# A Local Feature Engineering Strategy to Improve Network Anomaly Detection +
## 7 NSL-KDD Results  
The experimental results related to the process of comparison between the proposed strategy and the canonical use (baseline) of the state-of-the-art classification algorithms (i.e., without the LFE data preprocessing) in the context of the NSL-KDD dataset, are reported in Table 12. In this first view of the results, the performance is expressed in terms of the average value between all the adopted three metrics of evaluation (i.e., specificity, MCC, and AUC), in a similar way to what has been done in other studies [112], and the better average performance of the LFE strategy is denoted with \(+\).  
\begin{table}
\begin{tabular}{l l l l l l} \hline
**Dataset** & **Algorithm** & \(\delta\)**Value** & **Dataset** & **Algorithm** & \(\delta\)**Value** \\ \hline \multirow{6}{*}{DSA} & AB & 12 & & AB & 71 \\  & DT & 120 & & DT & 73 \\  & GB & 27 & RAA & GB & 250 \\  & MP & 7 & & MP & 247 \\  & RF & 6 & & RF & 89 \\ \hline \multirow{6}{*}{NNA} & AB & 125 & & AB & 148 \\  & DT & 158 & & DT & 187 \\  & GB & 135 & RSA & GB & 221 \\  & MP & 112 & & MP & 138 \\  & RF & 77 & & RF & 118 \\ \hline \multirow{6}{*}{PEA} & AB & 171 & & & \\  & DT & 157 & & & \\ \cline{1-1}  & GB & 47 & & & \\ \cline{1-1}  & MP & 70 & & & \\ \cline{1-1}  & RF & 123 & & & \\ \hline \end{tabular}
\end{table}
Table 11: NSL-KDD dataset—optimal \(\delta\) value detection.  
\begin{table}
\begin{tabular}{l l l l l l} \hline
**Dataset** & **Classification** & **Baseline** & **LFE** & **Strategies** & \(p\)**-Value** \\
**Category** & **Algorithm** & **Performance** & **Performance** & **Comparison** & \\ \hline \multirow{6}{*}{DSA} & AB & 0.9759 & 0.9774 & + & \textless{}0.01 \\  & DT & 0.9762 & 0.9811 & + & \textless{}0.01 \\  & GB & 0.9787 & 0.9796 & + & \textless{}0.01 \\  & MP & 0.9274 & 0.9719 & + & \textless{}0.01 \\  & RF & 0.9767 & 0.9762 & - & 0.04 \\ \hline \multirow{6}{*}{NNA} & AB & 0.9225 & 0.9226 & + & \textless{}0.01 \\  & DT & 0.9542 & 0.9535 & - & \textless{}0.01 \\  & GB & 0.9424 & 0.9453 & + & \textless{}0.01 \\  & MP & 0.8326 & 0.9317 & + & \textless{}0.01 \\  & RF & 0.9580 & 0.9523 & - & \textless{}0.01 \\ \hline \multirow{6}{*}{PEA} & AB & 0.6314 & 0.6412 & + & \textless{}0.01 \\  & DT & 0.5385 & 0.6369 & + & \textless{}0.01 \\  & GB & 0.6317 & 0.6512 & + & \textless{}0.01 \\  & MP & 0.2703 & 0.5232 & + & \textless{}0.01 \\  & RF & 0.5399 & 0.6222 & + & 0.07 \\ \hline \multirow{6}{*}{RAA} & AB & 0.8615 & 0.8758 & + & \textless{}0.01 \\  & DT & 0.8841 & 0.8655 & - & 0.18 \\ \cline{1-1}  & GB & 0.8820 & 0.8855 & + & \textless{}0.01 \\ \cline{1-1}  & MP & 0.6005 & 0.8534 & + & \textless{}0.01 \\ \cline{1-1}  & RF & 0.8802 & 0.8681 & - & 1.00 \\ \hline \multirow{6}{*}{RSA} & AB & 0.9515 & 0.9324 & - & \textless{}0.01 \\ \cline{1-1}  & DT & 0.9303 & 0.9436 & + & \textless{}0.01 \\ \cline{1-1}  & GB & 0.9404 & 0.9444 & + & \textless{}0.01 \\ \cline{1-1}  & MP & 0.8498 & 0.9219 & + & \textless{}0.01 \\ \cline{1-1}  & RF & 0.9349 & 0.9425 & + & 0.20 \\ \hline \end{tabular}
\end{table}
Table 12: NSL-KDD dataset—LFE strategy performance comparison.  
The statistical significance of the results was assessed through a _five by two-fold cross-validation paired \(t\)-test_[113]. Thus, we calculated the \(t\)-_values_ for each dataset-algorithm pair, by considering a two-tailed \(t\) distribution with five degrees of freedom. We then considered as significant, with a 0.05 significance level, each strategy comparison (between our LFE approach and the baseline one) where \(t>2.57\). We then computed and reported the resulting \(p\)-_values_, as shown in Table 12.  
These results led us to reject the null hypothesis  
Figure 8: NSL-KDD dataset—MCC mean performance.  
Figure 10: NSL-KDD dataset—overall mean performance in relation to all algorithms.  
Figure 9: NSL-KDD dataset—AUC mean performance.