# Resampling Imbalanced Network Intrusion Datasets to Identify Rare Attacks
## 8 Results and Discussion
### Resampling before and after Splitting
#### 8.2.2 Random Undersampling after Stratified Splitting
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Welch’s \(t\)-Test** & \multirow{2}{*}{**Precision \(t\)-Value**} & \multirow{2}{*}{**Recall \(t\)-Value**} & \multirow{2}{*}{**F-Score \(t\)-Value**} & \multicolumn{2}{c}{**Macro Precision**} & \multirow{2}{*}{**Analysis**} \\
**Results (\(p\) \(<\) 0.10)** & & & & & \\ \hline
0.1 vs. 0.2 & 0.183 & 0.799 & 0.612 & 0.183 & No significant \\  & & & & & difference \\  & & & & & 0.1 is better than 0.3 \\
0.1 vs. 0.3 & 1.413 & \(-\)1.563 & 0.592 & 1.413 & in precision and \\  & & & & & macro precision, but \\  & & & & & 0.3 is better in recall \\  & & & & & 0.1 is better than 0.4 \\
0.1 vs. 0.4 & 1.773 & \(-\)1.826 & 0.628 & 1.773 & in precision and \\  & & & & & macro precision, but \\  & & & & & 0.3 is better in recall \\
0.1 vs. 0.5 & 0.836 & \(-\)0.065 & 0.506 & 0.836 & 0.1 and 0.5 are \\  & & & & & statistically equal \\
0.1 vs. 0.6 & 0.451 & \(-\)0.957 & 0.264 & 0.451 & 0.1 and 0.6 are \\  & & & & & statistically equal \\
0.1 vs. 0.7 & \(-\)0.431 & \(-\)0.859 & \(-\)0.706 & \(-\)0.431 & 0.1 and 0.7 are \\  & & & & & statistically equal \\
0.1 vs. 0.8 & 2.052 & 0.959 & 2.5 & 2.826 & except for recall, \\  & & & & & where both of them \\  & & & & & are statistically equal \\
0.1 vs. 0.9 & 0.821 & 0.745 & 1.131 & 0.821 & 0.1 and 0.9 are \\  & & & & & statically equal \\
0.1 vs. 1 & 0.219 & \(-\)0.746 & \(-\)0.033 & 0.302 & 0.1 and 1 are \\  & & & & & statically equal \\ \hline \hline \end{tabular}
\end{table} 
Table 16: [PERSON]’s \(t\)-test results: UNSW-NB15: Worms—random undersampling after splitting. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Oversampling \%** & \multicolumn{2}{c}{**Accuracy**} & **Precision** & **Recall** & **F-Score** & **Macro Precision** \\ \hline
0.1 & Avg & 0.999 & 0.698 & 0.906 & 0.788 & 0.849 \\  & SD & NA & 0.016 & 0.017 & 0.010 & 0.008 \\
0.2 & Avg & 0.999 & 0.694 & 0.907 & 0.786 & 0.847 \\  & SD & NA & 0.016 & 0.015 & 0.011 & 0.008 \\  & Avg & 0.999 & 0.691 & 0.911 & 0.786 & 0.846 \\
0.3 & SD & NA & 0.017 & 0.015 & 0.011 & 0.008 \\  & Avg & 0.999 & 0.686 & 0.905 & 0.780 & 0.843 \\
0.4 & SD & NA & 0.014 & 0.011 & 0.010 & 0.007 \\  & Avg & 0.999 & 0.678 & 0.906 & 0.776 & 0.839 \\
0.5 & SD & NA & 0.011 & 0.014 & 0.008 & 0.005 \\  & Avg & 0.999 & 0.699 & 0.908 & 0.790 & 0.849 \\  & SD & NA & 0.020 & 0.003 & 0.013 & 0.010 \\  & Avg & 0.999 & 0.699 & 0.908 & 0.790 & 0.849 \\
0.7 & SD & NA & 0.021 & 0.016 & 0.016 & 0.011 \\  & Avg & 0.999 & 0.692 & 0.911 & 0.787 & 0.846 \\
0.8 & SD & NA & 0.011 & 0.021 & 0.013 & 0.006 \\ \hline \hline \end{tabular}
\end{table} 
Table 17: UNSW-NB15: Shellcode—classification results for random undersampling after splitting. Table 19 presents the classification results for Random Undersampling After Splitting for Backdoors (UNSW-NB15) for the various oversampling percentages (0.1 to 1.0, at intervals of 0.1). The best results are highlighted in green. Results of [PERSON]'s \(t\)-tests for UNSW-NB15 Backdoors for Random Undersampling after Splitting (Table 19) are presented in Table 20. Based on the analysis in Table 20, the best results were obtained at 0.1 oversampling for Backdoors (highlighted in green in Table 19). Again, although there are sampling ratios that are statistically equivalent to 0.1 (as shown in Table 20), 0.1 was chosen as the best since it has the smallest amount of oversampled data, thus taking the least computational time. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Oversampling \%** & \multicolumn{2}{c}{**Accuracy**} & **Precision** & **Recall** & **F-Score** & **Macro Precision** \\ \hline \multirow{3}{*}{0.9} & Avg & 0.999 & 0.688 & 0.901 & 0.780 & 0.844 \\  & SD & NA & 0.021 & 0.010 & 0.015 & 0.011 \\  & Avg & 0.999 & 0.688 & 0.888 & 0.775 & 0.844 \\ \multirow{3}{*}{1.0} & SD & NA & 0.018 & 0.015 & 0.016 & 0.009 \\  & Averages & 0.999 & 0.6913 & 0.9051 & 0.7838 & 0.8456 \\ \hline \hline \end{tabular}
\end{table} 
Table 17: _Cont._