The first cutoff, the principal components that explain 50% of the total variance, is indeed suggested based on the authors' experiments on the KDD CUP 99 dataset. Underneath Table 2 they explain that they tested cutoffs between 30% to 70%, and that 50% achieved the highest detection rate at the lowest false alarm rate.
As far as I can tell, they have not mentioned any reasoning behind choosing eigenvalues less than 0.2 but I suspect that they used a similar method. That is, testing various cutoffs between some range, and choosing the cutoff which gives the best results on this dataset.
Slightly unrelated, but very important if you are doing research in Intrusion Detection: be very careful with the DARPA 1998 and KDD CUP 99 datasets. It has been known for a very long time now that these datasets are inherently flawed, and that techniques cannot be accurately evaluated using them . The NSL-KDD dataset  may be a more reliable evaluation but is still not ideal. Furthermore, there is some interesting debate on the overwhelming use of machine learning and other anomaly detection techniques in intrusion detection research . You might want to read the papers in the reference list for more details.
- McHugh, "Testing Intrusion Detection Systems: A Critique of the 1998 and 1999 DARPA Intrusion Detection System Evaluations as Performed by Lincoln Laboratory"
- Tavallaee et al., "Toward Credible Evaluation of Anomaly-Based Intrusion-Detection Methods"
- Sommer et al, "Outside the Closed World: On Using Machine Learning For Network Intrusion Detection"