# A Local Feature Engineering Strategy to Improve Network Anomaly Detection +
## 5 Proposed Strategy
### Feature Engineering  
The addition of new features that characterizes the proposed LFE strategy falls into the literature background as a _feature engineering process_. Feature engineering is defined as a process aimed to improve the performance of a predictive model by exploiting the transformation of the original feature  
Figure 5: LFE high-level architecture. The classifier \(clf\) model training is then performed at Step 4 of Algorithm 1 by using the new data model, whereas the classification of each event in set \(\hat{E}\) is performed at Steps 5-8, and the results returned at Step 9 of the same algorithm. Here, we evaluate the computational complexity related to the proposed LFE strategy, since this provides important information in the context of real-world applications. Such an evaluation was made by analyzing the theoretical complexity of the events classification (Algorithm 1) and the events features transformation (Algorithm 2), as previously formalized. The complexity is expressed according to the _Big_\(O\) notation [96], which is aimed to define the upper bound of an algorithm, since it bounds a function only from above. As a premise, considering that our experiments involve different classification algorithms, and that the proposed strategy has been designed to operate regardless of the adopted algorithm, we do not take into account in this evaluation the classification algorithm complexity [97]. Generalizing as \(n\) the total number of events to process, Table 5 reports the significant steps of Algorithm 1, along with the involved single components complexity, and the final _Big_\(O\) complexity that derives from them. By carrying out a more detailed analysis of the operations involved in Algorithm 1 components, according to the complexity analysis presented in Table 5, we can observe the following. \begin{table}
\begin{tabular}{l l l} \hline \hline
**Input:**\(clf\)=Classifier, \(E\)=Classified events, \(\hat{E}\)=Events to classify, \(\hat{e}\)=Range of discretization \\
**Output:**\(out\)=Classification of events in \(\hat{E}\) \\
**1:**procedure EventsClassification(\(clf\), \(\hat{E}\), \(\hat{E}\)) \\
2:**\(E^{\prime\prime}\leftarrow DataTransformation(E,\hat{e})\) & \(\triangleright\) LFE data transformation \\
3:\(\hat{E}^{\prime\prime}\leftarrow DataTransformation(\hat{E},\hat{e})\) & \(\triangleright\) LFE data transformation \\
4:\(model\leftarrow Classifier\)\(Training(clf,\hat{E}^{\prime\prime})\) & \(\triangleright\) Evaluation model training \\
5:**for each \(\hat{E}^{\prime\prime}\in\hat{E}^{\prime\prime}\)do & \(\triangleright\) Processes all the events in \(\hat{E}\) \\
6:\(c\gets getEventClass(model,\hat{e}^{\prime\prime})\) & \(\triangleright\) Event classification \\
7:\(out.add(c)\) & \(\triangleright\) Stores classified events \\
8:**end for** \\
9:**return \(out\) & \(\triangleright\) Returns classification of event in \(\hat{E}\) \\
10:**end procedure** \\ \hline \hline \end{tabular}
\end{table} 
Table 5: LFE computational complexity. * Steps 2 and 3 of Algorithm 1 are related to the operation performed by Algorithm 2, where, in the main loop, the original feature \(F\) are extracted from the processed event in a constant time \(O(1)\), as well as the addition of the four new features \(m_{1},m_{2},m_{3},m_{4}\), and the storing of the extended feature space. The dominant complexity \(O(n)\) related to the main loop represents the the global complexity of all the involved operations. * Steps 5-8 of Algorithm 1 are related to the loop where the event classification is performed by exploiting the evaluation model trained in Step 4. The dominant complexity of this loop is \(O(n)\), since the storing of the classifications take a constant time \(O(1)\). * The complexity related to the adopted algorithm of classification, training and classification time, is not taken into consideration for the reasons discussed above.