# A Two-Stage Anomaly Detection Method Based on User Preference Features and the Deep Fusion Model
## 4 Results
### Performance Analysis  
In order to justify the use of the deep fusion models as the classifier, we conducted the ablation experiment using various other machine learning algorithms as the classifier. Random forests [16], decision trees [17], gradient boosting trees, and linear support vector machine classifiers are considered in the experiment, which are denoted as RF-based, DT-based, GBT-based, and SVM-based. The parameters of various detection algorithms are set as follows: the maximum depth of the random forest tree is 10, and the number of trees is 30; the maximum depth of the decision tree is 20; the maximum depth of the tree in the gradient boosting tree is 10, and the number of iterations is 10; multi-layer linear perception The device has four layers: the hidden layer is a two-layer neural network structure, which contains sixteen and eight neurons, respectively; the output layer is composed of two neurons; the linear support vector machine uses a linear function as the kernel function; and the number of iterations is ten. The regularization parameter is set to 0.1, and the aggregation depth is 2. The above algorithms run in the Spark cluster by writing the Spark driver and sending it to the master host.  
The experimental results are shown in Table 1 and Figure 6, where the results of the methods [18; 19] are reported in the references and the precision result is not provided in [18]. Among all the methods, the proposed method achieves the best detection effect; the detection accuracy rate is 96.1%, and the F1 score is 0.9595, indicating that the proposed method has the best classification performance under this data set. Among the machine learning methods based on tree structure, GBT-based methods achieve better performance than DT-based and RF-based methods, with a detection accuracy rate of 95.93%. Compared with other methods, the detection accuracy of the SVM-based method is relatively low. This is because the linear SVM method cannot very well deal with high-dimensional data, as the data set includes a total of 79 dimensional network features for attack detection.  
The proposed method is also compared with two typical methods: one based on AdaBoost [18] and its improved version [19], which has better detection performance by leveraging synthetic minority oversampling, principal component analysis, and ensemble feature selection. The experimental results are shown in Table 2 and Figure 7. It can be seen from Table 2 and Figure 4 that the proposed method achieves better detection performance than the typical methods [18; 19].  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Methods** & **Accuracy (\%)** & **Recall (\%)** & **Precision (\%)** & **F1-Score** \\ \hline RandomForest & 94.04 & 94.04 & 94.28 & 0.9362 \\ DecisionTree & 95.30 & 95.29 & 95.23 & 0.9511 \\ GradientBoostedTree & 95.93 & 95.93 & 95.96 & 0.9579 \\
**Proposed method** & **96.10** & **96.10** & **96.15** & **0.9595** \\ SVM & 91.74 & 91.73 & 91.67 & 0.9108 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Detection performance of the models using various types of classifiers.