# Reducing the False Negative Rate in Deep Learning Based Network Intrusion Detection Systems
## 6 Results
### Results of the NSL-KDD Experiments  
The results which were obtained in the 4 binary experiments done on the NSL-KDD dataset can be seen in Table 20.  
\begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline  & & \multicolumn{8}{c}{**Predicted**} \\ \cline{3-10}  & & **Analysis** & **Backdoor** & **DoS** & **Exploits** & **Fuzzers** & **Generic** & **Normal** & **Reconnaissanse** & **Shellcode** & **Worms** \\ \hline \multirow{6}{*}{
\begin{tabular}{c}  
Observing the table, we can see that the \"NSL-KDD binary--modified distribution\" experiment achieved the best results, with the lowest FPR and FNR. The \"NSL-KDD binary--full features\" experiment achieved the lowest results, which could mean that the initial training and testing subsets distribution was not appropriate. The \"NSL-KDD binary--reduced features\" and the \"NSL-KDD binary--class weights\" experiments achieved more or less similar results, with the fourth one having a slightly lower FNR, which was the goal. On the other hand, the FPR in the \"NSL-KDD binary--class weights\" experiment was higher than in the \"NSL-KDD binary--reduced features\" one, which was expected because there is a trade-off between the false positives and false negatives. Table 21 reports the results obtained in the 4 multiclass experiments with the NSL-KDD dataset. Observing the results in Table 21, we can see that the lowest FNR was reached in the \"NSL-KDD multiclass--class weights\" experiment and the highest in the \"NSL-KDD multiclass--full features\" experiment. In fact, all the evaluation metrics from the \"NSL-KDD multiclass--full features\" experiment show very poor performance, which again might mean that the datasets which were pre-made by the authors need a feature selection when facing the FNR minimization problem. The \"NSL-KDD multiclass--modified distribution\" experiment has slightly higher precision, recall, and F1 score than the \"NSL-KDD multiclass--reduced features\" and the \"NSL-KDD multiclass--class weights\" experiments. Overall, the \"NSL-KDD multiclass--modified distribution\", \"NSL-KDD multiclass--reduced features\", and \"NSL-KDD multiclass--class weights\" experiments all have performance metrics that are >99%, and that can be considered a satisfactory result. When it comes to the specific performance of the classes with a lower number of records, the U2R and R2L classes, the best performance for them was achieved in the \"NSL-KDD multiclass--modified distribution\" experiment. As mentioned earlier, another one of the goals of this research is to increase the detection rates of some specific classes which were shown to have low detection rates in previous works by other authors, as shown in Section 3. For this dataset, the classes that had the lowest detection rates were R2L and U2R, so we report the following performance \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Experiment** & **Training Accuracy** & **Prediction Accuracy** & **Precision** & **Recall** & **F1 Score** & **ROC AUC Score** & **FPR** & **FNR** \\ \hline Full features & 99.77\% & 82.44\% & 93.51\% & 74.32\% & 82.82\% & 83.75\% & 6.82\% & 25.68\% \\ \hline Modified distribution & 99.76\% & 99.72\% & 99.64\% & 99.78\% & 99.71\% & 99.72\% & 0.33\% & 0.22\% \\ \hline Reduced features & 98.94\% & 98.78\% & 98.5\% & 98.97\% & 98.74\% & 98.79\% & 1.4\% & 1.03\% \\ \hline Class weights & 98.32\% & 98.35\% & 97.42\% & 99.2\% & 98.3\% & 98.38\% & 2.44\% & 0.8\% \\ \hline \hline \end{tabular}
\end{table} 
Table 20: Comparison of the results achieved in the NSL-KDD binary classification experiments.