# Unsupervised Feature Selection for Outlier Detection on Streaming Data to Enhance Network Security
## 7 Conclusions and Future Work  
In this work we have illuminated the necessity of unsupervised Feature Selection (FS) for Outlier Detection (OD) in Streaming Data (SD) for domains, e.g., intrusion detection, in network security, which are ever-increasingly facing high-volume and high-dimensional data that need to be processed in almost real-time. With the extensive review on FS approaches for either (i) SD or (ii) OD, we have pointed out that, to the best of our knowledge, the proposed Unsupervised Feature Selection for Streaming Outlier Detection, called UFSSOD, is the first method of its kind to fill the research gap by providing a solution bridging (i) and (ii). Two application scenarios of UFSSOD, together with online capable OD methods, are discussed along with UFSSOD's operation and functionality. This also includes the ability to provide the amount of top-performing features by clustering their score values, which is often circumvented in the literature by setting a pre-defined number. Extensive measurements were conducted on 15 real-world datasets by applying multiple feature subsets to six widely accepted off-the-shelf online OD methods obtained from UFSSOD and state-of-the-art competitors FSDS as a representative of (i) and IBFS of (ii). The evaluation examines the alleviation of the negative effect brought by irrelevant features for the outlier detectors, considering both, the classification and computational performance. The discussion of the results pointed out the non-applicability of FSDS for OD because it does not achieve reliable and satisfactory results, independent of its cluster parameter \(k\). In comparison to (offline) IBFS, UFSSOD achieves at least comparable results while operating in an online fashion. It was able to decrease the average runtime of individual classifiers by approximately 12% and improve the \(F1\) by 14% on average. UFSSOD is also evaluated in a true online setting by providing a feature subset inline to xStream for each sample and to \(\text{Loda}_{\text{Two Hist}}\), using a windowed approach. In this setting, applying UFSSOD yields better results than the bare versions of the OD methods operating \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**ID**} & \multicolumn{2}{c}{**xStream**} & \multicolumn{2}{c}{**Loda\({}_{\text{Two Hist}}\)**} \\ \cline{2-5}  & \% \(\text{avg}_{\_}t\) & \% \(\text{F1}\) & \% \(\text{avg}_{\_}t\) & \% \(\text{F1}\) \\ \hline
2 & \(-2.74\) & \(-30.72\) & \(0.49\) & \(-6.41\) \\
5 & \(-2.29\) & \(60.29\) & \(3.18\) & \(-14.37\) \\
6 & \(-42.9\) & \(2638.80\) & \(-36.38\) & \(232.54\) \\
8 & \(-28.4\) & \(-47.85\) & \(-22.22\) & \(305.52\) \\
9 & \(-1.34\) & \(1.50\) & \(1.39\) & \(41.81\) \\
11 & \(-18.75\) & \(34.63\) & \(-15.21\) & \(3.46\) \\
12 & \(-3.19\) & \(111.16\) & \(1.82\) & \(-1.34\) \\
13 & \(-1.70\) & \(22.61\) & \(1.68\) & \(-16.07\) \\
15 & \(-1.15\) & N/A & \(0.29\) & \(16.00\) \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Performance of xStream and \(\text{Loda}_{\text{Two Hist}}\). in terms of the percentage increase/decrease of \(\text{avg}_{\_}t\) and \(F1\) applying UFSSOD in a streaming setting compared to full dimension (N/A for ID 15 since no \(F1\) score could be obtained with full dimension due to poor classification results). on full dimension. For instance, UFSSOD could improve the \(F1\) up to 45% for \(\text{Lodar}_{\text{Two Hist. }}\) while reducing the average runtime by 22% for individual data sets. As assumed, UFSSOD works better if the outliers in the dataset tend to occur in the same features, which is mostly the case, as stated, in the network security domain. Even passing the stress test on datasets that does not meet this presumption, as part of future work, UFSSOD will be thoroughly examined on more domain-specific datasets. Especially, the CSE-CIC-IDS2018 dataset allows to evaluate different types of features (e.g., flow or packet based) and their influence on the performance of UFSSOD.