# Graph-Based Multi-Label Classification for WiFi Network Traffic Analysis
## 6 Results

Table 5: Jaccard similarity score and complexity obtained for the non-exclusive supervised problem as a function of both the buffer length \(B\) and the maximum compressed training set size \(Q_{\text{max}}=|\mathcal{S}_{\text{tr}}^{(g)}|\). over, decision surfaces of the non-exclusive problem are less defined and precise than those taken from the binary classification problem, resulting in slightly better performances in the latter case. As regards the model complexities, GRALG's alphabet cardinality is high during the first optimization stage (in the order of hundreds of symbols), and correctly filtered in the second stage. Results also show that the GNN needs to process graphs mainly considering the second order neighborhood in order to maximize the performances: we think that this aspect is linked to the size of the network graphs themselves provided by the AWID dataset. As anticipated before, if we consider the different nature of the supervised problems analyzed in this work, it is not possible to perform a direct and fair comparison with other works (a summary of which can still be found in Table 6). This is due to multiple reasons: first, the supervised problem itself is defined in a completely different domain, in which aggregated data are represented with a graph structure; second, preprocessing patterns in the graph domain require the definition of a non-exclusive supervised problem, where a set of labels should be predicted for each graph instance; lastly, the purpose of the proposed Granular Computing approach consists of both building a human-interpretable white/grey box model and going towards state-of-the-art performances. Anyhow, we can make some considerations regarding currently used approaches and the impact of results. Thus, as a further performance assessment, in the following, we compare the results provided by our approach against those proposed in [11; 14; 43; 44]. In [10], [PERSON] et al. proposed the AWID dataset as a first benchmarking tool for WiFi network intrusion detection analysis. They performed a first analysis of supervised algorithms behavior on this kind of data. Results showed that _impersonation_ and _flooding_ attacks are the most difficult attack classes to recognize, along with the _normal_ class itself. In [1], this result has been confirmed, while at the same time improving final accuracy and providing a first approach to automatic knowledge discovery, by means of a genetic optimization-based feature selection. These results has been further confirmed in [11], where, despite the resulting accuracy of \(\sim\)78%, the proposed algorithm has been able to build human readable _IF-THEN_ rules. In this work, instead of explicitly outputting human-readable rules, we aim to return the information granules of the optimal alphabet \(\mathcal{A}\) resulting from the optimization process. This approach allows us to give insight into the network status, thus isolating key pieces of attack patterns and improving model and classes interpretability. A key aspect that we think is fundamental in this kind of scenario concerns the possibility to further exploit the knowledge discovery capabilities, applying them to analyze peculiar complex classes, e.g., the _normal_ one. Multiple works included different approaches to implement data preprocessing and classification pipeline. For instance, [PERSON] et al. [43] proposed a two-dimensional data cleaning preprocessing strategy able to introduce a new supervised problem which is then tackled with Support Vector Machines. Despite some difficulties in the correct recognition of _impersonation_ and _flooding_ attacks, it has shown interesting accuracy for the _normal_ traffic class. Both the GRALG classification system and the GNN are able to outperform [PERSON]'s work in _impersonation_ recognition, for both the binary supervised problem and the non-exclusive one, with different values of the buffer length \(B\) and the maximum number of clusters \(Q_{\text{max}}\).