# Combining Unsupervised Approaches for Near Real-Time Network Traffic Anomaly Detection
## 4 Experiment
### Results  
Below are tables containing the results obtained from the analyzed algorithms for each dataset used for testing (Table 1). Table 2 shows the prediction times measured in milliseconds for each algorithm used to analyze the KDDCUP99 dataset. Table 3 shows the results obtained from the tests performed on the NSL-KDD dataset. Table 4 shows the prediction times measured in milliseconds for each algorithm used to analyze the NSL-KDD dataset. \begin{table}
\begin{tabular}{c c c c c c c c} \hline
**Algorithm** & **Precision** & **Recall** & **F1-Score** & \(\sigma\)**(F1-Score)** & **AUROC** & \(\sigma\)**(AUROC)** & **Accuracy** \\ \hline EC & 0.8221 & 0.8102 & 0.8162 & 0.0026 & 0.8111 & 0.0026 & 0.8413 \\ EIF & 0.9177 & 0.9177 & 0.9177 & 0.0064 & 0.9177 & 0.0064 & 0.9478 \\ DAGMM & 0.9043 & 0.9056 & 0.9050 & 0.0051 & 0.9057 & 0.0051 & **0.9749** \\ DAGMM-EIF & 0.9157 & 0.9158 & 0.9157 & 0.0079 & 0.9158 & 0.0079 & 0.9410 \\ DA & 0.8657 & 0.8657 & 0.8657 & 0.0025 & 0.8657 & 0.0025 & 0.9150 \\ DA-EIF & 0.8914 & 0.8666 & 0.8770 & 0.0020 & 0.8666 & 0.0020 & 0.9234 \\ DSEBM & 0.8617 & 0.8617 & 0.8617 & 0.0021 & 0.8617 & 0.0021 & 0.9125 \\ MemAE & 0.9084 & 0.9084 & 0.9084 & 0.0021 & 0.9084 & 0.0021 & 0.9420 \\ MemAE-EIF & **0.9234** & **0.9219** & **0.9226** & 0.0015 & **0.9219** & 0.0015 & 0.9510 \\ \hline \end{tabular}
\end{table} 
Table 1: Results obtained from testing unsupervised algorithms on the KDDCUP99 dataset. \begin{table}
\begin{tabular}{c c} \hline
**Algorithm** & **Prediction Time** \\ \hline EC & 1187.610 \\ EIF & 274.780 \\ DAGMM & **2.810** \\ DAGMM-EIF & 211.670 \\ DA & 10.145 \\ DA-EIF & 451.557 \\ DSEBM & 13.620 \\ MemAE & 12.481 \\ MemAE-EIF & 527.001 \\ \hline \end{tabular}
\end{table} 
Table 2: Prediction times for analyzing 1000 records of the KDDCUP99 dataset. Times shown in the table are measured in milliseconds. \begin{table}
\begin{tabular}{c c c c c c c c} \hline
**Algorithm** & **Precision** & **Recall** & **F1-Score** & \(\sigma\)**(F1-Score)** & **AUROC** & \(\sigma\)**(AUROC)** & **Accuracy** \\ \hline EC & 0.8635 & 0.8588 & 0.8602 & 0.1326 & 0.8588 & 0.1326 & 0.8617 \\ EIF & 0.9120 & 0.9120 & 0.9120 & 0.1530 & 0.9120 & 0.1530 & 0.9124 \\ DAGMM & 0.8845 & 0.8845 & 0.8845 & 0.0520 & 0.8845 & 0.0511 & 0.8851 \\ DAGMM-EIF & 0.9045 & 0.9045 & 0.9045 & 0.1307 & 0.9045 & 0.1307 & 0.9050 \\ DA & 0.8905 & 0.8905 & 0.8905 & 0.1770 & 0.8905 & 0.1770 & 0.8910 \\ DA-EIF & 0.9113 & 0.9113 & 0.9113 & 0.1423 & 0.9114 & 0.1392 & 0.9118 \\ DSEBM & 0.8698 & 0.8698 & 0.8698 & 0.1781 & 0.8698 & 0.1781 & 0.8704 \\ MemAE & 0.9118 & 0.9118 & 0.9118 & 0.1684 & 0.9118 & 0.1684 & 0.9122 \\ MemAE-EIF & **0.9172** & **0.9172** & **0.9172** & 0.1275 & **0.9172** & 0.1271 & **0.9175** \\ \hline \end{tabular}
\end{table} 
Table 3: Results obtained from testing unsupervised algorithms on the NSL-KDD datasetTable 5 shows the results obtained from the tests performed on the CIC-IDS2017 dataset. Table 6 shows the prediction times measured in milliseconds for each algorithm used to analyze the CIC-IDS2017 dataset. The results obtained show that the MemAE-EIF algorithm achieves the best performance in terms of accuracy and F1-score for all the datasets examined. A high precision rate is equivalent to a low number of false positives, which are false alarms that experts in the field must handle. The new algorithms proposed in this work combine Deep Learning and Unsupervised Learning algorithms to estimate the anomaly score associated with each monitored connection in a network. In detail, Deep Learning algorithms are used to quickly identify suspicious samples, which are subsequently analyzed with the Extended Isolation \begin{table}
\begin{tabular}{c c} \hline \hline
**Algorithm** & **Prediction Time** \\ \hline EC & 12630.730 \\ EIF & 967.554 \\ DAGMM & **2.260** \\ DAGMM-EIF & 454.896 \\ DA & 12.309 \\ DA-EIF & 509.840 \\ DSEBM & 12.090 \\ MemAE & 13.980 \\ MemAE-EIF & 603.199 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Prediction times to analyze 1000 records from the CIC-IDS2017 dataset.