# Resampling Imbalanced Network Intrusion Datasets to Identify Rare Attacks
## 8 Results and Discussion
### Resampling before and after Splitting
#### 8.2.2 Random Undersampling after Stratified Splitting
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Welch’s \(t\)-Test** & \multirow{2}{*}{**Precision (\(\boldsymbol{\
u<0.10\))**}} & \multirow{2}{*}{**Precision \(\boldsymbol{t}\)-Value**} & \multirow{2}{*}{**Recall \(\boldsymbol{t}\)-Value**} & \multirow{2}{*}{**F-Score \(\boldsymbol{t}\)-Value**} & \multirow{2}{*}{**Macro Precision**} \\  & & & & & \(\boldsymbol{t}\)-Value \\ \hline \multirow{3}{*}{0.1 vs. 0.2} & 1.252 & \(-\)0.344 & 0.858 & 1.252 & 0.1 and 0.2 are \\  & & & & & statistically equal \\  & 0.1 vs. 0.3 & 0.348 & \(-\)0.632 & \(-\)0.286 & 0.348 & 0.1 and 0.3 are \\  & 0.1 vs. 0.4 & 1.023 & \(-\)0.697 & 0.611 & 1.023 & 0.1 and 0.4 are \\  & & & & & & statistically equal \\  & 0.1 vs. 0.5 & 0.704 & \(-\)1.528 & \(-\)0.047 & 0.704 & statistically equal, \\  & & & & & & 0.5 has better \\  & & & & & & recall \\  & 0.1 vs. 0.6 & 1.204 & 0 & 1.06 & 1.204 & 0.5 and 0.6 are \\  & 0.1 vs. 0.7 & 0.814 & 0.49 & 0.936 & 0.814 & 0.5 and 0.7 are \\  & & & & & & statistically equal \\  & 0.1 vs. 0.8 & 2.461 & 0.23 & 2.653 & 2.461 & 0.8 except for recall \\  & 0.1 vs. 0.9 & 0.786 & 0.563 & 1.112 & 0.786 & 0.5 and 0.9 are \\  & & & & & & statistically equal \\  & 0.1 vs. 1 & 0.408 & 1.162 & 1.22 & 0.408 & 0.5 and 1.0 are \\ \hline \hline \end{tabular}
\end{table} 
Table 21: UWF-ZeekData22: credential access—classification results for random undersampling after splitting. Table 23 presents the classification results for Random Undersampling After Splitting for Privilege Escalation (UWF-ZeekData22) for the various oversampling percentages (0.1 to 1.0, at intervals of 0.1). The best results are highlighted in green. Results of [PERSON]'s \(t\)-tests for UNSW-NB15 Backdoors for Random Undersampling after Splitting (Table 23) are presented in Table 24. Based on the analysis in Table 24, the best results were obtained at 0.1 oversampling for privilege escalation (highlighted in green in Table 23). Again, although there are sampling ratios that are statistically equivalent to 0.1 (as shown in Table 24), 0.1 was chosen as the best since it has the smallest amount of oversampled data, thus taking the least computational time. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**[PERSON]’s \(t\)-Test** & **Precision \(t\)-Value** & **Recall \(t\)-Value** & **F-Score \(t\)-Value** & **Macro Precision** & **Analysis** \\ \hline
0.1 vs. 0.2 & 0.929 & 0.179 & 0.611 & 0.929 & 0.1 and 0.2 are statistically equal \\
0.1 vs. 0.3 & 1.012 & \(-\)0.611 & 0.118 & 1.012 & 0.1 and 0.3 are statistically equal \\
0.1 vs. 0.4 & 0.817 & \(-\)0.367 & \(-\)0.08 & 0.817 & 0.1 and 0.4 are statistically equal \\
0.1 vs. 0.5 & 0.541 & \(-\)0.611 & \(-\)0.307 & 0.541 & 0.1 and 0.4 are statistically equal \\
0.1 vs. 0.6 & 2.1 & \(-\)1.552 & \(-\)0.344 & 2.1 & 0.1 is better than 0.6 except for recall \\
0.1 vs. 0.7 & 2.52 & \(-\)1.638 & \(-\)0.086 & 2.52 & 0.1 is better than 0.7 except for recall \\
0.1 vs. 0.8 & 2.606 & \(-\)1.391 & \(-\)0.027 & 2.606 & 0.1 is better than 0.8 except for recall \\ \hline \hline \end{tabular}
\end{table} 
Table 24: [PERSON]’s \(t\)-test results: UWF-ZeekData22: privilege escalation—random undersampling after splitting.