# Graph-Based Multi-Label Classification for WiFi Network Traffic Analysis
## 3 Dataset Description
### Supervised Exclusive and Non-Exclusive Problems Definitions  
In this section, we formally introduce the supervised problems that we are going to explore and analyze in this paper.  
Due to the complexity of non-exclusive (multi-label) supervised problems, we need to define a baseline problem in order to be able to compare testing results. To this end, we aim to verify classification accuracy of the proposed approach in a basic situation where the main objective consists of distinguishing normal traffic from anomalies.  
The problem is defined as the search of the best set of hyperparameters so that we can effectively approximate the target process \(p:X\to\mathcal{L}\), which maps to each instance of the input space \(X\), a specific label of the set \(\mathcal{L}=\{normal,anomaly\}\).  
Hence, all traffic flows belonging to any kind of anomaly/attack form a single class in this problem statement. In this way, we can perform a starting analysis of the Granular Computing capabilities of the GRALG classification system, trying to isolate key substructures of complex, heterogeneous network traffic.  
To further improve the above definition, we consider that the analysis on different semantic levels of telecommunication networks implies the association of a set of labels to each kind of structured data that represents multiple network packets.  
For this reason, we tackle a new supervised problem \(p_{ML}:X_{g}\to\mathcal{M}\) where each network graph of the starting structured space \(X_{g}\) is mapped to a multi-label (a specific set of labels) that belongs to \(\mathcal{M}\). In this way, we build a system that automatically learns this association and tries to give insight into label relationships.  
Lastly, by considering the different nature of the two supervised problems, we take into account the mean accuracy and the Jaccard similarity score as performance metrics. The rationale behind these choices follows. Since the number of instances per class are unbalanced, a mean accuracy measure is required in order to avoid implicit weighting  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Class Name** & \(\mathcal{S}\) \\ \hline normal & 530,785 \\ amok & 477 \\ arp & 13,644 \\ beacon & 599 \\ cafe\_lattice & 379 \\ chop\_chop & 2871 \\ cts & 1759 \\ deauthentication & 4445 \\ disassociation & 84 \\ evil\_twin & 611 \\ fragmentation & 167 \\ hirte & 19,089 \\ power\_saving & 165 \\ probe\_request & 369 \\ rts & 199 \\ \hline
**Multi-Label Graphs** & \(\mathcal{S}_{\text{tr}}^{(g)}\) & \(\mathcal{S}_{\text{vd}}^{(g)}\) & \(\mathcal{S}_{\text{bs}}^{(g)}\) \\ \hline \(B=10\) & 414,456 & 46,051 & 115,127 \\ \(B=20\) & 414,454 & 46,050 & 115,125 \\ \(B=50\) & 414,444 & 46,047 & 115,119 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Patterns and graphs’ distribution. Per label single instances’ distribution and multi-labeled network graph splits.  
phenomena. On the other hand, the non-exclusive supervised problem requires a specific performance metric, namely the Jaccard similarity score [29], which is defined as follows:  
\[J_{i,j}=\frac{\omega_{i}^{(m)}\bigcap\omega_{j}^{(m)}}{\omega_{i}^{(m)}\bigcup \omega_{j}^{(m)}} \tag{6}\]  
The definition holds for a specific pair of multi-labels \(\omega_{i}^{(m)}\). This measure can be extended to the entire dataset, by taking the mean value of all the measures obtained.