Bootstrap and MRCD Estimators in Hotelling’s T² Control Charts for Precise Intrusion Detection

Abstract

Intrusion detection systems (IDS) are crucial in safeguarding network security by identifying unauthorized access attempts through various techniques. Statistical Process Control (SPC), particularly Hotelling’s T² control charts, is noted for monitoring network traffic against known attack patterns or anomaly detection. This research advances the domain by incorporating robust statistical estimators—namely, the Fast-MCD and MRCD (Minimum Regularized Covariance Determinant) estimators—into bootstrap-enhanced Hotelling’s T² control charts. These enhanced charts aim to strengthen detection accuracy by offering improved resistance to outlier contamination, a prevalent challenge in intrusion detection. The methodology emphasizes the MRCD estimator’s robustness in overcoming the limitations of traditional T² charts, especially in environments with a high incidence of outliers. Applying the proposed bootstrap-based robust T² charts to the UNSW-NB15 dataset illustrates a marked enhancement in intrusion detection performance. Results indicate superior performance of the proposed method over conventional T² and Fast-MCD-based T² charts in detection accuracy, even in varied levels of outlier contamination. Despite increasing execution time, the precision and reliability in detecting intrusions present a justified trade-off. The findings underscore the significant potential of integrating robust statistical methods to enhance IDS effectiveness.

1. Introduction

Intrusion detection is a process of monitoring events within a computer system or network, where subsequent analysis of the monitored data is conducted to identify any signs of attempted intrusions. Intrusion refers to attempts to gain unauthorized access to a computer system or network, potentially threatening the availability, integrity, and confidentiality of a computer network system. The system used to perform intrusion detection is known as an intrusion detection system (IDS) [1]. Intrusion detection matches network traffic patterns with known attack patterns or identifies abnormal network traffic patterns [2]. Anomaly-based network intrusion detection systems are generally categorized into knowledge-based systems, computational approaches, and statistical approaches [3]. One statistical methodological approach used in intrusion detection is Statistical Process Control (SPC), which is widely applied across various sectors, including services and industries. SPC can also be applied to intrusion detection systems (IDS), and its conventional use is in monitoring changes within manufacturing and service processes. Recent research has investigated how SPC can detect unauthorized intrusions [4].

Statistical Process Control (SPC) has played a significant role in product quality control since Shewhart [5] introduced the control chart techniques by applying statistical methods to monitor the industrial and manufacturing processes. One of the multivariate control charts to monitor the process mean is Hotelling’s T² control chart [6], which can be used to monitor individual or subgroup observations. In SPC concepts, an outlier can be defined as an observation that significantly deviates from other observations, which indicates that the observation is observed by a different process [7]. Hotelling’s T² chart is unsuitable for detecting the presence of multiple outliers [8] due to the masking and swamping effect [9], especially for highly outlier-contaminated data. The statistic of T², which is based on the classical estimator, is easily affected and decreased by the presence of outliers [10,11]. Moreover, the performance of control charts will decrease if the variables monitored increase [12].

Several methods have been proposed to overcome this problem and minimize the effects of outliers by changing the classical estimator with a robust one, especially for the covariance matrix estimator. The performance of the T² control chart in detecting shifts in the mean could be enhanced by using a robust estimator [13]. Many robust methods have been adopted to develop a T² control chart to minimize the effect of outliers. These methods such as Minimum Volume Ellipsoid (MVE) [14], Trimming Method [15,16], Minimum Vector Variance [17,18], Successive Difference Covariance Matrix (SDCM) [10,19], Minimum Covariance Determinant (MCD) [15,20], Reweighted minimum covariance determinant (RMCD) [21], and Fast Minimum Covariance Determinant (Fast-MCD), whose good performance on monitoring small to medium outlier contaminated data with 30% breakdown point [22]. The latest development of robust estimators is the Minimum Regularized Covariance Determinant (MRCD) method [23], which uses a data-driven algorithm and regularization to avoid overfitting problems. The MRCD estimator can be used to detect outliers in high-dimensional data. Besides the robust estimator, the Hotelling’ T² chart can also be developed using a non-parametric approach as a control limit, namely the bootstrap resampling method [24].

This research focuses on developing bootstrap-based robust T² control charts with MRCD estimators for detecting intrusion. This method will be applied to the UNSW-NB15 dataset. The primary contributions of this research are as follows:

• Development: A novel control chart methodology based on the MRCD estimator is introduced for the identification of anomalous observation. The efficacy of the proposed method is assessed under diverse simulation conditions.
• Application: The developed approach is applied to real-world network intrusion detection scenarios. Comparative performance evaluations with established benchmark methods are conducted.

The rest of this paper is organized as follows: Section 2 presents the related work. In Section 3, the explanation of the proposed chart construction is presented. Section 4 provides the methodology and procedural details of the proposed chart. The application results of the chart for intrusion detection system (IDS) datasets are presented in Section 5. Finally, Section 6 is dedicated to the conclusion and future research.

2. Related Works

The SPC method commonly used in intrusion detection is a multivariate control chart. Ye et al. [25] initiated the use of Markov Chain techniques, T² Hotelling, and chi-square multivariate tests for intrusion detection. Then, Ye et al. [26] proposed a technique based on Hotelling’s T² to detect anomalies associated with counter relationships and mean shifts. Qu, Hariri, and Yousif [27] use the T² Hotelling diagram to detect intrusions on a network called real-time Multivariate Analysis for the Network Attack detection algorithm (MANA) by updating control limits at certain time intervals. Zhang, Zhu, and Jin [28] developed a Support Vector Clustering (SVC) based control diagram with performance results similar to the T² diagram for detecting anomalies in computer networks. Tavallaee et al. [29] apply the Covariance Matrix Sign (CMS) to detecting Denial of Service (DoS) attacks. Sivasamy and Sundan [30] compared the performance of the T² Hotelling control chart with the SVM and TANN methods. They found that Hotelling’s T² accuracy level was high for all attack classes.

Besides Hotelling’s T² chart, Rastogi et al. [31] stated that MEWMA and MCUSUM could be used in intrusion detection. However, intrusion detection data involves many quality characteristics, so MEWMA and MCUSUM are unsuitable. Camacho et al. [32] use PCA based on Multivariate Statistical Process Control (MSPC) to detect intrusions. Ahsan et al. [33] use PCA-based Hotelling’s T², producing more efficient computational time. The use of non-parametric control limits improves performance on the T² control diagram with a Successful Difference Covariance Matrix (SDCM) in the form of Kernel Density Estimation [34] and bootstrap resampling [35]. Then, Ahsan et al. [22] developed robust Hotelling’s T² based on Fast-MCD, which shows better performance in detecting outliers in intrusion detection systems.

3. Material and Methods

3.1. UNSW-NB15 Dataset

The UNSW-NB15 dataset was built using the IXIA PerfectStorm tool at the Australian Centre for Cyber Security (ACCS) by generating a combination of everyday activities and realistic, modern artificial attacks for research purposes related to Network Intrusion Detection Systems (NIDS) [36]. Compared to other NIDS datasets, UNSW-NB15 excels in complexity, referring to patterns of modern network traffic attacks, making it suitable for evaluating intrusion detection systems [37]. The training set of UNSW-NB15 consists of 175,341 records with 38 metric features and record labels, which are normal labels and several intrusion labels presented in

Table 1. Characteristics of UNSW-NB15 dataset.

Label	Number of Records	Percentage
Normal	5000	31.94
Intrusion	119,341	68.06
- Analysis	2000	1.14
- Backdoor	1746	1.00
- DoS	12,264	6.99
- Exploits	33,393	19.04
- Fuzzers	18,184	10.37
- Generic	40,000	22.81
- Reconnaissance	10,491	5.98
- Shellcode	1133	0.65
- Worms	130	0.07
Total	175,341	100.00

.

3.2. Multivariate Hotelling’s T² Control Chart

This section briefly summarizes the classic multivariate Hotelling’s T² control chart. Hotelling’s T² is a multivariate control chart, a generalization of the t-student distribution, that can be used to monitor the process mean. Let ${\mathit{x}}_i$ where $i=1, 2, \dots , n$ are identic and independently random vectors that follow the multivariate normal distribution ${\mathit{x}}_i~N_p(\mu ,\mathit{\Sigma })$. The data structure can be written as $\mathit{X}=\left[\begin{array}{cc}\begin{array}{cc}{\mathit{x}}_1^T& {\mathit{x}}_2^T\end{array}& \begin{array}{cc}\cdots & {\mathit{x}}_n^T\end{array}\end{array}\right]$ with mean vector $\overline{x}={\displaystyle \frac{1}{n}}\sum {\mathit{x}}_i$ and covariance matrix $\mathit{S}={\displaystyle \frac{1}{n-1}}\sum \left(x_i-\overline{x}\right){\left(x_i-\overline{x}\right)}^T$. The $T_i^2$ statistics can be calculated as follows [6]:

$$T_i^2=({\mathit{x}}_i-\overline{\mathit{x}})\prime {\mathbf{S}}^{-1}({\mathit{x}}_i-\overline{\mathit{x}})$$

(1)

Conventional Hotelling’s T² chart follows the assumption of multivariate normal distribution [38], so the control limit can be generated by following F-distribution with the following equation:

$$CL={\displaystyle \frac{p(n+1)(n-1)}{n^2-np}}{F}_{\alpha ;p;n-p}$$

(2)

where n is the total number of observations and p is the variable quantity, with α is the false alarm rate. The monitoring process is considered controlled if T² statistics are not greater than the control limit.

3.3. Bootstrap Control Limit-Based T² Chart

In some cases, a random variable might not follow any certain distributions. The bootstrap method is applied to overcome this problem and estimate the unknown distribution parameter [39,40]. Despite initially being proposed based on classic T² statistics [24], this control limit can also be adopted in the proposed chart by putting robust statistics in the first step. The algorithm of bootstrap control limit calculation (see Figure 1 for illustration) is presented in Algorithm 1 as follows:

Algorithm 1 Of Bootstrap Control Limit

Step 1. Compute the statistic T2 with n observations. Step 2. Generate B times bootstrap samples from statistic T2 for n observations with replacement (e.g., B = 1000). Step 3. Step 3. Calculate 100(1 − α).th percentile for each bootstrap resample for statistic $T^{2\left(l\right)}$; $l=1, 2, \dots , n$ Step 4. Determine the bootstrap control limit by averaging each replication using ${CL}_B={\displaystyle \frac{1}{B}}{\displaystyle \sum _{i=1}^B}{T^2}_{100(1-\mathsf{\alpha })}^{\left(l\right)}$

3.4. MRCD Algorithm

The Minimum Covariance Determinant (MCD) based method is one of the most extensively employed robust multivariate location and scatter estimators. This method is designed to determine ${\mathit{H}}_{MCD}$, defined as a subset with the smallest sample covariance determinant. The MCD estimates for the mean vector and covariance matrix correspond to the mean vector and covariance matrix of ${\mathit{H}}_{MCD}$. Define h as the subset size, where ${\displaystyle \frac{n}{2}}\le h<n$ and $h\ge p$ must be fulfilled; otherwise, the covariance matrix derived from the MCD method would become singular. The MCD algorithm calculates every subset possible, as many as $\left(\begin{array}{c}n\\ h\end{array}\right)$ possible combinations, in order to obtain ${\mathit{H}}_{MCD}$. Therefore, this method is time-consuming and not suitable for estimating large datasets.

Minimum Regularized Covariance Determinant (MRCD) estimators are proposed [23] as the extension of MCD. The MRCD is a robust estimator that uses various combinations of target matrix and regularization weight determined through data-driven procedures. The application of the MRCD estimator is robust and well-suited for handling outliers in datasets with high dimensions.

Let $\mathit{X}=\left\{{\mathit{x}}_1, {\mathit{x}}_2, \dots , {\mathit{x}}_i,\dots ,{\mathit{x}}_n\right\}\prime$, where ${\mathit{x}}_i=\left\{x_{i1}, x_{i2}, \dots ,x_{ip}\right\}\prime$ from a p-variate observations. First, the data must be standardized using the Qn estimator [41] and these values must be put in a diagonal matrix ${\mathit{D}}_X$. The median of each variable also needs to be computed and put in a location vector ${\mathit{v}}_X$. The standardized observations are then stated on U that constructed under a set of ${\mathit{u}}_{\mathit{i}}$ as follows:

$${\mathit{u}}_i={\mathit{D}}_X^{-1}\left({\mathit{x}}_i-{\mathit{v}}_X\right)$$

(3)

The next step is defining the target matrix (T) and scalar regularization parameter $\left(\rho \right)$. T is a $p\times p$ diagonal matrix that consists of estimated univariate scales, while $\rho$ is a weighted parameter that can be obtained by a data-driven approach that satisfies $0\le \rho \le 1$. Then, define $h\times p$ covariance matrix $\mathit{K}\left(H\right)$ of h-subset of H on the standardized data U as follows:

$$\mathit{K}\left(H\right)=\rho \mathit{T}+\left(1-\rho \right)c_{\gamma }{\mathit{S}}_{\mathit{U}}\left(H\right)$$

(4)

where ${\mathit{S}}_{\mathit{U}}\left(H\right)$ is the covariance matrix of the h-subset for U and $c_{\gamma }$ is the consistency factor [42].

Mathematical operation (7) can be done by a spectral decomposition $\mathbf{T}=\mathbf{Q}\mathit{\lambda }\mathbf{Q}\prime$ where $\mathsf{\lambda }$ represents the diagonal matrix encompassing the eigenvalues of T, while Q denotes the orthogonal matrix comprising the corresponding eigenvectors. The previous equation can be rewritten as follows:

$$\mathit{K}\left(H\right)=\mathit{Q}{\mathit{\lambda }}^{1/2}\left[\rho \mathit{I}+\left(1-\rho \right)c_{\alpha }{\mathit{S}}_{\mathit{W}}\left(H\right)\right]{\mathit{\lambda }}^{1/2}\mathit{Q}\prime$$

(5)

where W contains the transformation of standardized observations ${\mathit{w}}_i={\mathit{\lambda }}^{1/2}\mathbf{Q}\prime {\mathit{u}}_i$. Consequently, it follows ${\mathit{S}}_{\mathit{W}}\left(H\right)={\mathit{\lambda }}^{-1/2}\mathbf{Q}\prime {\mathit{S}}_{\mathit{U}}\left(H\right)\mathbf{Q}{\mathit{\lambda }}^{-1/2}$.

The subset MRCD ${\mathit{H}}_{MCD}$ is obtained by minimizing the determinant of the regularized covariance matrix K(H) as:

$$\begin{gathered} {\mathit{H}}_{MRCD}=\underset{H\in \mathsf{\Omega }}{\mathrm{argmin}}\left(\mathrm{d}\mathrm{e}\mathrm{t}\left(\mathit{K}\left(H\right)\right)\right) \\ {\mathit{H}}_{MRCD}=\underset{H\in \mathsf{\Omega }}{\mathrm{a}\mathrm{r}\mathrm{g}\mathrm{m}\mathrm{i}\mathrm{n}}\left(\det \left(\rho \mathbf{I}+\left(1-\rho \right)c_{\alpha }{\mathit{S}}_{\mathit{W}}\left(H\right)\right)\right) \end{gathered}$$

(6)

Once the ${\mathit{H}}_{MRCD}$ is determined, then the location and scatters of the MRCD estimator can be defined as:

$$\stackrel{’}{{\overline{\mathit{x}}}_{MRCD}}={\mathit{v}}_X+{\mathit{D}}_{\mathit{X}}{\overline{\mathit{H}}}_{MRCD}$$

(7)

$${\mathit{S}}_{MRCD}={\mathit{D}}_{\mathit{X}}\mathbf{Q}{\mathit{\lambda }}^{1/2}\left[\rho \mathbf{I}+\left(1-\rho \right)c_{\alpha }{\mathit{S}}_{\mathit{W}}\left({\mathit{H}}_{MRCD}\right)\right]{\mathit{\lambda }}^{1/2}\mathbf{Q}\prime {\mathit{D}}_{\mathit{X}}$$

(8)

3.5. MRCD-Based T² Chart

In order to develop the robust T² control chart, this study exchanges the classic estimators of mean vectors $\overline{\mathit{x}}$ and covariance matrix $\mathit{S}$ from Equation (1) with the estimated values obtained of mean vector and covariance matrix from robust estimators. Robust T² statistic based on MRCD was constructed as follows:

$$T_{MRCD;i}^2=({\mathit{x}}_i-{\overline{\mathit{x}}}_{MRCD})\prime {\mathbf{S}}_{MRCD}^{-1}({\mathit{x}}_i-{\overline{\mathit{x}}}_{MRCD})$$

(9)

Due to the unknown distribution of the proposed chart, its control limit for both charts is estimated using the bootstrap resampling method to develop an adaptive control chart. The detailed procedure for the control limit is presented in the previous subsection.

4. Methodology

Two phases are required to be undertaken in developing the proposed robust T² chart based on the MRCD estimator. Phase I is building a typical profile from the in-control, while Phase II detects intrusion using the calculated statistics and control limit from Phase II. Phase I must calculate the mean vector, covariance matrix, and bootstrap control limit. The procedure of Phase I is shown as following these steps:

Phase I: Normal Profile Construction Step 1. Form the in-control or normal data matrix ${\mathit{X}}_{normal}$ Step 2. Calculate ${\overline{\mathit{x}}}_{MRCD}$ and ${\mathit{S}}_{MRCD}$, which are the robust estimated values of normal data ${\mathit{X}}_{normal}$ using the MRCD algorithm in Equations (7) and (8) Step 3. Calculate $T_{MRCD;i}^2$ using Equation (9) from normal data ${\mathit{X}}_{normal}$ Step 4. Determine $\alpha$ and compute the bootstrap control limit ${CL}_{B;MRCD}$

Then, the estimated normal profile and control limit from Phase I are utilized for the Phase II detection process. The steps of Phase II are shown as follows:

Phase II: Detection Step 1. Form a new data matrix ${\mathit{X}}_{test}$ Step 2. Calculate $T_{MRCD;i}^2$ from new data ${\mathit{X}}_{normal}$ as follows: $T_{MRCD;i}^2{=\left({\mathit{x}}_{test;i}-{\overline{\mathit{x}}}_{MRCD}\right)}^T{\mathbf{S}}_{MRCD}^{-1}\left({\mathit{x}}_{test;i}-{\overline{\mathit{x}}}_{MRCD}\right)$ where ${\overline{\mathit{x}}}_{MRCD}$ and ${\mathit{S}}_{MRCD}$ are taken from Phase I Step 3. Detect if $T_{MRCD;i}^2>{CL}_{B;MRCD}$ then the observation is labeled as an intrusion, and if $T_{MRCD;i}^2\le {CL}_{B;MRCD}$ then the observation is labeled as normal

Moreover, the evaluation of the proposed system can be conducted using the confusion matrix presented in

Table 2. Confusion Matrix Table.

Actual	Detection
	Intrusion	Normal
Intrusion	True Positives (TPs)	False Negatives (FNs)
Normal	False Positives (FPs)	True Negatives (TNs)

. The assessment of classification effectiveness is determined by the degree of goodness and degree of error. In the context of intrusion detection, goodness is categorized into two types:

a.

True Positives (TPs) are intrusion records that are successfully detected as intrusions.

b.

True Negatives (TNs) are normal records that are correctly stated as normal.

The errors in detecting intrusion also can be divided into two types:

a.

False Positives (FPs) are normal records that are incorrectly detected as intrusions.

b.

False Negatives (FNs) are intrusion records that are unsuccessfully detected as normal.

FPs led to a false alarm, while FNs result in undetected chart intrusions. These error types can be used to calculate the degree of error, namely FP Rate and FN Rate [43]. The level of goodness can be measured using the Area Under Curves (AUC) as follows [44]:

$$AUC={\displaystyle \frac{1}{2}}\left({\displaystyle \frac{TP}{TP+FN}}+{\displaystyle \frac{TN}{TN+FP}}\right)$$

(10)

$$FP Rate={\displaystyle \frac{FP}{TN+FP}}$$

(11)

$$FN Rate={\displaystyle \frac{FN}{TP+FN}}$$

(12)

5. Results and Discussions

5.1. Simulation Study

Performance evaluation of control charts can be done by conducting a simulation study of outlier detection. The outlier detection method is carried out by simulating 1000 generated data containing outlier proportions ranging from 5%, 10%, 20%, 30%, 40%, and 50%, with the criteria being normal data ${\mathit{X}}_{normal}~N_p\left(\mathbf{0},\mathbf{I}\right)$ and outlier data ${\mathit{X}}_{out}~N_p\left(\mathbf{3},\mathbf{I}\right)$ as implemented to detect small outliers [22]. The number of variables generated is also regulated under several conditions, namely $p=5, p=10, p=20, p=30, p=40, \mathrm{a}\mathrm{n}\mathrm{d} p=50$. The performance evaluation encompassed three types of multivariate charts, specifically the conventional Hotelling’s T², the robust Hotelling’s T² based on Fast-MCD, and the robust Hotelling’s T² based on MRCD as proposed.

Outlier detection in conventional Hotelling’s T² control charts is carried out with detailed results obtained in

Table 3. Performance. Simulation of Conventional Hotelling’s T² Charts.

p	%Out	T2-Conventional
		Accuracy	AUC	FP Rate	FN Rate
5	5	0.978	0.833	0.006	0.327
	10	0.914	0.595	0.007	0.804
	20	0.801	0.513	0.007	0.967
	30	0.701	0.506	0.007	0.982
	40	0.600	0.502	0.007	0.988
	50	0.500	0.500	0.007	0.992
10	5	0.972	0.782	0.006	0.430
	10	0.905	0.553	0.006	0.888
	20	0.800	0.510	0.007	0.972
	30	0.699	0.504	0.007	0.985
	40	0.599	0.501	0.007	0.991
	50	0.500	0.500	0.007	0.991
20	5	0.963	0.685	0.006	0.624
	10	0.901	0.529	0.007	0.936
	20	0.798	0.506	0.007	0.981
	30	0.699	0.502	0.007	0.988
	40	0.599	0.501	0.007	0.992
	50	0.500	0.500	0.007	0.991
30	5	0.939	0.509	0.013	0.970
	10	0.892	0.508	0.012	0.972
	20	0.794	0.505	0.013	0.978
	30	0.699	0.503	0.007	0.988
	40	0.599	0.501	0.007	0.991
	50	0.500	0.500	0.007	0.991
40	5	0.954	0.596	0.007	0.801
	10	0.899	0.520	0.007	0.954
	20	0.798	0.505	0.006	0.983
	30	0.698	0.502	0.007	0.989
	40	0.599	0.501	0.007	0.991
	50	0.501	0.501	0.008	0.991
50	5	0.952	0.576	0.006	0.841
	10	0.897	0.514	0.007	0.966
	20	0.797	0.504	0.007	0.986
	30	0.699	0.503	0.007	0.988
	40	0.599	0.501	0.007	0.991
	50	0.500	0.500	0.008	0.993

. Table 3 shows the performance of Accuracy, AUC, FP rate, and FP rate of Hotelling’s T² control charts with bootstrap control limits in detecting outliers for each number of variables and various percentages of outliers added according to the procedures. Regarding performance, the conventional T² charts only work pretty well with an AUC of more than 0.75 and an FN Rate of less than 0.5 on data with a 5% outlier percentage for low dimensions ($p=5$) and medium dimension ($p=10$). In contrast, performance decreases drastically in high dimensional data ($p=30, 40, 50$). In addition, data with outlier percentages of 10%, 20%, 30%, 40%, and 50% for any dimension all indicate poor performance.

Then, the outlier detection in robust Fast-MCD-based Hotelling’s T² control charts is carried out, and detailed results are obtained in

Table 4. Performance. Simulation of Robust Fast-MCD-Based T² Charts.

p	%Out	T2-FMCD
		Accuracy	AUC	FP Rate	FN Rate
5	5	0.994	0.996	0.007	0.001
	10	0.994	0.996	0.007	0.002
	20	0.994	0.996	0.007	0.001
	30	0.995	0.996	0.007	0.001
	40	0.995	0.995	0.007	0.001
	50	0.500	0.500	0.007	0.992
10	5	0.994	0.997	0.007	0.000
	10	0.994	0.997	0.007	0.000
	20	0.995	0.997	0.007	0.000
	30	0.995	0.997	0.007	0.000
	40	0.861	0.828	0.007	0.337
	50	0.500	0.500	0.007	0.991
20	5	0.994	0.997	0.006	0.000
	10	0.994	0.997	0.007	0.000
	20	0.994	0.996	0.007	0.000
	30	0.799	0.670	0.007	0.653
	40	0.599	0.500	0.008	0.992
	50	0.500	0.500	0.007	0.991
30	5	0.994	0.997	0.007	0.000
	10	0.994	0.997	0.007	0.000
	20	0.985	0.972	0.007	0.049
	30	0.702	0.508	0.007	0.978
	40	0.599	0.501	0.007	0.991
	50	0.500	0.500	0.007	0.992
40	5	0.994	0.997	0.007	0.000
	10	0.994	0.997	0.007	0.000
	20	0.886	0.726	0.007	0.541
	30	0.698	0.502	0.007	0.989
	40	0.600	0.502	0.007	0.989
	50	0.501	0.501	0.007	0.990
50	5	0.994	0.997	0.006	0.000
	10	0.994	0.997	0.007	0.000
	20	0.805	0.524	0.007	0.946
	30	0.699	0.503	0.007	0.988
	40	0.599	0.501	0.007	0.991
	50	0.500	0.500	0.008	0.991

. Table 4 presents the performance of Accuracy, AUC, FP rate, and FP rate of robust Fast-MCD-based Hotelling’s T² control charts with bootstrap control limits in detecting outliers for each number of variables and various percentages of outliers added according to the procedures before.

Based on the outlier detection, detailed results are obtained in Table 4. In terms of performance, robust Fast-MCD based Hotelling’s T² control charts work very well for conditions of low-dimensional ($p=5$) and medium dimensions ($p=10$) data, which is indicated by an AUC of more than 0.99 and an FN Rate below 0.01. The same good results can still be achieved in high dimensional conditions, but only at outlier percentages of 5% and 10%. Meanwhile, in high-dimensional data, the outlier percentage is more than 10%, and there is a drastic decrease in performance, where the AUC value is around 0.5, and the FN Rate is above 0.97. This constraint is based on previous research stating that the greater the observed quality characteristics, the lower the performance of the T² charts. This limitation also applies to the robust Fast-MCD estimator and cannot be resolved entirely.

Finally, the outlier detection in robust MRCD-based Hotelling’s T² control charts is carried out, and detailed results are obtained in

Table 5. Performance. Simulation of Robust MRCD-Based T² Charts.

p	%Out	T2-MRCD
		Accuracy	AUC	FP Rate	FN Rate
5	5	0.994	0.996	0.006	0.002
	10	0.994	0.995	0.007	0.003
	20	0.994	0.996	0.007	0.001
	30	0.994	0.996	0.007	0.002
	40	0.643	0.556	0.007	0.882
	50	0.500	0.500	0.007	0.992
10	5	0.994	0.997	0.006	0.000
	10	0.994	0.997	0.006	0.000
	20	0.995	0.997	0.007	0.000
	30	0.995	0.996	0.007	0.000
	40	0.853	0.818	0.007	0.357
	50	0.500	0.500	0.007	0.991
20	5	0.994	0.997	0.007	0.000
	10	0.994	0.997	0.007	0.000
	20	0.994	0.997	0.007	0.000
	30	0.995	0.996	0.007	0.000
	40	0.964	0.957	0.007	0.079
	50	0.500	0.500	0.007	0.992
30	5	0.994	0.997	0.006	0.000
	10	0.994	0.997	0.007	0.000
	20	0.995	0.997	0.007	0.000
	30	0.995	0.996	0.007	0.000
	40	0.762	0.704	0.007	0.585
	50	0.500	0.500	0.007	0.992
40	5	0.994	0.997	0.007	0.000
	10	0.994	0.997	0.007	0.000
	20	0.995	0.996	0.007	0.000
	30	0.995	0.997	0.007	0.000
	40	0.692	0.617	0.007	0.760
	50	0.501	0.501	0.008	0.991
50	5	0.994	0.997	0.007	0.000
	10	0.994	0.997	0.007	0.000
	20	0.995	0.997	0.007	0.000
	30	0.995	0.997	0.007	0.000
	40	0.810	0.764	0.007	0.464
	50	0.501	0.501	0.008	0.991

. Table 5 presents the performance of Accuracy, AUC, FP rate, and FP rate of robust MRCD-based Hotelling’s T² control charts with bootstrap control limits in detecting outliers for each number of variables and various percentages of outliers added according to the procedures before. Based on the outlier detection, detailed results are obtained in Table 5. In terms of performance, the robust MRCD-based Hotelling’s T² control charts work very well for almost all conditions, as shown by an AUC of more than 0.99 and an FN Rate of below 0.01. This diagram only experiences problems: all data with an outlier percentage of 50% and a slight decrease in data with an outlier percentage of 40%. Besides $p=5$ and $p=40$, at 40%, the outlier percentage still has a pretty good AUC in the 70–90%. The FN Rate is not too high, namely 0.3–0.5. The absence of a decrease in performance when the quality characteristics increase indicates that robust MRCD-based Hotelling’s T² control charts can show consistent performance when used on high-dimensional data.

The performance results of each diagram in detecting outliers were shown and explained. These results can be compared to find out which diagram has the best performance in detecting outliers in various conditions. The following is a visualization of the chart’s performance comparison.

Figure 2 shows the AUC values for all diagrams based on the number of variables where Hotelling’s T² charts perform poorly in almost all scenarios. Fast-MCD-based T² charts can work very well in low dimensional data scenarios where $p\le 10$, but when the variables increase, the performance will decrease. Meanwhile, the MRCD-based T² charts can overcome the weaknesses of previous diagrams where the proposed diagram can consistently deal with high-dimensional data conditions to reach $p=50$.

To illustrate the comparative performance of the three methods, visual representations for $p=5, 20, 50$ are presented in Figure 3, Figure 4 and Figure 5. A representative scenario, considered a potential outlier breakpoint, namely $p=20,$ with a 30% proportion of outliers. Figure 4 shows that the MRCD-based T² charts can detect outliers well, while the conventional T² and Fast-MCD-based T² charts are less effective in identifying and detecting outliers.

5.2. Illustration for IDS on UNSW-NB15 Dataset

The data application is conducted through three methods: conventional Hotelling’s T², robust T² based on Fast-MCD, and the proposed diagram, which is the robust T² based on MRCD. The construction of the control chart is divided into two phases: Phase I for establishing control limits and Phase II for the detection process and calculating the performance of the control chart. In the conventional Hotelling’s T² control chart, the T² statistic is calculated using Equation (1), with control limits determined based on the significance level using the criteria of the highest AUC value, which is α = 6%, as depicted in Figure 6a. The control chart can be visualized after computing the statistics and establishing control limits, as shown in Figure 6b.

The statistical plot depicted in Figure 6 shows two types of data labels: green for normal data and red for intrusion data. These statistics will be tested against the control limits. If the value of the statistic T² > ${CL}_B$, the observation is detected as an intrusion. If the statistic T² ≤ ${CL}_B$, the observation is detected as normal. Based on the labels and the detection outcomes obtained, a confusion matrix table can be formed. Visualization in the form of an ROC Curve can also be generated, as shown in Figure 6c, which can subsequently be used for calculating the AUC value. A confusion matrix and AUC value can be seen in

Table 6. Confusion Matrix and Performance Evaluation for Conventional Hotelling’s T² Chart.

Actual	Detection		Accuracy	AUC	FP Rate	FN Rate
	Intrusion	Normal
Intrusion	9853	109,488	0.376	0.511	0.060	0.917
Normal	3354	52,646

.

Based on Table 6, it can be seen that the performance of conventional Hotelling’s T² on UNSW-NB15 data is not good, where the AUC value obtained is only 0.511. Then, with an FP Rate of 0.060, a very high FN rate is obtained, namely, 0.917.

Next, in the construction of a control chart for Robust T² based on Fast-MCD, the T² statistic is calculated, and the control limits are determined based on the significance level using the criteria of the highest AUC value, which is α = 25%, as depicted in Figure 7a. The control chart can be visualized after computing the statistics and establishing the control limits, as seen in Figure 7b.

Based on the figure, the statistical plot depicts two types of data labels: green for normal data and red for intrusion data. These statistics will be tested against the control limits. If the value of the statistic T²_FMCD > ${CL}_B$, the observation is detected as an intrusion. If the statistic T²_FMCD ≤ ${CL}_B$, the observation is normal. Based on the labels and the detection outcomes obtained, a confusion matrix table can be formed. Visualization in the form of an ROC Curve can also be generated, as shown in Figure 7c, which can subsequently be used for calculating the AUC value. A confusion matrix and AUC value can be seen in

Table 7. Confusion Matrix and Performance Evaluation for Fast-MCD-based T² Chart.

Actual	Detection		Accuracy	AUC	FP Rate	FN Rate
	Intrusion	Normal
Intrusion	81,871	37,470	0.711	0.718	0.250	0.314
Normal	13,991	42,009

. Table 7 shows that the performance of Robust T² based on Fast-MCD on the UNSW-NB15 data is quite good, with an AUC value of 0.718. Additionally, with an FP rate of 0.25, there is a relatively low FN rate of 0.314.

For constructing the proposed chart of Robust T² based on MRCD, the T² statistic is calculated, and the control limits are determined based on the significance level using the criteria of the highest AUC value, α = 30%, as depicted in Figure 8a. The control chart can be visualized after computing the statistics and establishing control limits, as shown in Figure 8b.

The statistical plot depicted in Figure 8 shows two types of data labels: green for normal data and red for intrusion data. These statistics will be tested against the control limits. If the value of the statistic T²_MRCD > ${CL}_B$, the observation is detected as an intrusion. If the statistic T²_MRCD ≤ ${CL}_B$, the observation is normal. Based on the labels and the detection outcomes obtained, a confusion matrix table can be formed. Visualization in the form of an ROC Curve can also be generated, as shown in Figure 8c, which can be used subsequently for calculating the AUC value. A confusion matrix and AUC value can be seen in

Table 8. Confusion Matrix and Performance Evaluation for MRCD-based T² Chart.

Actual	Detection		Accuracy	AUC	FP Rate	FN Rate
	Intrusion	Normal
Intrusion	118,915	426	0.902	0.849	0.298	0.004
Normal	16,671	39,329

. Based on Table 8, it is apparent that the performance of Robust T² based on MRCD on the UNSW-NB15 data is excellent, with an AUC value of 0.849. Additionally, with an FP Rate of 0.298, there is a shallow FN rate of only 0.004.

After applying the UNSW-NB15 data using these three methods, the performance of each chart can be compared by the shape of the ROC Curve in Figure 9. MRCD-based T² has a larger area; therefore, it has better performance than the other methods, which have a smaller area. The performance of each chart also can be compared and evaluated based on several goodness and error criteria, as presented in

Table 9. Confusion Matrix and Performance Evaluation for MRCD-based T² Chart.

Control Chart	Accuracy	AUC	FP Rate	FN Rate	Execution Time (s)
Conventional T2	0.376	0.511	0.060	0.917	286
T2 Fast-MCD	0.711	0.718	0.250	0.314	1470
Proposed T2 MRCD	0.902	0.849	0.298	0.004	8108

.

Table 9 displays the accuracy, AUC, FP rate, FN rate, and execution time of the three methods used in this study. The conventional T² method, with its straightforward steps, took only 286 s. The Fast-MCD-based T² method, known for its efficiency, required 1470 s. Meanwhile, the MRCD-based T², which features a complex algorithm, took a longer time of 8108 s.

The duration of execution time correlates with the quality of the chart’s performance in detecting intrusions. Based on the AUC values, the conventional T² Hotelling chart showed poor performance in intrusion detection, achieving an AUC of only 0.511. Both robust T² charts demonstrated better performance than the conventional T². The Fast-MCD-based T² had a relatively good AUC value of 0.718. On the other hand, the proposed MRCD-based T² had the best performance, with the highest AUC value of 0.849 and a shallow FN Rate of 0.004, indicating a meager chance of undetected intrusions.

Table 10. Comparison of MRCD-based T² Chart with the other algorithms.

Methods	Accuracy	FP Rate
Decision Tree [45]	0.8556	0.1578
Logistic Regression [46]	0.8315	0.1848
Naïve Bayes [47]	0.8207	0.1856
ANN [46]	0.8134	0.2113
Proposed T2 MRCD	0.9021	0.2980

summarizes the comparative performance of the proposed MRCD-based T² chart with existing algorithms. While the proposed method exhibits the highest accuracy, it also generates a relatively high false positive rate. This suggests a potential trade-off between detection accuracy and the number of non-anomalous events flagged as anomalies. Further investigation is warranted to explore methods for reducing the false positive rate while maintaining high detection accuracy. Additionally, the computational cost of the proposed method should be evaluated to assess its suitability for real-time applications.

The empirical results presented in this study collectively underscore the effectiveness of the proposed approach in accurately identifying network intrusions. This capability positions the methodology as a promising asset for bolstering overall cybersecurity defenses. A key advantage of the proposed framework is its computational efficiency, a direct consequence of the underlying multivariate chart structure. This efficiency enables the model to adapt swiftly to the evolving nature of network traffic, a critical attribute for contemporary intrusion detection systems operating in dynamic and complex digital landscapes.

6. Conclusions and Future Research

The simulation performance evaluation revealed that the conventional T² Hotelling performed effectively only under low dimensionality and a minimal percentage of outliers. On the other hand, Fast-MCD-based T² Hotelling demonstrated improved performance, particularly in managing a high percentage of low-dimensional data; however, its effectiveness decreased as the number of variables increased. In contrast, MRCD-based T² Hotelling consistently outperformed the above charts, exhibiting superior performance across all simulated conditions. The application of the UNSW-NB15 data revealed that the MRCD-based T² Hotelling exhibited better performance in detecting intrusion, with a 0.902 Accuracy and 0.848 AUC value. This proposed chart successfully outperformed the conventional T² Hotelling and the Fast-MCD-based T² Hotelling, which had AUC values of 0.511 and 0.718, respectively, despite the longer execution time. In addition, compared to the other algorithms, the proposed chart exhibits higher accuracy while producing higher false alarms.

This proposed chart can still be modified for further research by applying another non-parametric approach as the control limit. Applying an MRCD estimator for monitoring processes for variance shifts or simultaneous shifts in mean and variance can also be constructed. The latest robust estimator, Cellwise MCD [48], known for its efficiency, can be considered for implementation to overcome the MRCD’s problem in terms of the long execution time.