for U2R and six features forR2L. Both DoS and U2R rules will consist of 2x2 matrix 1 ( matrices ) from their four features . TheR2L rules will consist of 2x3 matrix 2 ( matrices ) from its six features . These matrices will be theBasic Block for the final form of the rules matrices The number of the NSL-KDD training records thatused in this design was 1500 records , 500 record 3 ( records ) for each attack class . Each record consist 4 ( consists ) of the selected features from its whole features . Fig. (3.13) show 5 ( Show )the systematic of configuration of the rules matrices . the 6 ( The ) 500 records of each attack classdivided to five matrices with 100 records for each one. F.O. 11 F.O. 1 F.O. 23 F.O. 3 F.O. 6 F.O. 39Basic Block for R2L No.20 No.1 F.O. 14 F.O. 36 F.O. 24 F.O. 3 F.O. 23 F.O. 8 F.O. 5 F.O. 7 BasicBlock for DoS No.1 No.100 Basic Block for U2R No.20 (a) (b) Fig. 3.13 The Forming of the rulesmatrices : a- for DoS and U2R, b- for R2L (F.O. Feature Order ).

Writing issues in this paragraph:1 Single countable noun used after numeral.2 Single countable noun used after numeral.3 Single countable noun used after numeral.4 Incorrect verb form with singular subject

25 Capitalization at the beginning of a sentence6 Capitalization at the beginning of a sentence

For DoS and U2R, each record consist 1 ( consists ) of four features represented by the BasicBlock, for that the rule matrix will be consist 2 ( consist ) of 400 features and configure as 20x20matrix (10x10 of Basic Blocks )as shown in Fig. (3.13-a). In this case , there will be five matricesfor DoS attack and the same number for U2R. For R2L, each record consist 3 ( consists ) of sixfeatures represented by the Basic Block. By depending 4 ( on ) the same method 5 ( process ) ofthe DoS and U2R, the block will be consist 6 ( consist ) of 600 features and configure as 20x30matrix and 10x10 of Basic Block as shown in Fig(3.13-b). 3.6 IDS Designing: Fig. (3.14) shows7 ( Shows ) the designed 8 ( created ) IDS. The input of the system is the 12th selected features

from the NSL-KDD testing dataset. These features passed to the System Core, which start , bysplitting them according to the related attack class to be processed in 9 ( a , the ) parallel method10

( process, design ) that is more speed and efficient . System-Core Fig. 3.14 the designed 11( created ) IDS structure by using Matlab R10

Writing issues in this paragraph:1 Incorrect verb form with singular subject2 Missing participle after be3 Incorrect verb form with singular subject4 Missing preposition after verb5 Overused word: method6 Missing participle after be7 Capitalization at the beginning of a sentence8 Overused word: designed9 Missing article10 Overused word: method11 Overused word: designed

Some features used in more than one attack class , for that , they are copied and sent to the relatedpattern matching to be shared . Pattern matching in the System Core is divided to three partsDoS, U2R and R2L. Each part consist of the Pattern Matching Engine, the Rules-set Store of therelated attack and the Decision Block. The core of Pattern Matching Engine consist 1 ( consists )of IBM block that receive its inputs as tow matrices , one from the Rules-set and the other from theTest dataset. The IBM scan the rules matrix to find 2 ( a , the ) match with the test dataset matrix .Fig. (3.15) shows 3 ( Shows ) how the matching operation is done . The IBM tacks 4 ( tracks )the under-test matrix (2x2 for DoS and U2R, 2x3 for R2L) and move it over the rules matrix bycomparison them step by step as mentioned in section (3.4.1).

Writing issues in this paragraph:1 Incorrect verb form with singular subject2 Missing article3 Capitalization at the beginning of a sentence4 Possibly confused word: tacks

. .

Fig. (3.15) the systematic of pattern matching in the Pattern Matching Engine

3If the match not found , the next rules matrix (there are five rules matrices ) is tacked to becompared with the Under-test matrix by the same way . The Decision 1 ( Decision ) blockreceive the output of the Pattern Matching Engine, which is the mean squired 2 ( squared )error matrix produced by the pattern matching operation . 3 The received matrix has the samesize of the rules matrix . The Decision block compute the sum of errors for each Basic Block (2x2for DoS and U2R, 2x3 for R2L) of the mean squired 4 ( squared ) error matrix . If the sum wereequal or less than the threshold value , the Decision 5 ( Decision ) block alarm an attack case andsend 6 ( a , the ) signal to the Classifier and Gates blocks . The threshold value computed as thebetter weight gives the better detection rate . The values computed by testing the whole 1500 testrecords . The threshold values for the three attacks classes were much closed and approachedfrom 0.02 vales 7 ( values, valves ) as shown in Fig. (3.16). Gate block control the passing of theRules and Under-test matrices . When the signal received from the Decision 8 ( Decision ) block ,the Gate block interrupt the flow of the Rules matrices and reset their counter to the initial state torestart them from the beginning with other Under-test matrix 9 ( another Under-test matrix, otherUnder-test matrices ) . If the signal not received , the flow continue 10 ( continues ) until thefifth Rules matrix , which is the last one. 11 Then , it tack the next Under-test matrix and resetthe counter of the Rules matrices . The Classifier block receive 12 ( receives ) the signal from the Decision 13 ( Decision ) block then it send to the Display block the class of the attack according tofrom which Decision block the signal received and count the number of the attacks . The Displayblock report the result and export them to 14 ( the , a ) text file .

Writing issues in this paragraph:1 Incorrect verb form instead of participle2 Possibly confused word: squired3 Missing subject4 Possibly confused word: squired5 Incorrect verb form instead of participle6 Missing article7 Possibly confused word: vales8 Incorrect verb form instead of participle9 Other with singular noun10 Incorrect verb form with singular subject11 Missing subject12 Incorrect verb form with singular subject13 Incorrect verb form instead of participle14 Missing article