# Resampling Imbalanced Network Intrusion Datasets to Identify Rare Attacks
## 8 Results and Discussion
### Resampling before and after Splitting
#### 8.2.2 Random Undersampling after Stratified Splitting
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Welch’s \(t\)-Test** & \multirow{2}{*}{**Precision (\(\boldsymbol{p<0.10\))**}} & \multirow{2}{*}{**Precision \(\boldsymbol{t\)-Value**}**} & \multirow{2}{*}{**Recall \(\boldsymbol{t\)-Value**}**} & \multirow{2}{*}{**F-Score \(\boldsymbol{t}\)-Value**} & \multicolumn{1}{c}{**Macro Precision**} & \multirow{2}{*}{**Analysis**} \\ \cline{2-5} \cline{6-7}  & & & & & \(t\)-Value & & \(t\)-Value \\ \hline \multirow{3}{*}{0.1 vs. 0.2} & 0.566 & \(-\)0.276 & 0.386 & 0.566 & 0.1 and 0.2 are & statistically equal \\  & 0.1 vs. 0.3 & 0.874 & \(-\)0.706 & 0.442 & 0.874 & 0.1 and 0.3 are & statistically equal \\  & 0.1 vs. 0.4 & 1.805 & 0.07 & 1.702 & 1.806 & precision, F-score, \\  & 0.1 vs. 0.5 & 3.349 & \(-\)0.128 & 3.104 & 3.349 & precision, F-score, \\  & & & & & & and macro precision \\  & 0.1 vs. 0.6 & \(-\)0.084 & \(-\)0.489 & \(-\)0.284 & \(-\)0.084 & 0.1 and 0.6 are & statistically equal \\  & 0.1 vs. 0.7 & 0.684 & \(-\)0.73 & 0.293 & 0.683 & 0.1 and 0.7 are & statistically equal \\  & & & & & & 0.1 better than 0.8 in \\  & 0.1 vs. 0.8 & 1.62 & 0.52 & 1.48 & 1.62 & precision, F-score, \\  & & & & & & and macro precision \\  & 0.1 vs. 0.9 & 1.202 & 2.814 & 2.187 & 1.204 & 0.1 is better than 0.9 \\  & & & & & & in recall and F-score \\  & & & & & & 0.1 is better than 1 in \\  & & & & & & all metrics \\  & & & & & & & except recall \\ \hline \hline \end{tabular}
\end{table} 
Table 18: [PERSON]’s \(t\)-test results: UNSW-NB15: Shellcode—random undersampling after splitting. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**[PERSON]’s \(t\)-Test** & \multirow{2}{*}{**Precision (\(p\) < 0.10)**} & \multirow{2}{*}{**Precision (\(t\)-Value)**} & \multirow{2}{*}{**Recall \(t\)-Value**} & \multirow{2}{*}{**F-Score \(t\)-Value**} & \multirow{2}{*}{**Macro Precision**} & \multirow{2}{*}{**Analysis**} \\ \cline{1  
Results of [PERSON]'s \(t\)-tests for UWF-ZeekData22 Credential Access for Random Undersampling after Splitting (Table 21) are presented in Table 22. Based on the analysis in Table 22, the best results were obtained at 0.5 oversampling for credential access (highlighted in green in Table 21). Again, although there are sampling ratios that are statistically equivalent to 0.5 (as shown in Table 22), 0.5 was chosen as the best since it has the smallest amount of oversampled data, thus taking the least computational time. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Oversampling \%** & \multicolumn{2}{c}{**Accuracy**} & **Precision** & **Recall** & **F-Score** & **Macro Precision** \\ \hline \multirow{3}{*}{0.1} & Avg & 0.999 & 0.822 & 0.878 & 0.833 & 0.911 \\  & SD & NA & 0.176 & 0.116 & 0.112 & 0.088 \\  & Avg & 0.999 & 0.732 & 0.900 & 0.788 & 0.867 \\  & SD & NA & 0.141 & 0.168 & 0.123 & 0.071 \\  & Avg & 0.999 & 0.799 & 0.911 & 0.847 & 0.899 \\  & SD & NA & 0.112 & 0.120 & 0.101 & 0.056 \\  & Avg & 0.999 & 0.744 & 0.911 & 0.804 & 0.872 \\  & SD & NA & 0.162 & 0.097 & 0.100 & 0.081 \\  & Avg & 0.999 & 0.770 & 0.944 & 0.835 & 0.885 \\  & SD & NA & 0.154 & 0.075 & 0.085 & 0.077 \\  & Avg & 0.999 & 0.696 & 0.944 & 0.793 & 0.848 \\  & SD & NA & 0.116 & 0.102 & 0.092 & 0.056 \\  & Avg & 0.999 & 0.713 & 0.922 & 0.793 & 0.857 \\  & SD & NA & 0.155 & 0.122 & 0.116 & 0.0777 \\  & Avg & 0.999 & 0.639 & 0.933 & 0.749 & 0.820 \\  & SD & NA & 0.067 & 0.133 & 0.058 & 0.034 \\  & Avg & 0.999 & 0.722 & 0.922 & 0.800 & 0.861 \\  & SD & NA & 0.110 & 0.100 & 0.052 & 0.055 \\  & Avg & 0.999 & 0.742 & 0.889 & 0.789 & 0.871 \\
1.0 & SD & NA & 0.146 & 0.131 & 0.083 & 0.073 \\  & Averages & 0.999 & 0.7379 & 0.9154 & 0.8031 & 0.8691 \\ \hline \hline \end{tabular}
\end{table} 
Table 22: Welch’s \(t\)-test results: UWF-ZeekData22: credential access—random undersampling after splitting.