# Combining Unsupervised Approaches for Near Real-Time Network Traffic Anomaly Detection
## 4 Experiment
### Experimental Setup
Parameter ntry indicates how many linear combinations to try to determine the best threshold. * **Deep Autoencoding Gaussian Mixture Model with Extended Isolation Forest**: The same configurations were used to configure the DAGMM-EIF algorithm as were used to evaluate the algorithms individually. * **Deep Autoencoder**: The neural network used by the Deep Autoencoder algorithm was trained through the Adam [33] optimization algorithm with a learning rate of 0.0001. The number of epochs used in the training phase was 30 for the KDDCUP99 and NSL-KDD datasets and 20 for the CIC-IDS2017 dataset. The neural network uses the Rectified Linear Unit activation function. For the KDDCUP99 and NSL-KDD datasets, the network consists of the following layers: an input layer made up of 38 nodes, which contain the features of a record of the dataset; 3 hidden layers made up of 26, 12 (which represent the compression carried out on the input record), and 26 nodes; and an output layer made up of 38 nodes, which contain the reconstructed features of the input record. For the CIC-IDS2017 dataset, the network has an input layer and an output layer of 78 nodes (corresponding to the dataset features and reconstructed features) and 5 hidden layers made up of 50, 25, 10 (which represent the compression carried out on the input record), 25, and 50 nodes. * **Deep Autoencoder with Extended Isolation Forest**: The same configurations were used to configure the DA-EIF algorithm as were used to evaluate the algorithms individually. * **Deep Structured Energy Based Models for Anomaly Detection**: The configuration reported in [19] for the KDDCUP99 dataset was used to configure the DSEBM algorithm. The neural network of the DSEBM algorithm was trained through the Adam optimization algorithm [33] with a learning rate of 0.0001. The number of epochs used for the training process was 20. * **Memory-Augmented Deep Autoencoder**: The configuration reported in [20] for the KDDCUP99 dataset was used to configure the MemAE algorithm. For the memory module, the parameter N was configured equal to 50. The neural network of the MemAE algorithm was trained through the Adam optimization algorithm [33] using a learning rate of 0.00001 for the KDDCUP99 and NSL-KDD datasets and of 0.0001 for the CIC-IDS2017 dataset. The epochs used in training phase for KDDCUP99 and CIC-IDS2017 numbered 30, while 20 were used for NSL-KDD. The neural network uses the function of hyperbolic tangent activation, and the following layers constitute it: an input layer and output layer with number of nodes equal to the number of features in a single dataset record (38 for KDDCUP99 and NSL-KDD, 78 for CIC-IDS2017), in which the input layer receives the sample and the output layer represents the reconstructed sample; and 9 hidden layers constituted respectively by 120, 60, 30, 10, 3 (which represent the compression made on the record given in input), 10, 30, 60, and 120 nodes. * **Memory-Augmented Deep Autoencoder with Extended Isolation Forest**: The same configurations were used to configure the MemAE-EIF algorithm as were used to evaluate the algorithms individually.